{ "Event": { "published": true, "date": "2022-04-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-04-01", "timestamp": 1648857781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "50e938d3-7d36-43ce-aec3-597569b67013", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e703bd-b183-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648794054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794054, "uuid": "488c7766-014e-460d-b9ce-15519901762a", "comment": "Malware payload (Heodo)", "value": "cce2ae6faa57a49a06207d756e2f4cde", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794054, "uuid": "5e20a303-5000-4002-b070-635f018281e9", "comment": "Malware payload (Heodo)", "value": "000cc33e07a54efdd93292b770d056894faa9a41eb9c1c22bf1507365a35ed64", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794054, "uuid": "23e812cc-c438-45fc-a826-9fa08c3473d2", "comment": "Malware payload (Heodo)", "value": "2096444c7e95cd69b62747a656fc192755683a6f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794054, "uuid": "149f75f8-3161-4910-93b1-cd8daf6fdb12", "comment": "Malware payload (Heodo)", "value": "9a0dbb617bc4ec5a0b302a1e3b79096b08976664a6390d116089a123203e795f90edce7b32b259b5d2f42bb51bb0ca8c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794054, "uuid": "b0934f5b-1a53-4750-a599-bc1228228aac", "value": "T1D1E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794054, "uuid": "e790427e-82ec-496a-b97a-e9cdbf52d22c", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648794054, "uuid": "963fa96d-8582-4ecc-81f5-c80d8938cf8d", "value": 145753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648794054, "uuid": "f08c60f7-eab6-46b1-b3a7-cfbb83a620a8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794054, "uuid": "15671784-e6ab-49c4-8beb-0df7ead6d581", "value": "hospital_data.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa12c9c1-b18b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648797395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648797395, "uuid": "9e2620cd-6b60-432c-bfb1-64cdcf27bc28", "comment": "Malware payload (RedLineStealer)", "value": "9f22650677a4ae002014fc4c0991924f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648797395, "uuid": "d9a01f03-eff2-4d27-a416-6b8cb6f9af5c", "comment": "Malware payload (RedLineStealer)", "value": "005445511b9679a83c6084ceff690e0884c38db3b86935ed8b54a80fee300cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648797395, "uuid": "f2df95bd-6384-404e-999c-e6c4ce0788c1", "comment": "Malware payload (RedLineStealer)", "value": "78368b1be0e220397817fffc4022f8e1255e896d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648797395, "uuid": "6855f825-5f78-45bd-b05a-a2ea298c2bd4", "comment": "Malware payload (RedLineStealer)", "value": "aa882b69c24b3a90e49c795f5d35f7be15e55b517a04a60eaddd165ded1a5e815711a5a3b83b5059af9ebe490278dd7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648797395, "uuid": "d6156f15-e248-43e4-8d70-2ddf13b50ae2", "value": "T13F94E0F577AD9871D443363094A58BB0A73EAC31E46046473634262E2EB3ECC9AF535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648797395, "uuid": "5b2a633c-0cfc-4c47-a442-d8bc679aeb1f", "value": "922156201fd93362d05e92765cb2408d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648797395, "uuid": "2f53b1cf-80d1-4185-b1bc-377bdff3e2ac", "value": "12288:2Jf7ZelqZ9cgvOaEv1wbQWAunnwQ7G7Eb:KNel6cgvO5vObQWLw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648797395, "uuid": "ec198cf9-9cfc-4637-9b66-c472bb8b5a76", "value": 435712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648797395, "uuid": "20034eee-39a9-4af5-88af-7093cc8327c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648797395, "uuid": "61b85f0d-b798-4786-9704-b3bd95d65b69", "value": "9f22650677a4ae002014fc4c0991924f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984d380d-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648819699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819699, "uuid": "30cd9e1b-d90b-4aaa-8da3-c2896d90423e", "comment": "Malware payload (Formbook)", "value": "0ee7839317a553b568adfb4fe3891c80", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819699, "uuid": "f43655c4-1915-40cb-98c8-779fd0d4fe89", "comment": "Malware payload (Formbook)", "value": "016868478c37affcf3757be982982233ee1833b997467d2c743027d6bc69f994", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819699, "uuid": "596764af-cbc1-4ef9-97c5-1f97a2d17de7", "comment": "Malware payload (Formbook)", "value": "4977210e5e526a8136abe47377b0ec5a6f51eee1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819699, "uuid": "b452ba8f-0b7f-4650-b02c-1c45beb19c68", "comment": "Malware payload (Formbook)", "value": "ef9932599670f3408022982c6ba2e7b6df44300a9ebc308b5f1d1db8969d225c6a4fde37ad3ce09f8a48179e9f47b934", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819699, "uuid": "e9b226ee-9738-4387-b45d-27c2034d3d02", "value": "T1AC1412717AB3C947E45FF63EAC2590780265BC66EFCAF4C528013F21F679D29A4404B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819699, "uuid": "9dea9bd3-625b-407d-8a1f-71a10909249e", "value": "3072:YujrSttFlpmp/hVt+OoBV5LpbTItHdAYV8qXqAvgUmRfjZnK:5jrmroxhv+9LgZKGXqAG9nK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819699, "uuid": "1b1eda79-5bf4-45b0-9097-191abac06ee2", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819699, "uuid": "d739ee5c-8ccc-4b5b-aaea-b7d554817748", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819699, "uuid": "c8170523-dde8-4ec7-97fe-34e427bc54ff", "value": "pedido del proveedor_457525.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f486dd4-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819657, "uuid": "019a1966-cf16-45fe-9e86-5885d71f9e4a", "comment": "Malware payload (Loki)", "value": "5f5a6385de7f7c5a71cea07c4064603c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819657, "uuid": "7f59f13e-a1c9-4af3-a44a-ed18c425287c", "comment": "Malware payload (Loki)", "value": "019b81ebdac7db55b2a2927a5d1bd25a2ff1d7c3cdb33f53669953768cbc723a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819657, "uuid": "558e15fb-83cf-4d4c-bfe6-4cd1ff14f5cc", "comment": "Malware payload (Loki)", "value": "705d88b20337d03e50b30a86a1119928929bf421", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819657, "uuid": "e1f9d5f2-ad53-458c-9483-504625bfd30d", "comment": "Malware payload (Loki)", "value": "ef9937b597f7972813749375419a0fb8c4a00672defb2ccc971a9569516a79df427acc29e13fe79762730d2ad45d8d9a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819657, "uuid": "d00b02d0-e4b1-47e1-8dfd-ca77c6efa3ad", "value": "T168141211B99B811BE0014931CF6D5BED06AFFC65C84DE0273F513A988ABA4FC257D5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819657, "uuid": "8e3eec21-288c-478d-913c-63a3fff4964e", "value": "3072:UPglbvYkKSZp7zGIlb7GbXm8hJm807+6MDmt6ubZoAtLPB0hHYMYE8ZnQix:7EYpvP2bjhE37+6nRCZqE2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819657, "uuid": "92f1b4bd-20f4-4289-b3a8-89a5213d8edc", "value": 191608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819657, "uuid": "5122f278-8f5f-406d-9e06-105900bcb87e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819657, "uuid": "cf6dc822-98ff-4960-b7c0-99b73b6c2ad5", "value": "MV EPIC MADEIRA_ Cargo Docs.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eef8c7a-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648799873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799873, "uuid": "1003da55-5464-42c7-8738-dc6a6ebbdc3e", "comment": "Malware payload (Heodo)", "value": "adf7e518fa3ddc62aa5483b6881ec0be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799873, "uuid": "4deed541-61d4-49a5-ac1a-c339a5020190", "comment": "Malware payload (Heodo)", "value": "0333e8920b819296c6e44a9ad7db127a1845dc6497b0b4cf01e42f17fc2d9571", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799873, "uuid": "c7c4731c-60b2-43cc-982e-7b7eef9bd8aa", "comment": "Malware payload (Heodo)", "value": "17aacbdde7739e6314011b9fb164619bb75449e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799873, "uuid": "b4483112-cce7-4a60-876c-679b277ab3b0", "comment": "Malware payload (Heodo)", "value": "acd4c3138a668734242dfbb65ff34a7525a93be31962b8c337d9ce30b2e6328199ac137bf27b440de965f8a412e6eb23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799873, "uuid": "c47bda5a-ad5b-43ca-87e7-5d69f0ecb58f", "value": "T1FCB4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799873, "uuid": "5b70ac0b-52af-4ec8-af26-26765fbff51b", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799873, "uuid": "700e3874-fa91-402c-8489-a314e8e335dc", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQhJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWz3DIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648799873, "uuid": "5bb8d960-3078-4b96-b659-d1d3163deb6b", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648799873, "uuid": "4a16d4e7-37c5-4498-868f-82cc34d59f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799873, "uuid": "c6c745a3-e759-4c24-bf78-4f3a061939eb", "value": "adf7e518fa3ddc62aa5483b6881ec0be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50c8560-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648818942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818942, "uuid": "423b3a7f-f332-4be7-ac70-b9338f8101c8", "comment": "Malware payload (RedLineStealer)", "value": "ddf0fc0dc0f16df6f2e8da9ba6006920", "object_relation": "md5", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818942, "uuid": "f27ed324-4801-4e8b-839a-13e399485b2d", "comment": "Malware payload (RedLineStealer)", "value": "035135ef9ff11b79d5904a8ea08a1a430e6d9ca3d75bb30c0bd47d0f72486153", "object_relation": "sha256", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818942, "uuid": "9a167876-2cef-4595-aa60-0da931bbeeb8", "comment": "Malware payload (RedLineStealer)", "value": "8abd399b7f691edb07c705f2e9db3b806ed21b55", "object_relation": "sha1", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818942, "uuid": "a338dad9-92e6-46db-939d-5be4ca5b5ec3", "comment": "Malware payload (RedLineStealer)", "value": "effc3044eee9bbeeba2d88d89626bf8e39b2df24bf8d6b0030c70617ee5423b530b961c60a2979f399c50811328690e0", "object_relation": "sha3-384", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818942, "uuid": "02d19a3f-931e-4dc1-84d0-1d5f9d5477a0", "value": "T11E25127E0F0602D8E1EF7036C46F7645AE623FAE15615D980229742E483E12E94FF6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818942, "uuid": "745c1f22-6254-4340-8e59-d2fc65cbcf8f", "value": "10c0bc3b6bc159f16f4e767483ed3004", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818942, "uuid": "f845bec6-dd39-483b-ab7d-d843b2decf08", "value": "24576:nl+ZZZpppppUPe+pEHcwaIfbaWNOeVOgdf4YNHuWMg:l+ZZZpppppUG4EHXaIfba3lYhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818942, "uuid": "543266e5-e2b5-4d84-93f2-8a3b29db9536", "value": 1056896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818942, "uuid": "e2750339-1083-4b60-948b-f7afac1442ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818942, "uuid": "07d3b4aa-27ca-49ea-8a08-5e586ff30d11", "value": "TrdngAnlzr2249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b2aca6-b1ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648817581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817581, "uuid": "6a1d492b-ed24-4ffd-9bbe-5dcc6570eb2f", "comment": "Malware payload (RemcosRAT)", "value": "04630e2256c8182388128e0e970edf87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817581, "uuid": "0b79f104-9358-4094-9612-7a418f5836ef", "comment": "Malware payload (RemcosRAT)", "value": "05cbf177e25c8ffe879437b0f5add370b358f0a8a0451b6bfc8bb3d8f2813e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817581, "uuid": "6345ba4f-f76d-4a8f-a1ca-fa0f354c95b2", "comment": "Malware payload (RemcosRAT)", "value": "07ab5a7709ad3aee12768b514558831406c6b5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817581, "uuid": "3739f3d9-bb1c-49df-a716-2a230f2f2881", "comment": "Malware payload (RemcosRAT)", "value": "557ce81b3ff22d23880ba62f6a5feb69cd9c70f357cec00b8bb09c255221ffb91735924a44f7bfb6f84c75a6a4cc3df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817581, "uuid": "4616ea04-5d3b-4543-89b9-e66848272b04", "value": "T15215A062F2818937C023197F7D1BA2E98837BE512E6875563FE53D4C2F76641392A2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817581, "uuid": "74f24afc-fff9-4a10-a9fb-0187f8b1dfc2", "value": "fdad361144afe229033565a59cbcac71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817581, "uuid": "798e5f0e-4ab0-492a-96f9-af1ba0f32f8f", "value": "12288:cB+PnwfmejogYtFJpFulAJDtHTALKsd/mSf2pSgj3R+li9B8h2+knwcBz:tweOYtFJPulAJDxWKUmSf2x9wSVZwcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648817581, "uuid": "89ac933a-0830-452e-a7ee-19eebf82a292", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648817581, "uuid": "b7e8079a-87a4-4e72-bbac-2b2bb90881dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817581, "uuid": "510b7b16-4bc1-4b2e-a33f-904f2e262cd6", "value": "Waybill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ae5237-b1a1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648806704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806704, "uuid": "d607f6df-3246-4928-9c13-d8cd91de1807", "comment": "Malware payload", "value": "8a6ca9e1054731023ab4c8b85cb84f9b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806704, "uuid": "d27e14ff-204a-4dd3-8221-c17eed39ec21", "comment": "Malware payload", "value": "05d8267bfae7dc004287c2b4a14344ca7e01ab5c8bdce4f190ef10dc949eff64", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806704, "uuid": "d5ef20e2-116d-414c-85e5-59c3f4dbd31c", "comment": "Malware payload", "value": "b2cfebf9d75244f8de8124b8463fb83820197ce6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806704, "uuid": "fda33dba-fcd2-4588-8faf-41bd95dcfea3", "comment": "Malware payload", "value": "ba02e98533d092598b5e4b73f406328f4e71bd16fd40f48bf4625e5a2388547c53d71d7918e4e9825d8d988961c1bb82", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806704, "uuid": "40a50aaf-6fbe-4e11-8edb-8eac771ccc6a", "value": "T19F541E2E43936FB8EF8D21B653ABA64A0E5493E204F98055EDD518E304C3B53F7435AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806704, "uuid": "a3586f18-5ae2-4bb5-accf-e4a94621e07e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806704, "uuid": "df9f99f7-dcbf-40a0-992d-512923b07339", "value": "3072:RDb6k9SQpnwCREe+qeZv44HhNbqLYiq5sg8+rw8wM4klNdZ8dNXU954rvos5COkQ:gkEMH4fqLjg8hE4klNqNXyoTk67gKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806704, "uuid": "f6508c69-59b7-4295-a0bc-73c3a5fa5df5", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806704, "uuid": "a07ea570-68ff-456d-9d5a-da9d2d01f2f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806704, "uuid": "64b56bf2-9ced-4003-8c34-9e81addf8af6", "value": "qte_Jrm_274.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820cb88b-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819662, "uuid": "4b1273dd-ebf7-4e59-a18f-25b1c3c4f10b", "comment": "Malware payload (Loki)", "value": "222445e17440e5ebf7807d374d379171", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819662, "uuid": "82299b92-ef5c-4e56-8c58-d78bcb3397a2", "comment": "Malware payload (Loki)", "value": "06a99077097eff728ad31e3516d13b2a3aa77b5d9b1b3f06ab981e59f6bcb6f3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819662, "uuid": "1426dc90-9e03-44f3-beea-214920011330", "comment": "Malware payload (Loki)", "value": "e9bffccf3b57ca14657b3e2eaa4a6c89cc9e643a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819662, "uuid": "7afc6ee1-ca22-4f5d-bf2d-cfa4a29acf1a", "comment": "Malware payload (Loki)", "value": "7f359e123ffba920a4e3cf84042429842fa285b8dc47d451c756659a4445b509b93865be957ea3a8bcd8f4abdb388d4c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819662, "uuid": "7cb069fc-c175-427f-a90c-8d0b7e1a3671", "value": "T1F414126625B05B01E7770BBE3C9A88289A3EDFBD8654642E6354795FC37C3C14B21371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819662, "uuid": "09b41994-6ee1-443f-ba02-87639b5328b4", "value": "3072:FCpdBlCxfjAiUmvVVwLY0zha2q3djVpcUhtF58pHMYn9eYWcN1Ps54EXc67J6G:+dDCzUmd+LY0FaP3Zz3Mvn9McN1PtEXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819662, "uuid": "88e61cce-0567-458a-8055-d8589f49059c", "value": 192344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819662, "uuid": "e7aa4b60-ceff-44d0-8ba1-648ac1600a05", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819662, "uuid": "c58b1741-c7a5-457d-8e6e-2d2f17f67eb4", "value": "PO2224477.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59828979-b20f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648853953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853953, "uuid": "ba0a2f32-4c0f-4c65-989c-10fa689e29fa", "comment": "Malware payload (Mirai)", "value": "39ce8d0ad4ce516b639f4041447b1d58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853953, "uuid": "2bc338a6-d731-45b3-b01a-31a78ea976ff", "comment": "Malware payload (Mirai)", "value": "06ab74ed178b73ef74ccc24d5bc092600b015745135840c4165c0411e4e9d99d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853953, "uuid": "78a294b3-5504-4da2-808e-885391f5054c", "comment": "Malware payload (Mirai)", "value": "9f9f127adf6ace92c304681cd872148cd61d5778", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853953, "uuid": "8a42b8dd-4b7f-4756-be1d-909389f7b0b1", "comment": "Malware payload (Mirai)", "value": "7de0651e7ff124024d0ef95a06f06a28918a67abba4fdd506045a94f68a8c303f14a98ff93a72a939ca189fa90794ac2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853953, "uuid": "1d905811-c8d0-45c5-bc1e-c3ac7b9ea4c8", "value": "T1D6D34B46FA408B17C4D617B6FAAF414A3322DB94D3DB330699185FF43F86A9E4E13606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853953, "uuid": "7341991d-5886-4b4d-903e-62b381fc1e75", "value": "3072:rlpkszDbZ1v0oa1WKMd9ZHAiUYbjuXxVFxa:rldzDbMl1WKMd9BASbjuXxVFxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648853953, "uuid": "2d743c86-24ce-480d-b081-e5ba3da4df91", "value": 137868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648853953, "uuid": "2d2ffe65-0a53-4b36-9593-71f574e26b23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853953, "uuid": "09098742-055f-4f54-ae66-6a33fabffe36", "value": "arm6-20220401-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8275d36c-b195-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648801623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801623, "uuid": "74c815b6-09f4-4faa-bb06-29635d0ff14a", "comment": "Malware payload (Loki)", "value": "d2c5bd1980bf2f27393f61b8e14c4f84", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801623, "uuid": "3da8ec2c-78e2-4687-a005-f260614ad1a4", "comment": "Malware payload (Loki)", "value": "094d2815e16afb3c956e3195ace96fe090f0519a05e5d7fa031ccc9115144e07", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801623, "uuid": "b9435951-98ed-4a68-9478-0f7c1bb43eca", "comment": "Malware payload (Loki)", "value": "ad104c421572d5b1f0ba3279918406e164fafd44", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801623, "uuid": "4ec5233d-df8a-4c56-9aa5-f0aef99d8579", "comment": "Malware payload (Loki)", "value": "5c300e4b64187924229a5559cd6f63b307e21f064aca3f7af99909666e166137373004c0061ba3256a4929f681fd781a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801623, "uuid": "e8cd0464-cc7c-4929-8174-cd6dac83bddb", "value": "T1CA14021336E9A15CE065497EB64011280DF1AE1A4C26C92C74A6BA0FFDF683F1DD07F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801623, "uuid": "6bfa2a49-b01e-4e4c-b91c-93ac6b72526c", "value": "3072:BP2+7EOOCBqwykCW+KCgAydpYHBQlZIMoo6e7q1ze1tmiYMdUwSKjGdkAQNQHh:gs5zlpC1KdqBu76r1zefLUDuykx6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648801623, "uuid": "477c0aa1-c603-479b-9ee4-831cfdba28c3", "value": 192184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648801623, "uuid": "ed0a58d8-3c12-45c0-97bc-abb5d34dcfc5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801623, "uuid": "ff3169ba-428a-46e8-b3ef-dea53a48e2de", "value": "Order24422.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdfcea9-b1b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1648813887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813887, "uuid": "cf5d63c5-bdc7-4eb8-b177-3db871fd0c9d", "comment": "Malware payload (GuLoader)", "value": "6b48e5d0b4c85889499273e47de85b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813887, "uuid": "e2ed7d82-4f49-49b8-8acf-9e2c4d2700fb", "comment": "Malware payload (GuLoader)", "value": "09b3b8a4933696acf7585e19d17045af88d17aba682eb437291a2ccdd5e76ba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813887, "uuid": "4a469788-94e5-4e48-9fd8-5f5826b46f48", "comment": "Malware payload (GuLoader)", "value": "ee3d01bb586eb4162a624e982859066c5f16fa4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813887, "uuid": "724fe293-3d86-4085-a650-1395428d5402", "comment": "Malware payload (GuLoader)", "value": "56c80d2e2181676d6905d21ff7c7b903d0803feb974a4754f7f55ca2ec6a85ca4daa4af283ec13f3310d89c8a5b08e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813887, "uuid": "56d1722d-1297-463b-9047-e3405679c676", "value": "T16AD3F1405674D467F8D25B305C22DB23AEFAAD213871522B17A46B0F3CB6391A72F74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813887, "uuid": "c88ce897-9c67-4d8e-9fe6-8613175fc038", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813887, "uuid": "8a3b875e-9b0b-4c0f-9aa1-ab048f51cffd", "value": "3072:u3yddvw8pSutvb0W1XUpvmSIxUidIOoYPAFEA/TDbtONOwOL:u3yztL0o+mS/OvAFE0hONOwOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648813887, "uuid": "6a6b8527-8fbf-4c4c-bac1-2687d0af9a2e", "value": 130656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648813887, "uuid": "1960d35f-2f31-4b0a-8424-4148dbf71784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813887, "uuid": "c8b45dda-e470-4529-8afd-52400b8f6910", "value": "invoice28dhldetails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963515f8-b1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648822702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822702, "uuid": "d2faef66-5bd4-44fa-b2ac-280ae40117bd", "comment": "Malware payload", "value": "6245829104de1cd569271e5fc2967d3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822702, "uuid": "eced5384-9c7a-405d-bca9-f482cda1d43f", "comment": "Malware payload", "value": "0d284d4245e546f47598646af31e8baf554775640fa8f2ee7a62608b370ad561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822702, "uuid": "bf8aa337-5e0c-41be-a0c3-a47d8f52e0ea", "comment": "Malware payload", "value": "d16cd6056bb19210fc9f1132911b14d868b95d8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822702, "uuid": "916508ea-a4a0-4b0e-960d-1ebe7f49b8d5", "comment": "Malware payload", "value": "d1febed4693255c8d8d615ca249b36880dff49ae4d5c4e88c8014b0f1ff73076afb92ea3d869d134e3ca41083cc1f20a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822702, "uuid": "61d109a6-52d1-426c-a4a4-3adb4731c506", "value": "T1B7B5233E2054E381CCD4DA7BC8E9E5ED436CDFD1E693A74651823D5028B267E4289EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822702, "uuid": "d2dbebb3-3d5c-4a39-8586-b367d533bede", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822702, "uuid": "72245811-6330-4cc6-9c09-ade747474948", "value": "49152:F4kduskZkROrPrv5BPNVsUU7N1g6/9A7yl3sp45wtlIRNSCMXiXd6CeX:F4EquRO3vHlCX7XsQPvbg3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648822702, "uuid": "22455a77-f4e8-4bff-82bf-41041eab09ef", "value": 2363932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648822702, "uuid": "87e32378-9a03-4e5b-9ada-d69e200e2db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822702, "uuid": "50563d34-27ad-410d-8325-ef238492e759", "value": "6245829104de1cd569271e5fc2967d3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e153f8a0-b1c7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648823257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823257, "uuid": "87498aec-e9c2-47dc-8545-ef9e3bbddafa", "comment": "Malware payload", "value": "ae69335fc5a845be550b5fd8780edac4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823257, "uuid": "ef97b3a2-a799-44f6-9911-dd88b8346ef7", "comment": "Malware payload", "value": "0d39fdc74c89e90f5952fc1352a22d9c1ed239453e5f6d98805aaeeedbce3022", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823257, "uuid": "34a5f36b-d88d-4dc3-aa30-13c0c013b1ca", "comment": "Malware payload", "value": "63b60d5828b694bbfdfa2110c3f7bf1ad1ca8902", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823257, "uuid": "856e9f56-51af-447b-9f36-e06a2b2861fc", "comment": "Malware payload", "value": "91a4f713507d0ad1849310d43c1aae460b14f1fbdf5e28b74f31b5c1ed75fccde0c0015488fabb73dcfafa476aaa7b96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823257, "uuid": "89b33656-485c-4849-84b1-7cbb4953914c", "value": "T13BE401B99EC7FCE7C1AB15301527AB16C842FD0B111AAA26781778CDE5F0B503E1F589", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823257, "uuid": "d749fedc-ff9b-4ff1-8a06-0a8ea3d1f6a6", "value": "a2649b5e86db7b661621f04c86736797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823257, "uuid": "70b4468c-68f0-4f75-9cfc-d48fc3bd9930", "value": "12288:UrBK1pvTD1NLVYHJXSuH350FwmVaoJAj3SGdnGLWZWMCyM+9xYWU:EB4VTD1NkXFpYwm5qj3vGa0Md9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823257, "uuid": "233095de-f27f-4149-9c6e-19caa01453fd", "value": 698080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823257, "uuid": "321e40ca-4093-46ac-895f-1e8022babbcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823257, "uuid": "130e950b-0fbf-4a67-9cc9-d26b58efe6d3", "value": "ae69335fc5a845be550b5fd8780edac4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ebe707-b1de-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648832982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648832982, "uuid": "e32ad85c-c35b-4046-8cf9-b3e8634f6bfc", "comment": "Malware payload (Heodo)", "value": "ab6db015339295bab2079228b4cde9e4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pwd", "colour": "#7978E0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648832982, "uuid": "15ca2cc9-d6f7-4d96-abcd-1d96c72485cb", "comment": "Malware payload (Heodo)", "value": "0db34073c0ac9ec851eb2ded3e695a665df1ceb243429c78ea03330693628a50", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pwd", "colour": "#7978E0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648832982, "uuid": "d90f884c-6256-46b7-8d8d-be31262b269d", "comment": "Malware payload (Heodo)", "value": "540a4623983f6f55808dc03d18baabe1a23e9b98", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pwd", "colour": "#7978E0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648832982, "uuid": "e85ae273-8e91-4fae-bb15-83995bdab3c0", "comment": "Malware payload (Heodo)", "value": "a3d1184bc512e2bfc2e6bca8071d648bef18ec275981eb3fca3d52c3a956e9087ca90b4f2e2d1315899df89dad2fd6bd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pwd", "colour": "#7978E0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648832982, "uuid": "d4e7d33c-ece3-4db6-802e-0ae7861b6bf8", "value": "T1FAA2E1C916184B6F7896B1077E44B55027E3A0D1523C4F1DA4D034A388EFFD8AAF6A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648832982, "uuid": "095ce1c6-04da-4a8f-8808-4463a1c66a6e", "value": "384:R5GC5dob/L/WLiq97OJyvVAyEXNNgQa4tfcZBbOgyXvSsh8kZ:rGC5dAyLiqdOw9REX8QrtSNyfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648832982, "uuid": "c0930b95-37f2-45af-837f-a4fe397daee7", "value": 22364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648832982, "uuid": "28013456-3e25-49be-9049-e4efbf82f58b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648832982, "uuid": "b2fbf0c0-33b0-4f5a-ba28-a746915d4f59", "value": "doc-935.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de367608-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819387, "uuid": "d3e88df0-876c-419d-aa6c-27b8bae0ba76", "comment": "Malware payload (SnakeKeylogger)", "value": "8312fd919aaaef97f04b424f24afec62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819387, "uuid": "32309c73-7e01-4903-b24a-5ae72156ea97", "comment": "Malware payload (SnakeKeylogger)", "value": "0e2a40ce14f7b22fba7de8573742a528b140768bc657fa43133257705872aab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819387, "uuid": "b17369ef-f8b6-44e5-a70c-5e75c6f82e86", "comment": "Malware payload (SnakeKeylogger)", "value": "78108bd60ca3c401e9f4f704c5bf0de51f72d177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819387, "uuid": "7b9fe209-9632-4f4b-9984-564e5ae17f16", "comment": "Malware payload (SnakeKeylogger)", "value": "f8f6973e9d26f60385a2fc1ca58113b92289f595b139c490f990d20d3cd064b07b432fa5ab4a0868b4aad04b1fa09d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819387, "uuid": "0f9cbb58-3fe6-47aa-a810-96df8e145f99", "value": "T1CA05221732D94B20C1FC6BB12462A0C91635BE0BB666EF0C6DC571CC4ABB7929BB1747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819387, "uuid": "e1145858-9d5e-4ea8-9c24-e3fbafe4b840", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819387, "uuid": "b583a471-d071-4943-bfb0-f560e23e0dcf", "value": "12288:eU2TEm89gdN6vJllTk9St1Gs+VNd5mK+w5/QdggSd4SBcKczaWQg:qTp82dMTKSt18d5XtcKcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819387, "uuid": "623eeb8b-e70f-4494-991e-24dbbcf42da9", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819387, "uuid": "1ad5eca8-638d-46cf-8367-1c8f1b849ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819387, "uuid": "eb4024a1-9cd2-49da-90b3-f7d6413b1a90", "value": "Orden De Compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb61d018-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648835246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835246, "uuid": "a7a6f084-51b8-436e-9a6a-eb4efd404bf4", "comment": "Malware payload (Heodo)", "value": "f3c932204ad82fa3cce2ee5c577a311a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835246, "uuid": "db23f3d8-5ca5-4449-9627-81676c0c5247", "comment": "Malware payload (Heodo)", "value": "0f8ccb0f50f35db200de8125172ae37981e708373b28f420615117101dfe9841", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835246, "uuid": "f83c124e-1fd1-4ea3-86df-74058e40893f", "comment": "Malware payload (Heodo)", "value": "63d3680991f834db7ceed97036c665cdfdf2d0ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835246, "uuid": "4ea014f7-dd14-4304-a83d-bcb38188d613", "comment": "Malware payload (Heodo)", "value": "f994dec318a1bbf9c47ac42ef2c6f24c1dbdca2ddfce2538979ad3e0714861a1cc313a195c2a93872e4f90a863d2df42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835246, "uuid": "67844ff3-67b2-4978-bd13-936c30703fdc", "value": "T1B094BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835246, "uuid": "7122befe-ac5e-48ae-a4fa-d84daa01c795", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835246, "uuid": "3bf8c94b-ac54-4985-9043-1716b5fd2172", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDXS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK3rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835246, "uuid": "47eb681c-9e4b-4b3c-b317-d8d228cd6e26", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835246, "uuid": "9cbdaa5c-fdc0-4645-bfde-7c93fe8088aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835246, "uuid": "6ba86a6d-25cd-4b50-a6a7-aa9b085773be", "value": "f3c932204ad82fa3cce2ee5c577a311a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac7a7fd-b183-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648793933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793933, "uuid": "66866972-96a2-438a-b85d-445a39e4e525", "comment": "Malware payload (Heodo)", "value": "7a0a0f67d68a1b3c7ceab4f4ec00913f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793933, "uuid": "35f82513-893b-4dbe-b9eb-0f440594bcce", "comment": "Malware payload (Heodo)", "value": "0f9e1acc9aa103d1f0c76486187faa2f534f9d3b70caab91bffbef4f9dcd4227", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793933, "uuid": "3fb88ef8-7fc3-44e5-8bb5-efe6b9a9c376", "comment": "Malware payload (Heodo)", "value": "710ba6afef81bd5d52b61cedf8b275196416a218", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793933, "uuid": "f3357b5a-b47b-4d1b-bc37-67287f6c8303", "comment": "Malware payload (Heodo)", "value": "f75873ff7aa5788326815b192b0195fc3288655d12bc1a172149c0f004ef28a7413e6aeb3a3eb4c6b9ad26cd95fb45ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793933, "uuid": "4a308a00-c070-4d16-9e1b-e330f64025fc", "value": "T1B764977D0FAE00A2CC621770146C0FD991ABCA25BB1255FF64892E2E2EB57D74879F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793933, "uuid": "e07be521-9bfa-42dc-82e3-4b95cdc2f8ec", "value": "3072:rA5pcWyfJCALTQMLOuw80g4SY0sjHyKilLh:iKfJCALkjp1g4SbsLyKilt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648793933, "uuid": "97fe6eb3-b2c9-4f50-afae-928f339aedea", "value": 332500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648793933, "uuid": "4d2d7ce2-0249-4274-9dd7-ad312f1ffaf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793933, "uuid": "8a5ec36d-8e19-4018-a54b-29340f6ef019", "value": "emotet-low2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0d45c2-b1de-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648832776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648832776, "uuid": "e45e2648-027d-4522-b02e-19e25ce1b56a", "comment": "Malware payload", "value": "a6975ceaedceb806a4f49e103c50a341", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama173", "colour": "#853FD1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648832776, "uuid": "42c0cdee-64ba-44d1-b8df-1a7ce5a6e3b9", "comment": "Malware payload", "value": "0ff53bc0243122381aa964067287c6128d75a565955f1e0a2f0f82b46428963d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama173", "colour": "#853FD1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648832776, "uuid": "568692a8-1efa-40ef-9198-12e48c072fed", "comment": "Malware payload", "value": "19b2cacfd4fa76d9aaa4a3d4a666fc93a509acf6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama173", "colour": "#853FD1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648832776, "uuid": "c445a313-b8dc-4cc1-85df-c40751052c6a", "comment": "Malware payload", "value": "e999646c8bb37945984b00d8ab688ab533d040c13081e8c9e484989c4e810231aab5025910752a6406f9f5151df75d2c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama173", "colour": "#853FD1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648832776, "uuid": "f11b44bf-02da-482d-a467-03fe3f0afd9d", "value": "T12105BFB876047CE6E5AF427BDE96ACD913762A32C9C799CD4065B7C30963372EE01C06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648832776, "uuid": "4428567a-fcc3-4835-bceb-15621bd1a103", "value": "fb812e15befde32b6180a6b0cd372f42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648832776, "uuid": "0a6ed736-7c43-4ad5-88f5-ced334a407a9", "value": "24576:ZpYqZZQsxzVxASLeM/3S6kk0lWhgDabO:Zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648832776, "uuid": "8ba55686-6788-4de1-933d-4f7225496333", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648832776, "uuid": "25dcf7ed-8dfc-429d-a878-2d485726fb0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648832776, "uuid": "686f4168-90f5-46c1-b7cb-43c3f39c9e1f", "value": "0ff53bc0243122381aa964067287c6128d75a565955f1e0a2f0f82b46428963d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9e41e1-b1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648822557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822557, "uuid": "b80ae654-ba10-4348-89ac-994b2f08952d", "comment": "Malware payload (Loki)", "value": "4a7daa8db99b90f2bb610115e759bbc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822557, "uuid": "ed4e1c3d-76b1-48da-8ac4-e0363b65de3d", "comment": "Malware payload (Loki)", "value": "111dcebedcced1f9ab5377e613149aa3b08ad02dae5f4fdb3d627872aa16e128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822557, "uuid": "8e53e609-5235-4086-aaa6-cc87b38cc485", "comment": "Malware payload (Loki)", "value": "3d3579d927bb9b84cdf7dc0e198ae6a43475bade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822557, "uuid": "95629165-c2ed-46db-a4e3-45d4db651c4b", "comment": "Malware payload (Loki)", "value": "63c63700a5b3c1f2040b6d45d0418f48a9db24f472e39f5f0b6b679a7f668c3a70fc4a8a08b17537da6631dc9ae54bea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822557, "uuid": "14bd886e-aada-4259-9a4f-8550aac2c9dc", "value": "T169448E10BB90C034F1B766F999B99368B93FB9A15B3490CB62D52AED46357E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822557, "uuid": "64521011-4d0f-4508-8045-7cda5859655f", "value": "4b0932ad38c639ac88a395249c08ac7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822557, "uuid": "1c9df3db-469c-4f13-8af3-a84c9c66d270", "value": "6144:VjZSako3S2BXveQ6Vxo7N+pAjeTUnFnad1:VjZoo3SkXveQLpgTUnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648822557, "uuid": "a0f4016e-17f0-4af7-a21a-209fbfda2a08", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648822557, "uuid": "543557eb-f4e6-422c-b6b4-64b7a3d1a109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822557, "uuid": "61a80743-9d1c-4167-872c-b06ca408cd9f", "value": "4a7daa8db99b90f2bb610115e759bbc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8566ca79-b1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648837706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837706, "uuid": "117baeda-eb27-40b7-a713-3ee431e3b0b2", "comment": "Malware payload (Heodo)", "value": "9900067f38908ceacb1f701681f2c98a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837706, "uuid": "19a3dd84-8703-44d8-9357-8bfc0dcb5b4e", "comment": "Malware payload (Heodo)", "value": "125ce1ba6e4e6d438508e9ea0bde6a0b2f126a889bcd9cafc221edae27135f28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837706, "uuid": "1c736778-ae8f-4aae-ad83-f1888b094a44", "comment": "Malware payload (Heodo)", "value": "2607fa8a499e121066d1cdecdb778a0c11f4b5fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837706, "uuid": "2f77327e-191b-4216-b4aa-a6b637de3af9", "comment": "Malware payload (Heodo)", "value": "8c1406fe06fcb8e1c5c9aef6a2d9a8867b02a225b6867333be88f9b91b9c5ee77dbefd0effddd724f5ae9f884ba3f9d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837706, "uuid": "c872faaf-4a2a-49da-80a3-def9efba365e", "value": "T12994BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837706, "uuid": "7eac344d-8412-4902-bfc7-64f4c5905dd3", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837706, "uuid": "fa1a301e-ec9c-4e8d-a94a-c76bbfd05365", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD4S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKIrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648837706, "uuid": "021a93e3-cbbf-48ce-917f-133943a689d5", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648837706, "uuid": "a8071961-9044-445e-bfb8-788591fb9872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837706, "uuid": "610f40dc-b553-450f-869e-3d85b26808a1", "value": "9900067f38908ceacb1f701681f2c98a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4e6026-b181-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648793021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793021, "uuid": "1cc3d217-53da-4736-9d9f-09d0e6e1bee9", "comment": "Malware payload (Quakbot)", "value": "e612796dd17f8aca09f19c7ea50c07f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793021, "uuid": "f22ad358-74ce-46fe-8ad7-0bc19971ac51", "comment": "Malware payload (Quakbot)", "value": "13b53bb82690b6894e72d37b9710cc8ddb7082de1b88312fce3b7cb1d03becfc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793021, "uuid": "a8446cb6-d997-4a13-9989-b9051214af99", "comment": "Malware payload (Quakbot)", "value": "c80ab61c5a6b8fba2204be45ab61179326a0cdf7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793021, "uuid": "331e1be9-8b3d-4f97-841b-263894d0757b", "comment": "Malware payload (Quakbot)", "value": "e139e4d6355c180795222b9813660d7674c52bfa2dd50cbc59f9754a312c0fb867be1641b6b7f32f1f7ce5b930f154a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793021, "uuid": "967ae688-e8e2-474b-a169-5cb0512c7790", "value": "T11CA4CFB976047CD6E62E467BD9A6ACED13B61363C9C798CD80647BC305A3371FE12806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793021, "uuid": "e1904f8a-50d0-4eff-a63c-3d1849d381ac", "value": "f57208adfa39508c6359efb37cae78d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793021, "uuid": "d6b2926a-dd3a-4876-b16f-901a76f023e2", "value": "12288:/mkElZCpzm9FcxGSIGRbVqHIk8my7aP3RcAqRBp6dn0/D:3EfC5m4QJGRbVqHIk8mgaP3RjueK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648793021, "uuid": "776b1d99-7ec2-4509-93ba-668c322fe6ec", "value": 487406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648793021, "uuid": "e7872795-e9fa-4515-8d5d-4ee8579a9276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793021, "uuid": "f4f13ccf-1cd8-418b-b6f5-6cf700a21be9", "value": "sample9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1bd708-b20f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648853954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853954, "uuid": "42447d08-764b-4760-8bba-a9c1ed68c58a", "comment": "Malware payload (Mirai)", "value": "755a9c351269841963faadc584bbcc76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853954, "uuid": "984f299b-b010-4432-9c3a-8009f1a1acbd", "comment": "Malware payload (Mirai)", "value": "14a40bf55f622a44c7d84877ce01084ea3fd32e200591ac82cf691da09e114f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853954, "uuid": "5be11cc9-ec54-4003-9915-168b35e605c1", "comment": "Malware payload (Mirai)", "value": "571fdbf3048e302c4fcf09d2f5f6cd87aeb9b41f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853954, "uuid": "50b55f38-0714-4975-80ad-19827b187e6f", "comment": "Malware payload (Mirai)", "value": "c3f0208848a4e8d54db4968f4681fd7a64f6b5233306a5c3fffad6c382ab6dcf346e0d751b30e742f30089952d657076", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853954, "uuid": "7c1fe451-b2be-449d-acb6-cafaa5f0cedd", "value": "T1C073844D3E319FBDFB9C863847B78A20A64833D626E1C584D15CE9015EB038E641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853954, "uuid": "e911bc56-9545-42ed-8afb-f372b26af028", "value": "1536:3Zt3lDFgZSlplFnRDH3DHLtDHIPCwFWdv6GIpEPbgp7Tuq7eJaXkDz6+/DNxmsI3:pzDFgIlpr8dGIp57TuqSluAM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648853954, "uuid": "8bf0348e-c842-44e7-a7e8-bd80a807594e", "value": 79888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648853954, "uuid": "bed70339-3eab-4301-8fcb-653484820a3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853954, "uuid": "3e751b42-4edc-41f9-a7e2-0b922a4c955f", "value": "mips-20220401-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae6374e-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819650, "uuid": "8fbde476-55fc-48ec-8222-d7d6a9c7a349", "comment": "Malware payload (Loki)", "value": "340012c9d3c1cc0e0fea93166c3ccb19", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819650, "uuid": "dd4932ca-9e07-4efc-8c36-4b232800f358", "comment": "Malware payload (Loki)", "value": "14f36e2c91132f1eeadcfa1a7d1385cfcbd6a125189b3fbf0352dad85dbddd0d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819650, "uuid": "da736b02-d520-4be6-aa76-1822cc05fdc0", "comment": "Malware payload (Loki)", "value": "e5e087704caa22736ce5cf2b40776a0ed2b25033", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819650, "uuid": "63b28a95-653a-47d3-8657-e5f77aa15725", "comment": "Malware payload (Loki)", "value": "c6484a06089072c940a786a1e39d442f6429448a2a27a7dda273bc918d73162e62355e4ee66cf6185f864ef63c39ea74", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819650, "uuid": "eacbc09d-b4d4-4240-a04b-8cf40d318406", "value": "T19A1412F0273547BFCA8908BE3DB447240571FEFA972A9843B119BDD12DBA4BDB428015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819650, "uuid": "5e1177c0-0f97-40a3-93cc-8b9911fe442c", "value": "3072:VEa681M8wiMqcwkOyRMxB3CISGIOus1e8Jfk1BmOsnhj7L8tIR9bDajcOcNPZB6:ua6WwiMRUyfEIO3Pf4BmOshv4SRx+jcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819650, "uuid": "83193bbd-3ef1-43e6-ac09-dcab3d6606e0", "value": 192248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819650, "uuid": "aac8932e-88fd-4577-8780-81dc945f5935", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819650, "uuid": "97d832de-b387-4898-926b-0398a1513548", "value": "PO2203-0154.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d20f8aa-b201-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648847946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648847946, "uuid": "1b7db3b7-dbb4-434f-9835-e3a69e012c2d", "comment": "Malware payload", "value": "e15de9d950b0002b131eba5146029e56", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648847946, "uuid": "beb4cd9b-1aaf-4735-883b-0e9cab5d3ec0", "comment": "Malware payload", "value": "150d35526eb17ca29fb6f1dd8ec79033cd4f9ef2976c4520d4ff3c285a81bef4", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648847946, "uuid": "5a9bfa49-61d6-4020-9060-ea8a39760c21", "comment": "Malware payload", "value": "ba770b47bc582822ba4ca282aa7807884f9687aa", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648847946, "uuid": "266eba27-64c6-4530-92ab-b25776d13cc7", "comment": "Malware payload", "value": "2630fb5b9e1354149eebfea52e5d36ba6cb11ba032a28571d1674f1ce9267596932cebb459431f8b6bd101396d1572d5", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648847946, "uuid": "62500167-92fd-4598-9f57-9830e5d4d558", "value": "T150957C925EBD2C22D9CF373F9C9C85A53027F31C0622C2BB3E6651AD49D6674817EA31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648847946, "uuid": "57e4b330-c814-4a68-916d-779656cf8ce6", "value": "24576:KPjxx5f6bJQAnU07Fanu76hsXRQX7X4MCuRL9PWtSohJMIjI8FD:0jLA96pcEafhJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648847946, "uuid": "98740317-03b0-4864-bfe5-ab94c19b24ee", "value": 1903024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648847946, "uuid": "62b4bd31-4e58-4d29-bacb-e0eaf6256115", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648847946, "uuid": "405b8d15-b39d-4b69-bca7-d584a18ad87d", "value": "150d35526eb17ca29fb6f1dd8ec79033cd4f9ef2976c4520d4ff3c285a81bef4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50e097b-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648835182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835182, "uuid": "597b1054-6e85-4ce8-8aa6-3b852af09f30", "comment": "Malware payload (Heodo)", "value": "cd94f73c72c2a0105b63b8517fab9ebd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835182, "uuid": "e5c4e661-b798-42db-9205-e23366f57baa", "comment": "Malware payload (Heodo)", "value": "152a8a5c1a9e57a0973e6e0040a8561c780689285c5d49ff86ee89f2b65a2210", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835182, "uuid": "d197d432-d495-497f-9f3a-1237faf009d2", "comment": "Malware payload (Heodo)", "value": "06094974f78d503a18acf5038b42c0c3e143233d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835182, "uuid": "d62c9824-0a3e-4ca8-8a29-912501985b24", "comment": "Malware payload (Heodo)", "value": "79b440e778c4cad0b4dfad01b0694f8b62015ee6dd52b6bf2fafeb415a4722624173977b65f65c960ab8230f04da3009", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835182, "uuid": "a95a111e-3241-4d23-8037-9f20cd2272ce", "value": "T17094BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835182, "uuid": "87c280c6-34fe-4434-9bce-b67bb5728284", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835182, "uuid": "5e77be4f-678f-4181-a367-2d218dc77a31", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD0S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKMrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835182, "uuid": "61b7edd7-3f38-4a51-83b0-cfb49943cce1", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835182, "uuid": "dbf084ff-10f1-468c-a833-9cf238c8263f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835182, "uuid": "3e7d2d04-e0e3-4579-bc49-157eb907d83d", "value": "cd94f73c72c2a0105b63b8517fab9ebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b40f1f8-b1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648826468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826468, "uuid": "f959d306-7583-48fb-bb03-f2cfdadeaa47", "comment": "Malware payload", "value": "486617e5e5a6c14c7ad1b7764c353b8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826468, "uuid": "837c2659-67ec-4935-a17a-4fb763ab070e", "comment": "Malware payload", "value": "15a3f360c7768d11c783c454207c4a278c0855091901dbc985074a8e3b0c68b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826468, "uuid": "7a8f1db5-b3ff-4ae2-a56c-2bb80cf5e116", "comment": "Malware payload", "value": "8d59ac239d8a133046165560e0743a1059871e70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826468, "uuid": "7802ba05-d21f-472a-8a62-bf64bea916b3", "comment": "Malware payload", "value": "5e1adbb69091445f7b80030b47472bf578452e734f964975f29a40e758abbfef3b5b978766d894f7e48b407b96defed9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826468, "uuid": "fca70338-5010-4614-8260-b3d3eeb403f9", "value": "T1DD15AE13B193C677D2231A75DC6B42A9D835BE132F28A8793AF5BD0C9FF82607525183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826468, "uuid": "45b10116-fc0f-460e-b989-188041c4c38b", "value": "6781b7d6dd8c416ff00a8475f55a2b9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826468, "uuid": "8d6a42dd-49d3-46c0-8745-c834e0e194ed", "value": "24576:eMJPiT/CLjfGwa7MA76/Ox57UDgI+5Zt:eM8srM7ugI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648826468, "uuid": "ffba159d-7561-4a43-87b5-5dd4b2c22a1b", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648826468, "uuid": "1cf1944a-6ee9-4c5e-8441-650b68df7bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826468, "uuid": "86b712de-568c-4bf8-8b2e-dac3614698d3", "value": "486617e5e5a6c14c7ad1b7764c353b8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9991c9-b1ee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648839897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839897, "uuid": "3997ee1e-c0f2-4589-a0bc-589810804dd7", "comment": "Malware payload", "value": "eef0c8da7ab6b462a56467f39e952836", "object_relation": "md5", "Tag": [ { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839897, "uuid": "bf29c68a-5a28-4c07-80e1-5ca23906b159", "comment": "Malware payload", "value": "1670285f43fbf97e6c53349a9518b7daa4ea147481be976633c1ff39dbc6e09a", "object_relation": "sha256", "Tag": [ { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839897, "uuid": "378ce39f-7921-406a-b133-03502d3b9f0e", "comment": "Malware payload", "value": "ce494b7212c4d1da3fb6291d796e4718cfaa4338", "object_relation": "sha1", "Tag": [ { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839897, "uuid": "17a47c35-9b92-4195-ac01-539b7e85c18f", "comment": "Malware payload", "value": "83ef358e44a9c353fa6a6214aa949996003a10791f83e946f6a3d0d91462a637619218fca1f06efb2c0c902ca15eea34", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839897, "uuid": "4f7ae8ad-cb4a-4a6a-b6f0-df31f471e303", "value": "T1C95108133982B1AF008787793E8E6BE5947BD044CA5D404AF68CDEACE4DDD67264D7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839897, "uuid": "0d092bc1-d6d4-4438-954e-d6ba44da9b38", "value": "48:Y+MThimb7RLRPMpLbb3oieszgnkBYyK5nMRY3lgimFoKZYjWwSkBRA3WcHqelSuj:rGTJRUpPbYvFnkBYRnMRDOQYiV3pqelL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648839897, "uuid": "cead3503-8236-46a6-aad1-c32fb194846c", "value": 2635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648839897, "uuid": "1ff4680a-7824-497b-8117-5183473d4ffd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839897, "uuid": "41e940bd-f7da-4762-a256-7562e9f27d24", "value": "HytcVF8S.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550ee88e-b1ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648811426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811426, "uuid": "6d231cd8-916a-4c33-87e2-8da7736673ac", "comment": "Malware payload (Heodo)", "value": "e127069cd8adb6abf24db27971fbf8d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811426, "uuid": "6e393fc0-b64e-4b98-af77-09b7930f01b9", "comment": "Malware payload (Heodo)", "value": "16fe23680fa41df6cf3d0f40297347362a77610ebf372b5bd47abe858abf4a9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811426, "uuid": "a5057e86-5d80-4384-810c-3ce655647086", "comment": "Malware payload (Heodo)", "value": "8d7aa7eb66a00253d1c3e90b697dc69997a4ac81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811426, "uuid": "45674b0c-bc25-4333-a542-b7de35ab8489", "comment": "Malware payload (Heodo)", "value": "55eb53a47591e18fab9d4b844c78bb3c6c5b03c75673df559bf841b10afcb8f9315fc4ffed8cb410da9003bd9c0a909f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811426, "uuid": "a374c59e-80e7-48cb-9d07-bf00fcea0ef9", "value": "T16394BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811426, "uuid": "7205d4c7-54c0-4447-b05d-1e961ab93ca6", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811426, "uuid": "eff1b6ef-336d-4a34-b5c3-b10acd576d21", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDlS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKxrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648811426, "uuid": "fc807d99-0b39-4d9d-876c-7eac43657a08", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648811426, "uuid": "457466ed-3357-4390-9eee-20e5e7a09cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811426, "uuid": "48b2423b-d856-4de2-9c1c-446659746749", "value": "e127069cd8adb6abf24db27971fbf8d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c85c473-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648819679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819679, "uuid": "6ff472bd-bac1-4dfa-bc6a-c1931c1c8780", "comment": "Malware payload (Formbook)", "value": "5b5dca44c1ed3f26f864723540243fb1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819679, "uuid": "1c33d3a4-d7b9-4288-a1e0-062fa87b1af8", "comment": "Malware payload (Formbook)", "value": "173008fcc2ae8254fbab2ba2eb97e3c1afb826fcfc0efe610c66fd5ea897ff9b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819679, "uuid": "e4b40647-1102-4e9b-991b-c5157278a6b6", "comment": "Malware payload (Formbook)", "value": "73856b9b45a7ce9bc2e1da86a1befded872c1bcc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819679, "uuid": "e76e7c79-e759-405b-87e6-f1c50b0cd5f4", "comment": "Malware payload (Formbook)", "value": "b8b8dfa079078166cddff939c1aa2b096415c94d66703c0a96ef53a49788feb77f10319a292b08ee2faf9b7b83f6b921", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819679, "uuid": "e7dda46c-202c-4240-af55-4659854c3095", "value": "T1161402C1E88AB1EDE6E3813EC355915DC46CED7E84C36A52316D33D66E763089C2B6B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819679, "uuid": "467a9e24-161a-4d09-a758-c9bdbe855f5b", "value": "3072:m76Op+M6BD+Mg2/RQopskv5F3F3H0A3rlM8ykQKuztGSBC:Sp+Mli/OkbxH0Av9xSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819679, "uuid": "e47511f0-4ae0-45fd-a605-ff48d9cd97ff", "value": 192424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819679, "uuid": "4eed40db-ecc5-486a-8898-a6c7a9b18f66", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819679, "uuid": "97b817f4-1dd3-4693-ae66-e32f58210944", "value": "Swift copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b8249c-b1a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648806333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806333, "uuid": "0888b06d-40ba-427e-9bac-845aeae9c792", "comment": "Malware payload (Heodo)", "value": "a074b908b12186d7fad49a8c3c422a9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806333, "uuid": "c3f5eca9-e2f9-4258-8172-e9be16964342", "comment": "Malware payload (Heodo)", "value": "17d0895a9da4480de6832b00ac7a29f53de30218fa8a5cd8c9c2d6bbbd3625fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806333, "uuid": "e047955e-359a-4740-a716-be5f6045beb2", "comment": "Malware payload (Heodo)", "value": "117df5b697ecf15cf8dfbfaf5e15671ba78fa23c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806333, "uuid": "564f64eb-3d6f-4faf-92cc-290d6d201307", "comment": "Malware payload (Heodo)", "value": "cb956418d7bd07d1cdadd214c50772aa8a5f95bd6b4751c35dfa900d3bb1d7c2fb334bf09ca3e21013e6d957dd6e82d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806333, "uuid": "f41d54a3-d319-4602-b3e2-187476503bb0", "value": "T1F094BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806333, "uuid": "9d42ca7e-7566-4355-85ef-32eb2795c5bf", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806333, "uuid": "80bf7450-c545-4121-89b1-fa67011c92de", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDaS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK2rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806333, "uuid": "8e2a6e9c-f199-4f3c-a1f2-c0f911d752f4", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806333, "uuid": "088e306f-97a6-4074-bcfd-ea9567b9e885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806333, "uuid": "519724cc-d718-49dc-8b80-ebb653df6c17", "value": "a074b908b12186d7fad49a8c3c422a9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad626e9f-b1c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648824029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824029, "uuid": "848fe55d-34bb-4244-a237-5e91cc2ba587", "comment": "Malware payload (Formbook)", "value": "5f69fa676168364367f8b1ff9f8c87ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824029, "uuid": "f825c1f1-a124-450d-9a51-c1a516bd2176", "comment": "Malware payload (Formbook)", "value": "188ffa0666a74b6ea59802778f06667551b442642dd1eb33cdacc9fbeb7b4120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824029, "uuid": "58c8423c-8aeb-468d-a6a3-f0fb4ec24f28", "comment": "Malware payload (Formbook)", "value": "62941976a61826f51149dccb9354d8df72a235a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824029, "uuid": "850fe069-2217-4b16-a0be-0ba23b9d93a2", "comment": "Malware payload (Formbook)", "value": "80574502a92dc0fee8f7687c3d830bb30ce02797c705455d54da8f4cb1612eeb19c3f0e80c164bd0f0e68fd1dc581d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824029, "uuid": "2fc999c8-caa9-4bc1-bd83-d1479430da4c", "value": "T170E4AB2A38BA100DB272AD6C6BBCB175911EF3F226365CBB0DF7054611129F0DB9D627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824029, "uuid": "c3f9d287-63ff-4352-9a66-9f2bb6f35e38", "value": "12288:5IH8Ub56F1HURPr45tNIVgbokwQgGZSmXh50IOSwMD8F+VSC5lAcfc:Gk5o27e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648824029, "uuid": "cd5f7fbf-f903-4048-8a9b-19fe1bd9b625", "value": 668720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648824029, "uuid": "c4b332c1-5f63-4ab6-918b-ee3fb18fd1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824029, "uuid": "b6b09ad3-b082-423f-9c1a-534a0047bf52", "value": "5f69fa676168364367f8b1ff9f8c87ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e49e3f6-b1ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648840083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840083, "uuid": "8c240d98-92d8-408e-b87a-0806b34ccd57", "comment": "Malware payload (Heodo)", "value": "7bcf1c9e9dfc561a0f0aec52eb59dac9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840083, "uuid": "a5100a87-3b9c-41a4-891d-712c96ef7009", "comment": "Malware payload (Heodo)", "value": "18ed546e8ff778508617aa7b92d903b6acafdca66eca3a40ee6a21e25bbaf377", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840083, "uuid": "00af2a28-ed27-42e1-ae82-7663964864ef", "comment": "Malware payload (Heodo)", "value": "667736f2f6ef2388a8b29dc008ab634384e5be28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840083, "uuid": "999e3b7e-40d4-4216-9f79-adc9e3d1c433", "comment": "Malware payload (Heodo)", "value": "e3bb0e7e5d507a012bf2a13099eb102683ce474c33ba732ab5f93d0a38ba0dadc467b24bf3b38302b321bc76a1b02dfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840083, "uuid": "3c1f49e2-44a9-40d7-ad18-6c9ddfd3f6a3", "value": "T15294BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840083, "uuid": "aa50011f-828e-4a61-ac81-0758875b0590", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840083, "uuid": "517559ee-08b2-4b06-bd4a-465177ccd56d", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDiS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKersjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840083, "uuid": "bc698409-b9a5-4cc8-9161-276f55690b81", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840083, "uuid": "4a110bb1-0e9b-4e09-9301-b1d1848364ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840083, "uuid": "b7602e2b-8782-4e5e-a583-80c091af7bcb", "value": "7bcf1c9e9dfc561a0f0aec52eb59dac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffb5c66-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819390, "uuid": "bd3f6955-f2cb-4749-a2da-58bd7df94ada", "comment": "Malware payload (SnakeKeylogger)", "value": "2c7743611899bb04b432a29b168328ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819390, "uuid": "904d236b-8926-403c-84ee-bdd95ac6ed89", "comment": "Malware payload (SnakeKeylogger)", "value": "19227b7c185f23b3daa21101f10657de40ff27bcfd188c423269aac5e9602149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819390, "uuid": "90ea8804-7ed8-4b2d-afc8-c5970062b148", "comment": "Malware payload (SnakeKeylogger)", "value": "9f9db977ba1f77e77bf7d14d580347dac985f9e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819390, "uuid": "6d1c2a7b-7157-4787-a939-1da9bd680e09", "comment": "Malware payload (SnakeKeylogger)", "value": "b038c93eab526aa46dff851979f5f29845a4f71e7ef9fe73baf771f7d19ea6fcc330045dda3da3c252cbf54f96dad69f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819390, "uuid": "ea4ab745-83ec-49f8-b5e7-862c016b82b5", "value": "T1742501152BD88450EABD6BFEF4F090404BB5B92B2137F70C468269EE0E76381DA5B747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819390, "uuid": "6d6c3447-53df-450f-ac8d-223e1ff611a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819390, "uuid": "e957e28b-716c-4bff-8943-ca2039b8d77b", "value": "12288:GJtPRxjej9OEP2hNWIqgoppuEwVKplNmmrBYMJ3XRM9SxdyqPEC00qgMPsWDbnW7:yjeg4KWXhAiNzR3hsSxsSngQOK9Bhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819390, "uuid": "d7f78ade-b2c9-44f9-8a43-0654cbb1346c", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819390, "uuid": "9191cc76-5d65-4c0a-a6a5-8bc70f0bd7fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819390, "uuid": "d1b204c8-b6ac-4f7c-a39e-581dd8486e89", "value": "2c7743611899bb04b432a29b168328ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8566fe80-b1a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648806353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806353, "uuid": "3a1423a3-03f7-4889-8d5f-e88b76a6a543", "comment": "Malware payload (Heodo)", "value": "548232caad8e83ce8a897b8c61b90adf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806353, "uuid": "98c3293d-2104-4fa2-9a00-ae69d1cd1cc2", "comment": "Malware payload (Heodo)", "value": "19ce14b9a1f1f17dee731e801494e2dc2f27a1abf00f62fe664df63a4f791a1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806353, "uuid": "5a8644cd-89fb-4767-9695-a0a92678a0b1", "comment": "Malware payload (Heodo)", "value": "8980755e9ece82c7dc717d4bdbcaa804b68ec2e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806353, "uuid": "93e2e443-f98c-49e9-88b6-a6a07da66079", "comment": "Malware payload (Heodo)", "value": "1d9531856e279e80efb88f111ea19dc447cfc7d19fc27849e46f4e648a165b3423c510d6b2fa28b1da4f9da9c0f242a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806353, "uuid": "1f84975a-341d-40cf-878f-431d044827ac", "value": "T1A294BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806353, "uuid": "7f781e22-95b0-493d-b1a5-09f16f2cb42a", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806353, "uuid": "254f848a-6040-4f4c-8185-80d8def39c4e", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDHS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK/rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806353, "uuid": "1db9e94a-8f42-4fc5-9b88-ce69cf5c3535", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806353, "uuid": "4683c721-12a1-4d9e-9988-0f0436d65f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806353, "uuid": "493caa21-e3d0-46a1-a04b-af23ff3312d1", "value": "548232caad8e83ce8a897b8c61b90adf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30d0218-b1f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648840843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840843, "uuid": "81ff127f-2662-4b1b-b6a6-ebcc749b5dd8", "comment": "Malware payload (Heodo)", "value": "908b18eccc98a04c0249ae3464a86477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840843, "uuid": "a6591677-f764-4624-9d4d-2c5f208e6571", "comment": "Malware payload (Heodo)", "value": "1ab4f5f9a595c438edb24dc2139d1b43c3bde1186c6b1451ece957923dda6166", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840843, "uuid": "097f8514-0c3e-4361-aefa-efaed756e653", "comment": "Malware payload (Heodo)", "value": "49da4669ccadc0236e6b1d2a539dbd1b1b4064f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840843, "uuid": "900376fb-3f5f-49cc-bb55-27ad89268012", "comment": "Malware payload (Heodo)", "value": "9d6762ddc6dd096b47bda0adf4606f48ca19bf5435ab634670ee44d376e8e4fa16e757e34e6aab367121bd8d2f7175e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840843, "uuid": "0ddfc956-8987-476b-a084-b9b053558ce8", "value": "T1B4F4AE1231A3C075DEAF11744A566FA9A6F9FA146B708DD3A770CB3CC9309C68B36217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840843, "uuid": "3d8a9ef7-b9b6-40ab-af99-1cebccccfc47", "value": "078cf8e17700d87242408b8588acd2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840843, "uuid": "347df2a2-1d3c-4bb6-8f36-0c7edac12ccc", "value": "12288:y7pLgbqIjZbwqHUM6Ay+rYj2azO8BOg1s3F2r/:y7ssqeoYtzbO53F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840843, "uuid": "95a0fa0e-09d4-4899-b742-4b7f04beddb1", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840843, "uuid": "6fbf1a7a-9471-4ec5-af8b-44948e509c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840843, "uuid": "363a52b7-e6db-48d9-a9d4-475729dd6e3d", "value": "908b18eccc98a04c0249ae3464a86477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064a275b-b194-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648800986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800986, "uuid": "fbcdfc75-4224-46bd-ae67-ced0d4b49e01", "comment": "Malware payload (Formbook)", "value": "9b04049db7fa11306845b50bdae4db75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800986, "uuid": "9cf6649f-e2f3-458c-bf54-c51e7b14463b", "comment": "Malware payload (Formbook)", "value": "1cfe87811d0c330dd6fdca569e2c0139fe747ce6ed286a6b1967211da83aea9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800986, "uuid": "267dc913-14d6-4638-a7bc-d4819432682b", "comment": "Malware payload (Formbook)", "value": "610ae0aaf8207aaa5f53c9f6c590c93236d74f2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800986, "uuid": "2f0f5db6-0382-46e9-9453-cbdf63d41f6a", "comment": "Malware payload (Formbook)", "value": "1e70b8dbbfc9fc619a3931017657b949d43988004ce73ab564e610846a5baf6000c0b335c3037e03a10964dea6207e99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800986, "uuid": "c0229809-2037-45e4-b0f2-68b389f58d9d", "value": "T10E05122333D88E24C1F8DB3695610641663ABD263136FF4C26CD709E8DBBBC5926539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800986, "uuid": "eaf219e3-5b58-43ab-ad9c-c6158deefda0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800986, "uuid": "90fad54d-7be9-4918-bb08-5adaa787468c", "value": "12288:xUIsJI7P8CoRl1s8F0nNHZYmKOXnqToEar+zqTDCJKG4F0w7N8T:psJIwfRQ8qGMruzqMKNFn7iT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648800986, "uuid": "cd30ee82-5f66-4b66-88ff-0a48e8a19527", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648800986, "uuid": "4978be7b-4c06-4403-bc41-52623efa8f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800986, "uuid": "7c4db531-1995-4589-a16f-529ea109b5b1", "value": "Request For Quotation GM-0034.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26001dc9-b1ef-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648840123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840123, "uuid": "004a1827-1ca5-499e-8682-a760272055a8", "comment": "Malware payload", "value": "e8267780010f1b79d10d22bf70ba6f5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840123, "uuid": "c7adda54-a2ab-4cd2-8e3e-8e64fe7adeb5", "comment": "Malware payload", "value": "1d1c688d117950a23ae8c39cbe2bfee953030f33a59afe869989b2e9470c464e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840123, "uuid": "27f43766-09dd-4bf8-8568-6577e128fcc8", "comment": "Malware payload", "value": "f30bfba63ff4ea5c73048631bdadbbd37d22ffb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840123, "uuid": "7f75da93-3c1c-4b71-9d77-732e1e0a35e1", "comment": "Malware payload", "value": "838d7ef51d4db50ae4ff6b6d34c1c6b0ef8ba0de59aa2871730de1c749df176edc0c0e1b525d8c98f11ae53f87a56308", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840123, "uuid": "afaa876c-1236-4163-89ba-3aa85ef06af7", "value": "T10F740154B3F142B7E5E1453200B561AF9B3953346B11E8EBC78C2D819863AD82F7D3EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840123, "uuid": "50f42373-43e1-4940-8aa7-eb699af4922b", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840123, "uuid": "33cd412e-2c4b-46e7-a8fd-200904017b8c", "value": "6144:fBlkZvaF4NTB36TS5eLB2GoVSnQxJLP4EcMVG9gXulR8zV6LGU59PgK/Tis:foSWNTpazASnQxJLwxMV3XulR8x6r59j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840123, "uuid": "2e9918a4-1cb3-4fbe-b76b-b89c0f58b93c", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840123, "uuid": "df9559f5-7baf-4d32-b3e7-722325da34df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840123, "uuid": "70165025-53a5-4619-accf-921016c7eb16", "value": "e8267780010f1b79d10d22bf70ba6f5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aea015f-b1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1648821824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821824, "uuid": "1f9c3473-e41d-4589-abd2-9c8641b251f7", "comment": "Malware payload (CobaltStrike)", "value": "19c442a31a07953549218421c38570c1", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CS4.5", "colour": "#060F20", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821824, "uuid": "3f264b9e-3cb1-41ec-a5d8-781b265bbeb0", "comment": "Malware payload (CobaltStrike)", "value": "1d1c844dbe07f096650e5da95cc0b9fbcddd21da73917f394c0f3a61edc66c27", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CS4.5", "colour": "#060F20", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821824, "uuid": "a9e1fba5-979d-480f-aa18-df71940a89f6", "comment": "Malware payload (CobaltStrike)", "value": "b68ac8cec33c47d29c44ae066444138b93d8552f", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CS4.5", "colour": "#060F20", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821824, "uuid": "da5545b5-0bfb-4ead-a988-7693bc1c4767", "comment": "Malware payload (CobaltStrike)", "value": "99067f3626fdefc5d176d0be52a487be2f2f29ac7675f1eef9509052d225ed592b5ad3ad84e78daf49cce2f9dcc1122b", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CS4.5", "colour": "#060F20", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821824, "uuid": "eb55a790-d381-4f58-bf85-46b5a2d43009", "value": "T14572D93EF26156E8E127C27489EE5371ADF2B01241771B3F2B70D6312E724785E7A904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821824, "uuid": "281879ed-435f-4c25-9859-614e9b7a9795", "value": "f73cb1b8999c7e79c50459b8e1f144f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821824, "uuid": "77653ec8-1e89-4c32-8fac-3fc01ddfbba7", "value": "192:bDGIRJ8rl0bIW5mXEX/i5xuQBbW80wZoYa06DSVAu9trTMkEabWAcBf6kxH5y/:bSAw0k/f6QsmoV0gSvtnMRBft5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648821824, "uuid": "80d9d28f-ec61-4433-9c5e-509a06d9d0da", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648821824, "uuid": "128f7985-0b7c-45b6-9c1f-73841560eb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821824, "uuid": "9881c074-dab4-4743-a10f-412be2e4940c", "value": "staged_dll_http.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf1506f-b1a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648808620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808620, "uuid": "51329abf-cb34-466e-9552-1d90720d4e3a", "comment": "Malware payload (Heodo)", "value": "047ffc68ea7f05d629a801bb23b3f515", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808620, "uuid": "ddf323bf-b5ce-4ddd-87dd-8eac1d8961e0", "comment": "Malware payload (Heodo)", "value": "1d1ecf7f775a7f0c62ddd034a326fec2c1823ef36f63159d91637682b99d032a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808620, "uuid": "f82613f3-57e6-4caa-9cd4-4d2813b7df4b", "comment": "Malware payload (Heodo)", "value": "ccb461c67dfe200060343c38746bbad0a5784ecf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808620, "uuid": "06bc5069-faf3-4b1e-a1f9-825b9b980622", "comment": "Malware payload (Heodo)", "value": "2c5f6d4571159ed343c13e8d02bb2f0c0bc88e21ae889331911e5b79374bec7a7eedc7e3e430fd59e264c3302aea98a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808620, "uuid": "c846525f-9954-4207-86a8-cdb1030e8d77", "value": "T1B594BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808620, "uuid": "8fb15316-965e-42b6-9dcd-d94de37d1dfe", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808620, "uuid": "f6ea81b3-f5c6-4970-932b-13084d6e8532", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDxKS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKMrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648808620, "uuid": "f7d7c163-cb73-4311-a44c-5f4f0d4a6b23", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648808620, "uuid": "8b0ce2b2-09c9-49b6-82f4-1e80d0e9eee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808620, "uuid": "65022123-4b03-4849-ade0-226c4bdcae2f", "value": "047ffc68ea7f05d629a801bb23b3f515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff26a4d3-b183-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648794102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794102, "uuid": "5abc999e-1be5-41f0-9c5e-c5a98c36906e", "comment": "Malware payload (Heodo)", "value": "424cf11a7f0c729024571fcd9a8a1ee1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794102, "uuid": "3a97308a-d294-4d33-b30e-3f907c6a7974", "comment": "Malware payload (Heodo)", "value": "1d5b8191e467e1877b88af3fb5c18405dab5541e4b59e02d47786dd797ae640a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794102, "uuid": "4f7953de-498e-4623-8258-abc76368347a", "comment": "Malware payload (Heodo)", "value": "bd05a2f5109878808ee0d2d67e970c78daaddbf9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794102, "uuid": "a3d70a32-4220-41f1-b577-685aec1f936c", "comment": "Malware payload (Heodo)", "value": "b8ad98670c369cfa7f350987781e2cafea9e0c25418919643416262f4de36610d873e95ca161cb1190343b416452bb59", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794102, "uuid": "21fd5d4c-9874-4437-bc02-52151c6e4d39", "value": "T1B0059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794102, "uuid": "b96ea624-244a-4606-a67c-a8fb0d11c42f", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794102, "uuid": "fe102561-0693-4534-a58e-5057c4bf21b7", "value": "12288:KVHML2QJe6XxhqCW/QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhq3QHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648794102, "uuid": "e02e9b65-c303-4abe-8ce5-a4bfd493ac89", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648794102, "uuid": "30f9a94e-1a96-4d70-95fb-2c3b789d9dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794102, "uuid": "cfc08fcc-497c-42d5-a4cd-5a9297f6dc99", "value": "plants.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756da5a6-b177-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackGuard)", "timestamp": 1648788717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788717, "uuid": "798ede09-4e89-4fbf-9e62-a554f33be83e", "comment": "Malware payload (BlackGuard)", "value": "c7b6b38295005c98e58ee722a9673c81", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788717, "uuid": "fdc5678b-8b14-4e02-9c5c-41d0bd520800", "comment": "Malware payload (BlackGuard)", "value": "1ee88a8f680ffd175943e465bf85e003e1ae7d90a0b677b785c7be8ded481392", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788717, "uuid": "62e2abf0-1357-4086-b34a-333c986db885", "comment": "Malware payload (BlackGuard)", "value": "660c233843fc5cbde4e087471a8b0a2a38541db2", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788717, "uuid": "54071e83-7c6a-4f64-8064-18e0889185b6", "comment": "Malware payload (BlackGuard)", "value": "fc36f7446f9b2afd2dbcab8dfe3818af4878f93c2d58d785693bab31e7fff722362e49316a8ba0b9ba4d2ab51028105f", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788717, "uuid": "7a86b9c0-cfc0-4b06-b4de-d5e022b290b5", "value": "T1FEB53386A92EB515F49F97303427F315B518CEC4AE2BCB24673BB7E65D33BE0A015602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788717, "uuid": "71d779f6-c23d-4d03-b8a8-130d63505170", "value": "91652763f0bbbea350f45a6d7107e373", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788717, "uuid": "2aaacca9-c9f3-49af-8dce-d91858db54ef", "value": "49152:Sn+zmuzkl9yb2xcTaPy81DvXV1bC6Jacq/PUMoYFUGCD:SnYmuQub2GaK81zl1bCzcgUsFUGCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648788717, "uuid": "6937a982-7578-4c0e-9d76-2630d133afd4", "value": 2386944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648788717, "uuid": "1961b035-27d5-46f3-b8a2-3ef6563c02fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788717, "uuid": "8addc086-3af1-4236-afd4-9c79a584ea63", "value": "1ee88a8f680ffd175943e465bf85e003e1ae7d90a0b677b785c7be8ded481392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d2b9e0-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648835175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835175, "uuid": "2f3e1ea6-0328-4faa-996b-ec1cc3e4046c", "comment": "Malware payload (Mirai)", "value": "e1190f07a6da91caaa317affc9512caa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835175, "uuid": "ac4774a5-f323-4ca3-a926-921377755d04", "comment": "Malware payload (Mirai)", "value": "1ef815b3b2afd16b0b8801ae49f2fe70209c0393b77ff03c172cc237eb72c858", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835175, "uuid": "7c25334b-5f8e-4593-b88e-710421db9332", "comment": "Malware payload (Mirai)", "value": "9c8678204821b1fb5b8989262e08aa9ae299d841", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835175, "uuid": "29c66891-830f-484f-99ce-9f3a228c4b04", "comment": "Malware payload (Mirai)", "value": "c72e2ed37c1df4201afbfc6d7e1faeebf29896e53c734e572ca4825a0efef85c96cfcd6cf20ba9cd12956ed573cf9efc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835175, "uuid": "fd57bb16-2928-4ed8-afae-b12b1fc1e37b", "value": "T1E2731B84B841D726C6C256B7FB4F028E372593D8D2ED33039D256BA4778781B0E66F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835175, "uuid": "b15b7fb7-fc55-40a1-b3d2-42bd9ad0d7a9", "value": "1536:wkR7jg20killO0XO2jGv7fU27aScTvEteSdIGinwkTUfXjv:wk620k2JqTM2+hvEtHdSwkQXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835175, "uuid": "0d30eaab-a9d7-4ee7-9311-52820b72d3ac", "value": 75136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835175, "uuid": "05dde9b7-809d-4571-8904-53f4fea401a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835175, "uuid": "01bee909-9dfc-4703-8f5e-624136d23187", "value": "e1190f07a6da91caaa317affc9512caa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640c2719-b19c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648804579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804579, "uuid": "af365a81-0ec9-4936-8b7e-ebdd072af0e9", "comment": "Malware payload (SnakeKeylogger)", "value": "24fc9c1112302c5bd7d93d464d06f169", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804579, "uuid": "5dd57f2a-9400-4f87-ba29-317a44e12784", "comment": "Malware payload (SnakeKeylogger)", "value": "1f10dc928196c9ec241a1e81bcbc1b1a558d93126b42303b48ef61bed920fb05", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804579, "uuid": "fdb51a6e-834a-4d25-8ddf-b04a8a76c2dc", "comment": "Malware payload (SnakeKeylogger)", "value": "cadb0a59219b0f4f2db146be4f89e4df510d492c", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804579, "uuid": "927972a2-8e07-4267-9c02-349a7285fc33", "comment": "Malware payload (SnakeKeylogger)", "value": "24387da9b114aeb0dd2f4df5fe53bcbcd30e054c9a35e96b95658df82fb8166b4aa74a6db5691058b71609f8935a9082", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804579, "uuid": "cc29e104-87c9-4c7a-8feb-65644ec0f8f4", "value": "T1288433E626D9FF33F86F5BFA71141B1C10E019DA839894ABC8F51F9EB8094706E5C684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804579, "uuid": "9d5e13c6-c1b0-4246-b1bb-505c03f2bb25", "value": "12288:63p8QQjPxcSUIIn/fzwO8psfs03Zo6FV146m6BXE5:63pjQ1cSUR/fzw/p+V3ZoUr46hXE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648804579, "uuid": "fbfc546c-9f5b-47cc-b990-bfc9122614cd", "value": 398378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648804579, "uuid": "9db1992b-01e0-4cac-84ef-682e2901c54a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804579, "uuid": "8eb8a35e-ff11-4ea7-ae59-0659693eae8b", "value": "Payment advice.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2190f21e-b1c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648821218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821218, "uuid": "10feb5bc-dbc7-4fec-bb31-36ea53c9c22e", "comment": "Malware payload (AgentTesla)", "value": "b7178ca0cf94ed6b5337b1bc56145149", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821218, "uuid": "4170c69b-87df-4999-b782-a3ff9c4afbf4", "comment": "Malware payload (AgentTesla)", "value": "1f9f0ee5dd7d68fa9d1d0e4dc83b72d75c792fde2006625e10eb85dce68de41d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821218, "uuid": "17861191-0598-40b0-94b9-2900aae0b3dc", "comment": "Malware payload (AgentTesla)", "value": "36a5991c0b19ca04109f99c59581ae3df00e04ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821218, "uuid": "4062f5de-4f2c-4b53-a93d-acf0138c7f5c", "comment": "Malware payload (AgentTesla)", "value": "f8156c236a046a5f12c1273cda0a25f049c8ec3206e2612842b368134e8abc77c60dc3886d223f4ac5978f6cfdeb013e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821218, "uuid": "ff026068-c3ef-4036-82dd-1225156d9e2b", "value": "T110F48D69F2F175DFC45FC0318F584D38BD906C7A978A820B9117319A8A3E693DE093A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821218, "uuid": "e6683ba7-198e-4112-b35c-aac4f543c0f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821218, "uuid": "ce61ce4c-1989-4a83-9cf2-888e81b8af8f", "value": "12288:m9zMXqQZyUhTS6aUE5WAIjU5msqCugrUdyRpYDzGEiBHhZAGne6SMdQVYJUEKl7J:mmXqgyMTAzDR5mJCuLLM2VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648821218, "uuid": "43371cf1-12a3-40e8-ab5f-1d5b8d941dfd", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648821218, "uuid": "8d7826db-feb7-40e0-a73e-78d26d9241d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821218, "uuid": "ba698771-e83d-4b5c-8460-94d2512ddf44", "value": "purchase order PO3218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e21d777-b1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648822259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822259, "uuid": "c20ed5cf-f0be-4a17-968e-045b3c69c722", "comment": "Malware payload", "value": "d08fa84d966a9390b1d6db8ae0888cdd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822259, "uuid": "02b93427-5012-4b7a-a95f-06fc4eb4400b", "comment": "Malware payload", "value": "2058cdf174be4f26f3c41c44bc614cccb89a10d1bdebf2c4e64e404a268fe5de", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822259, "uuid": "d19c6902-8cdb-4612-bb19-faa9d32c85ec", "comment": "Malware payload", "value": "d4884c5bdc59e8f5bf794147a8ad902b3b72a654", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822259, "uuid": "75aab73d-cb53-4fae-b72a-4b56bb8e1a1d", "comment": "Malware payload", "value": "60bbce71f46a4aa5e8d3c8ace4ea19175182b44030ab531e8a206f67dcec8f8f581cf71cda7a58a6ae030b53c3b04bb3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822259, "uuid": "b91b709b-1bae-4c06-9adf-c82217ffefd4", "value": "T10A4515A3D5F1FF02FA220C38B7A15EA501456C3B4FD90106B4EEEB9A20A3D65746F587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822259, "uuid": "06f0fba2-f052-42e9-8c6d-81ae259a5d33", "value": "b6e59fa48928522cfae01b27d2060025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822259, "uuid": "6345ec9f-a17f-4734-9ab3-2fc6b4b33151", "value": "24576:LlM/A1A3A2MMe46D5tKERWpnhNjQlUPnGYI5aDMRAXfmP/UDMS08Ckn3gMi:BM/g6ZML46lgEshNjQmuYMaoROfmP/SC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648822259, "uuid": "52a19253-35e2-4780-89d9-a58f3935d7b9", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648822259, "uuid": "eff86cb1-3a63-4ac5-aada-da6df722955e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822259, "uuid": "7b790a36-ac9a-4506-a389-e888d677a202", "value": "E-INVOICE 8424.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962f4f52-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648819695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819695, "uuid": "9fe02a1c-7c84-4eab-b316-f777683cf5c7", "comment": "Malware payload (RemcosRAT)", "value": "8e771bbfcf70fd23b59828729ffaf48b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819695, "uuid": "0ac8844a-0ea1-448e-b5fc-3dae4899e2e6", "comment": "Malware payload (RemcosRAT)", "value": "208716fae92a9e2ee3a76647aef81208f65173b56d36367924bfe3329e1c68f3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819695, "uuid": "c6c044eb-eee2-4f8c-aea2-1cb1873128e6", "comment": "Malware payload (RemcosRAT)", "value": "72368d627a98c3af6584c686cf26a81eab459923", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819695, "uuid": "079a40da-76a7-4995-81a2-d15a170c7f27", "comment": "Malware payload (RemcosRAT)", "value": "5c24d30921b0f73e4589173d9def68f8696e31dcdcb9f5ab9f8471fc4bccc5264d4d6854fe5c748e68c0c154602983ca", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819695, "uuid": "2faa2435-01fe-47f5-8508-9e30d9cd4e91", "value": "T1D91412FB3D200597FCA472F8DAC935698B17DC740E4F1D5BE2807289C8B4B02A5E5A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819695, "uuid": "eb169f0a-50a2-4d76-94a5-cccb9f0c57d7", "value": "3072:zPpHGFgcab/sW/gSPT3buutRloXNpqc1VKvHvRdx72Bvh/yPeey8VcqjhsJ4yj67:rpHGrMhPO/dpVAvHvN7UpaP1qJ1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819695, "uuid": "acb7efe9-d699-41b9-886d-eb7ec659f3d3", "value": 192008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819695, "uuid": "e334efdb-faeb-4de1-962b-4e2cc3697b06", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819695, "uuid": "9d9ca98e-6e19-4609-aba8-efaaa6da60f0", "value": "040_001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfa0244-b1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648822849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822849, "uuid": "6935931f-6b12-4b4d-b84b-ecf1ba1789ba", "comment": "Malware payload (Loki)", "value": "1f43b5cc1869aea999a4d3d653d6c613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822849, "uuid": "48a281b3-1ea4-42e2-9ece-3e410305583b", "comment": "Malware payload (Loki)", "value": "20dde0ac9cfe41a1b3b1d6b7cb58008cb95a76b4876ca823d1b5f6a5ebf03bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822849, "uuid": "a7d553ae-d27e-4554-9248-e09be19d8076", "comment": "Malware payload (Loki)", "value": "375efdbf81c8aea76da7ee244271317459192175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822849, "uuid": "57c312b7-98b2-4793-ab0a-146af56444eb", "comment": "Malware payload (Loki)", "value": "8dd933de1ee2d2f16cbcc4f20fc95e0b1137a22f930e4367cb1f7eb2c66920f9e16e99fa4ba89e1ccd55a1bcf218a532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822849, "uuid": "c6b58ef7-e11e-4ed6-a54b-251c5975b6b9", "value": "T1A5A4011DB7F6CA13C0751AF680E7116013F5A38AA673D78A3DC112DA0E633A75D8A787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822849, "uuid": "c19a608a-ee94-404c-af17-89bc3be7bcdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822849, "uuid": "012b570c-0095-4ab1-95d7-f7ca5fdc5055", "value": "12288:Xpp3pxM19Za+JeJuPughr2lSBstR9Fgaew:vcHo+4UPolBFgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648822849, "uuid": "2aff12c1-81ca-4ee8-be7e-10ff38ed9f1a", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648822849, "uuid": "903a8bab-4bc7-4866-955a-78f66fc375c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822849, "uuid": "e099dada-dae7-4277-9477-f49a361062c0", "value": "1f43b5cc1869aea999a4d3d653d6c613.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f1ac09-b1a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648806360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806360, "uuid": "7c85f448-99ed-4d17-b535-b4e04a3bbb32", "comment": "Malware payload (Heodo)", "value": "9e95f9e27129983e18b97f51062bda8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806360, "uuid": "fc2c0541-40dc-49fa-8d0c-abbe18bd98d6", "comment": "Malware payload (Heodo)", "value": "2166f61dc33e0cc8c28e5d2fcdee7da34411ba57a8f655c2ec85c40288d20f41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806360, "uuid": "eaf1bc89-7afb-4c81-af40-29aed426f470", "comment": "Malware payload (Heodo)", "value": "d599045477c8ec4e1bc11044400a27dbd3579ead", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806360, "uuid": "408be65c-e523-4cfe-98e3-7048a4e9eb61", "comment": "Malware payload (Heodo)", "value": "d8bc22cd434eab3eab56e4fa996b3ebbdda9c5a129a79fbbf7b7197f087570558868e9c73f56f40c2dbbdcb3e609f19b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806360, "uuid": "7775e343-bca4-40d1-85b4-a06879914388", "value": "T18F94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806360, "uuid": "676a3fdb-eeb1-41b3-89a9-b36a8476cb4f", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806360, "uuid": "b256413f-212d-4e62-b1b1-40f4370621e8", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDuS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKarsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806360, "uuid": "0c95384d-2efd-4348-8422-32d8a1a3a111", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806360, "uuid": "86c1d3cf-9636-4df9-bde1-7f4bbce31876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806360, "uuid": "275377d9-7023-4f65-932d-c74ea538ab28", "value": "9e95f9e27129983e18b97f51062bda8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1723db-b19a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648803945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803945, "uuid": "f5bde27e-8c4c-4f0f-a470-62eabba8fdf7", "comment": "Malware payload (AgentTesla)", "value": "f105a91cbf2105eb240f8e4cb9f86e11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803945, "uuid": "e534de70-901a-4fdd-869a-fb34939ed6c4", "comment": "Malware payload (AgentTesla)", "value": "21ecc26930ca727acc608e96054c3bc269248d85f59580993fa2d77295b53a56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803945, "uuid": "979c61d5-454b-4c25-a766-1be076e3775f", "comment": "Malware payload (AgentTesla)", "value": "c4e12d425958c382f0f8de72c44875081fe747f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803945, "uuid": "bde2208f-32c0-4f01-a543-e02b1dd3a2dd", "comment": "Malware payload (AgentTesla)", "value": "e0e40a206adf971e73140304075beddfb67b995d6e2333101ddc00eff2b4151034c9e5861d7a2326559e4b23f1d5ae62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803945, "uuid": "1e595887-6a0b-43b3-82ae-0d69e9a77edb", "value": "T1C244121167E8C0B3E4D24A704EB5967A2FFE5B214476074B23705B7E75A2682873F3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803945, "uuid": "e37278f1-8616-4c6e-86a2-4e1a4486b322", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803945, "uuid": "960415fa-9739-4134-9203-8b1245ccbec2", "value": "3072:l1NjcVVnLpPunb69AJ/Or2COgqyE44cnaOTY+dfm/UUkHEv6immhJBBmMXL8SiI:HNeZmCAYeyH4WaOMH6ECtmhJ64IVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648803945, "uuid": "5da42106-b1b0-4470-8978-1d643d5b987d", "value": 266660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648803945, "uuid": "8ca78dae-e78d-4e21-a556-eed5bc4720dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803945, "uuid": "2e56c425-6977-46bd-ae15-966fd5b61067", "value": "\u00dcR\u00dcN \u00d6ZELL\u0130KLER\u0130_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2c9fd6-b1ba-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648817424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817424, "uuid": "954401aa-0a7b-4f10-805e-f63f035975a7", "comment": "Malware payload", "value": "dc254ed955ff21ddb193f3fec2d53b01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817424, "uuid": "a1d82b47-3383-4d3d-abd2-dbd4d5af7022", "comment": "Malware payload", "value": "2287c4761f11ca664c80aad351492b8cf9c625d4c0dd73a6c46178b70cd081b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817424, "uuid": "5e6798f0-337f-452d-96f7-ee447be420a0", "comment": "Malware payload", "value": "dcb0096a352a14e2eb4e6a51658514bfb2e9cbee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817424, "uuid": "2bf0ee54-03b9-40e0-930e-86c78a12058a", "comment": "Malware payload", "value": "11b439170d6de4c538022450fcafd353ade680656899ef54ce8db21e1c0a98edb812f3d4d39071defe9b18a47a8fe6c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817424, "uuid": "4b9f51d7-502a-45f0-befe-ab0370088424", "value": "T1A1937305AB551FEFD82FCD3205DD0781B4BC165615AE6B26FD3CCA24F2CA2CA15D38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817424, "uuid": "fb319678-6a9a-424b-8bed-5836fc9d97d5", "value": "1536:LLgsox2HksM5TcJpLktPDoeyoZiRdN6PVXFXwH:Lksox2HrQoepVrXwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648817424, "uuid": "6fef0a27-79bd-403d-89c4-77b8792439eb", "value": 88856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648817424, "uuid": "db6cfa09-aed6-4672-80bc-39cf0f6a2e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817424, "uuid": "6c0e2be3-25a2-44c8-b9da-e8d2a4e6c096", "value": "dc254ed955ff21ddb193f3fec2d53b01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9028ed4d-b1a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648806371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806371, "uuid": "773ec1c7-c958-4318-ac71-98f93726baf9", "comment": "Malware payload (Heodo)", "value": "d333a62bcffc7e2285c2f9c07750dc14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806371, "uuid": "42542d69-efe7-4cb4-a728-662a34ac3505", "comment": "Malware payload (Heodo)", "value": "22ca8d702fd8ba0f4c0e651de743fe422400c77a54dee8bc1993f0ba584150ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806371, "uuid": "9f98b254-895f-4e79-ba44-a2869792eb29", "comment": "Malware payload (Heodo)", "value": "df1c22242815a2f1f3ab81762c499fb9859f286e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806371, "uuid": "f1324d30-3cb4-4ecf-a8a2-98566e34c69a", "comment": "Malware payload (Heodo)", "value": "b03036f0eb338dda4223145c60368504f88b329a5b0759d681f582a387f20102251b390cfc4308622554b8c3283cab35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806371, "uuid": "ed188d79-9430-43de-a58c-486991d6c11e", "value": "T17494BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806371, "uuid": "9f8d9586-aea4-4cba-aa8c-93b3f7848125", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806371, "uuid": "ce88ca14-d601-43e6-a1ba-b3755bbbc333", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDmS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKqrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806371, "uuid": "caf7e92d-a8c7-4f11-8a7a-4f133431b3c7", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806371, "uuid": "4ab29706-6ddc-47cf-97c4-b31e04cdf36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806371, "uuid": "f083a78a-416a-4f55-b4ea-5f852ced6ad3", "value": "d333a62bcffc7e2285c2f9c07750dc14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bc0a5c-b1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648822186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822186, "uuid": "8bd83b4b-2319-4607-bbcf-9dc43a9d5b10", "comment": "Malware payload (Formbook)", "value": "8be97a587d0f0da89cb30586ce07ff54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822186, "uuid": "18153aea-5715-4edc-a32f-83fc14d32f47", "comment": "Malware payload (Formbook)", "value": "2388aba5e29792fc92af726882eb073d8d896640df9926d0dcd7565e2ee41cce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822186, "uuid": "0b7b3ca6-3706-418c-ae47-b7c8486fbc31", "comment": "Malware payload (Formbook)", "value": "08b8c506fdb5e882de20e88366aaa2a21522c874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822186, "uuid": "8f35534d-4b83-4a91-8b03-7640f818f788", "comment": "Malware payload (Formbook)", "value": "66b9d6a2a1dcf18cea8f8abcc5d5cf09a8df9be07b7acab48196d88c301e8090d9a32a6a37a7715e7c270d4f2279bf05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822186, "uuid": "aef1d11b-4a53-4eea-8831-d5ae127c9b7f", "value": "T1D484024037E5C417D1E0AB7468B68E40CDF96A700A60A9FE3225BF6BB4F6395C52F217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822186, "uuid": "7f2cce36-c5e6-472c-b97d-7a49a03f7846", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822186, "uuid": "259e002a-4b56-45ff-a357-505a0a69b917", "value": "6144:UNeZBbUffV6itouZVUS0RnH8gse/7qfsy7rSGhI8k27LdgaHI:UNiU16i8S0Rnvs8GrhIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648822186, "uuid": "8b86df57-8787-4110-ab34-00a56d9c3378", "value": 401321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648822186, "uuid": "41eb221b-55d6-47ad-89e6-1603fc362aeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822186, "uuid": "af8fe7e1-5f44-4ee7-8212-48ded8a5b45f", "value": "ORDER INQUIRY_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291f32fa-b18f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648798896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798896, "uuid": "6cf06812-a56d-4908-8bba-348eff948a44", "comment": "Malware payload (Formbook)", "value": "26c1852a3b26040fb5ca8b62365d3c62", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798896, "uuid": "6958d8eb-7107-4265-82a8-4298adea719e", "comment": "Malware payload (Formbook)", "value": "23af583224347d7ccdcafd3966b0933e808f20342bedefba1f66b5ff50b9622e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798896, "uuid": "2dad9706-df1c-4744-be76-e713d3e685c3", "comment": "Malware payload (Formbook)", "value": "f9afd956aad4316ce862a212234282192655bc49", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798896, "uuid": "16086649-b443-4287-8906-4decddb9f303", "comment": "Malware payload (Formbook)", "value": "4c3cfb08bdf2ef7f68c9d18655d3f8a74b8be4a658cb06730092f29eb9a706503f09e4c7fc44bc13e5c39826dc519977", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798896, "uuid": "ca3a3bae-480f-4542-8fe3-167f330bbc3f", "value": "T1B2542393DEE103E49A693F4C21F0B682379290F4961D0F65DF80A01A3F46AB66C565FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798896, "uuid": "af771f1f-e684-4eda-b3a6-797106e15d28", "value": "6144:mX/OMdltqa+XoTa7wPBYZgL3FnUfM37HGY3GpjIKabQ:mXRlBuoTa7wCZ83FnUkK5VIKAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648798896, "uuid": "b03a9599-655c-452b-9850-44e1a3f8b0f9", "value": 286005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648798896, "uuid": "03f25ddb-3cec-4f94-8ebd-7d7c0c915776", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798896, "uuid": "92fe2336-3f59-4208-af19-e7a07b4355d7", "value": "Purchase Order_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d67e9c-b1a8-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1648809659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809659, "uuid": "813f2e09-f46b-446e-be5f-f2273b90697d", "comment": "Malware payload (GuLoader)", "value": "6b1d4a25578543f953fc87d435a4503e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809659, "uuid": "6453c670-50c3-4ae6-bbd5-894e69cbeda8", "comment": "Malware payload (GuLoader)", "value": "249054f69eae64d7cfeb06fdfb70572baa82cf923ca0ba2175698f68abe0558f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809659, "uuid": "41a4a423-a0e2-443b-854c-9d62881af4da", "comment": "Malware payload (GuLoader)", "value": "05b83778ee9cdb3acf3b9704d05d7d1f228e51ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809659, "uuid": "844a2a16-31d7-465e-b2e1-603e8ee0ba2b", "comment": "Malware payload (GuLoader)", "value": "c363dc7c5bb333a59be29bfddc8fcf415b0c094340c5ee7766cdc61364358d242232b03944c14115a108f3e2394e70b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809659, "uuid": "a702079a-a203-449d-bdfe-e191eff03177", "value": "T1CBC492C3E28041D9EC682B77D437FC3B156BBEBE6AB0645D965DB1725FB3282001AD02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809659, "uuid": "1a82d1f0-a2e5-4e6e-870f-f6896c26cf86", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809659, "uuid": "19eb69ae-9e9e-4c4d-aa59-1141c1c747e3", "value": "6144:uYa64Bnu9T4kuBzmHnq52oxqMVTxWt7BlxQmO:uYWBkT4aHnq52owEkt1l63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648809659, "uuid": "ced3374c-cfbd-44e5-91b7-23c508420190", "value": 575832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648809659, "uuid": "c390034f-04dc-40ec-80e9-2a386cde2faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809659, "uuid": "c3ea66c3-d281-43b8-b726-798ed17a13c0", "value": "PO9413 2022-04-01__pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72003f1-b1a6-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648809067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809067, "uuid": "59fce946-95d7-43cd-ae17-457b27d42e73", "comment": "Malware payload (RedLineStealer)", "value": "01208afff8a9d0e41861b39c1c411e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809067, "uuid": "7ca5652d-b266-4a57-9511-96300c1a7a4f", "comment": "Malware payload (RedLineStealer)", "value": "25308137fa3566fee406d592d7fdfbf6719082dd44ef267e24d38bb2edae94cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809067, "uuid": "fbe1cfc9-a2d0-4326-a285-d3e3feeec383", "comment": "Malware payload (RedLineStealer)", "value": "f5d09fd299026421fa5a0fff65452c7dce917643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809067, "uuid": "11344e1a-0b51-4e2a-b745-8a3dfe2f847d", "comment": "Malware payload (RedLineStealer)", "value": "9e7a9dee06a95de91fb523b8d877c3c1be6d49129df3fac1a1316dabbf392d1b57d1028359a840cd5ed153bf2520848f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809067, "uuid": "ea91c593-b582-49aa-b0bb-a185c891c16f", "value": "T1D374D000B7A0D035F1BB12F45A7AD3A8793E7AA16B2594CB62D526EF16306F4EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809067, "uuid": "0a94ca74-b6b1-456b-92c7-10a7aee6dcf3", "value": "de2a87646cc33f42cff0f6e99f12662e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809067, "uuid": "24e13859-96d4-44f9-a78e-42a889e030f2", "value": "6144:pm15YsJGdGZ+aWQKHbFbNKwl13/rNM/6gizKzY7obvSMMkLdo:pnsJGK+a49NKw7vBMxizoDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648809067, "uuid": "c1493b4a-366a-48fb-9d4f-c3d672a9d7fb", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648809067, "uuid": "d0f13224-28c4-43cc-90ae-d2d03df9aba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809067, "uuid": "70e174a0-72bb-44b3-9882-5bf83269b4a9", "value": "01208afff8a9d0e41861b39c1c411e99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f04eb13-b195-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648801671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801671, "uuid": "6dc34407-0fae-431f-a849-2cb0af56af57", "comment": "Malware payload (Loki)", "value": "4fdede680a057afc8b0a77abc5ee3100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801671, "uuid": "b51da398-4b4a-4ad7-967b-daede6a57c1b", "comment": "Malware payload (Loki)", "value": "26070b1a05da0da550b286c83227def8b346570e3644b491cedf3e59b31ceb6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801671, "uuid": "d8745e1c-b6e5-4ad5-ab77-8027400a17ba", "comment": "Malware payload (Loki)", "value": "405d17ebc6ddda8cca5ae681f439a952d5af9bab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801671, "uuid": "c083440f-8a45-4055-a94f-fedd779236bf", "comment": "Malware payload (Loki)", "value": "163db992c82b017ac3dede4fed64325343e9491c5613553f0df2b83ec4e41e41c74e086039d6ede1280305df1c8ed84b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801671, "uuid": "3f93f423-c563-41de-98c7-acefb7e30994", "value": "T1D134125477D0C1A3F6A26B32087B46BB4BFD5522AC604E5F07908F5DBB50AC3984B3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801671, "uuid": "c398bb60-eb06-49af-9c16-ff6d0b2c5407", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801671, "uuid": "0b3b8a03-4262-4c9d-99a7-4393e4080f3a", "value": "6144:HNeZmVCRbYFs2Gw9e87pttY5MF5dDjdapWTk10kZhdU:HNlglYf9Xptt3XhIvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648801671, "uuid": "29f6f8fe-4f25-4fd4-b7fa-2df3d14a69fa", "value": 237547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648801671, "uuid": "7859ac85-13c6-479f-a75d-85a51f5d7164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801671, "uuid": "540a053a-dbd8-43ca-a5f2-c57b80eb155c", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db208804-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648818952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818952, "uuid": "b8e1f2cf-bc5b-4e16-ba93-9dc80d5f3f8e", "comment": "Malware payload", "value": "9a9b4140f435f8c5e90b9d37b3934cb6", "object_relation": "md5", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818952, "uuid": "610c109f-c50e-4952-a330-805baa1f00d4", "comment": "Malware payload", "value": "26561f10cc120df745a1bbb4062af13aaf13129002ca36de757d11764849194f", "object_relation": "sha256", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818952, "uuid": "dfdeab08-2687-4150-bb78-dc10f47ccf6b", "comment": "Malware payload", "value": "45d8a74b35d4fdb9a64a7f8ef3d12468ad0dbd2f", "object_relation": "sha1", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818952, "uuid": "6bd8de20-0d49-4786-8d4b-c51e12dfc83c", "comment": "Malware payload", "value": "8978a82a81203da09add39f51fdfacc08cc99df1802766c3ceaaebd8b7e9c7cbbc18db472bddc1bcb840c1e55cd2235d", "object_relation": "sha3-384", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818952, "uuid": "ee44fcac-ad7b-4977-92ba-cf9d8729772c", "value": "T1CB25247E0F0602D8E1EF7436D45E7605FE622FAE15612D98426A752E483E02E50FF2ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818952, "uuid": "5eb3e293-2153-4145-baab-9e3bfb9e06b1", "value": "bff611495925b176323f79dce4f7b8f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818952, "uuid": "2b54bfe6-ce2e-44cc-b59d-8cc3a649a3c2", "value": "24576:yZZZpppppUDnbx+28f3Dr2CDAycOva1ju:yZZZpppppUbb4nTDAycOvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818952, "uuid": "ed5caf4f-d5a9-42d2-a32d-cb61953196bd", "value": 1056864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818952, "uuid": "27a455e4-d79e-48d3-b491-2d1b6229e1c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818952, "uuid": "8909466a-441f-4456-aa68-02e5a7bc0ae4", "value": "TrdngAnlzr1756.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91affcb5-b198-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802937, "uuid": "76bd1975-fdde-463c-93bc-1b1c23f6cd93", "comment": "Malware payload (Heodo)", "value": "8ee835ffeeb53551cd3e0b7ac1f476b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802937, "uuid": "da63d94e-74cb-45d4-9ff6-db99bfb82381", "comment": "Malware payload (Heodo)", "value": "26f38447782f504212e9a1adeeb44d77535359a9ed73d74b0e9ed670439d022e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802937, "uuid": "528ca65a-8682-4a86-9d97-2bfb653239e1", "comment": "Malware payload (Heodo)", "value": "96b92197bb0cb25ef86e78aa35cb702e0c0e07b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802937, "uuid": "02cf2484-c4db-4ddd-ae26-80980168ee54", "comment": "Malware payload (Heodo)", "value": "dbd11c7eb95c858e25c99bc74f8ef1d265ba0fa2e720a755a0e19112c330abf43cfef00de78339713aba93ea5cade987", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802937, "uuid": "282c7b90-b617-4f76-9eca-29f405cbba05", "value": "T19494BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802937, "uuid": "87953ca1-a2e2-4b02-8e20-6ffc70e99ac9", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802937, "uuid": "db484cd5-a8df-45a2-bdce-ff05cbd60519", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDsS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK8rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802937, "uuid": "b08607f2-73df-47fe-aba1-3322f4acbcf5", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802937, "uuid": "ab2dda64-29e2-46ce-bd32-696862e42f23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802937, "uuid": "3bcadd5b-6925-46ed-bf6b-8f0806c7df8e", "value": "8ee835ffeeb53551cd3e0b7ac1f476b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00899135-b1a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hydra)", "timestamp": 1648806559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806559, "uuid": "6da7c5da-37b1-41b2-9129-8e207b80604c", "comment": "Malware payload (Hydra)", "value": "412826ee6d6fab98a5471008a2cd1118", "object_relation": "md5", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806559, "uuid": "32ff299d-14af-4559-8915-45de216d8446", "comment": "Malware payload (Hydra)", "value": "26fdc35c4216c1b7a810ac2e341630cca4b5faa92561df7c42ccb6ea408a8d7f", "object_relation": "sha256", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806559, "uuid": "a9e308cc-1e99-455b-83e5-4e204ba23e2a", "comment": "Malware payload (Hydra)", "value": "17ae43b5a9128d4df9c140833bf696c42bf04ccb", "object_relation": "sha1", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806559, "uuid": "1e330e0f-6f3f-4aa1-a987-182a08070b8a", "comment": "Malware payload (Hydra)", "value": "2add60b4032744183451d62a7907c154100cec0883c06dfe7ec9fd263973151e16dfef9994a129f19d3ce3be0bf8f204", "object_relation": "sha3-384", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806559, "uuid": "67d3a6d0-568e-48db-83fc-360881d7e0ea", "value": "T169369D17E2A29C31D86D47B04DFE6700BB3263477F4307932099D8B97DC6AC6DB986A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806559, "uuid": "3d81b84c-b6ea-4e55-a0bc-0012ced3e071", "value": "49152:Py+ARapPKgOjvshtlD2ttpR6fDsOfGHBmiu5zLzNu2kAALhcyMMr94g+cuL+1v0t:DAeIG7KhMzITf8Xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806559, "uuid": "37cc49af-547e-43da-8be4-4aeb3866c5e9", "value": 5246144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806559, "uuid": "7ffcc868-46d0-4753-81d9-b0c649d1662f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806559, "uuid": "a6a00698-2cdc-4143-8b62-1e08faeb9019", "value": "classes.dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37437f3-b1c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648824039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824039, "uuid": "a48ec9fe-f457-49f9-bb70-f96920d5d668", "comment": "Malware payload (Loki)", "value": "84de5d7cb1a1330735d10f9d4aa6dccd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824039, "uuid": "bfd6ecc3-4066-4097-8b23-df2f8b82906b", "comment": "Malware payload (Loki)", "value": "271406f0fef76c576345ff573bbcd40c41cbd98e0f8edc7de6af15b636855735", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824039, "uuid": "f643ca63-2ba9-44e0-9811-659940118756", "comment": "Malware payload (Loki)", "value": "b3b6809d330b15483df6f66c2cbd9e0ec8ec3cc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824039, "uuid": "7ad4612b-0e3f-42a6-89f1-84a48a083e09", "comment": "Malware payload (Loki)", "value": "1784c4aaa3812c39de5928471adf2810e3053866207317064feb4dd53b0305253ca64d35dbb44e76aee3c3c6879b5fc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824039, "uuid": "a93491ca-9b12-4941-971e-cde2bfddd8fb", "value": "T1A7C412087A68C7BBCA7F15FD50D1802497B8A509F712DB49AC8660DEAAD77F006523F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824039, "uuid": "39421351-3ad7-4f35-a258-25fe68bb02ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824039, "uuid": "71655ef7-d63b-4b5a-955d-b569e78a2012", "value": "12288:GSLsTqGaZK6CuGW+FROGL73ez/rYFzLJAI2bkTqOF:kTqzuTD3ezrOLJ2bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648824039, "uuid": "1814b617-0863-41ad-bccd-8074c83f1be8", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648824039, "uuid": "e277e832-b3f2-44c1-8863-cfb423da428b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824039, "uuid": "bbd9adb8-70dc-4b85-9838-74b629acfafd", "value": "84de5d7cb1a1330735d10f9d4aa6dccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4c63bd-b186-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648794979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794979, "uuid": "9f2f5e2b-6a01-4e56-9b84-3d5d9b12ab71", "comment": "Malware payload", "value": "25ab4912141f74837c368eafd23c317a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794979, "uuid": "9725e230-f7e3-4a71-a650-da3e63c09fa5", "comment": "Malware payload", "value": "27d36f6a354cacf424f3d077a5fec026d7f185cae9397f1eb0b602fe1d210cb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794979, "uuid": "31d99610-6cf1-4d2d-b317-3e953763ef68", "comment": "Malware payload", "value": "d6e4e6df07077f39c38ba93110b5ad74c531948e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794979, "uuid": "80667060-1265-4ae5-befb-f9f54ba1c255", "comment": "Malware payload", "value": "aacf10aee19586ce43d6e2c7c863c0ca88239d8632a95301293bd602d16b39814fa726e82817a78c999a712cc3b5ec50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794979, "uuid": "1595adbd-4214-418d-a099-c1540123b57b", "value": "T152E3A3137191C065E1442A30D9A2DBF7AF3ABDA0E844718B71E93F5FBC31A4C9DB5268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794979, "uuid": "ed3d6101-ad11-4595-a44a-81effa9202dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794979, "uuid": "0ab6848e-2c0e-4d09-897f-249c9530984c", "value": "1536:lLVb5pV8T6HYZzabYnnnnLQh42IokFlZiEtaqAX:lLVb5paabdhZIoMwEtaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648794979, "uuid": "fea8f011-c3d3-4466-bf68-d7ac3a38623b", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648794979, "uuid": "b7a0c24f-c851-40b2-8d75-25ea4e16125c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794979, "uuid": "2fd1099d-64c8-4df0-93f4-62b5f6048af2", "value": "Kasdw aosdw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d542232-b20f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648853960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853960, "uuid": "eb3b27ed-d411-4af0-a5d6-9f0718e12f3b", "comment": "Malware payload (Mirai)", "value": "46ea33e7870d51121d27901acf2a4b1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853960, "uuid": "2a3398b7-fa99-4670-9b45-e70bad633f8d", "comment": "Malware payload (Mirai)", "value": "27e0f15d78732e04ce4ea3bcfe61793e60c84aa6deacf9f0de0b39c092cd5e2a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853960, "uuid": "0b297dda-abc7-4a9b-8102-a5c675f90ca3", "comment": "Malware payload (Mirai)", "value": "b8596397889e1ff8a0a42e14fd32fb19dc4dc3ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853960, "uuid": "da78048a-150e-4cbb-b9f7-1846d48c2beb", "comment": "Malware payload (Mirai)", "value": "3781044bf7374928aee17521b259ca0368d2d13794a0d36ca8c6f661ca91ed6ebd2e52c71da4007adb8939a9e36aff77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853960, "uuid": "b20d4a6a-ced6-4fe0-b637-f651a2e765f7", "value": "T1E0533903A58181FDC489C1BC46BBB536D423B47D137AB69A37C4FF1B2D49E602E2E589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853960, "uuid": "5ab0bdef-18cd-4704-8113-9d8e2c2376b4", "value": "1536:P94xiYiB2JV9jIAxuyZQyzXTF9dQVNF2j7tP:l4cBeV98OJTFDQVOj7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648853960, "uuid": "70e3ecbb-0124-4872-a3e2-1510d92c34f3", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648853960, "uuid": "3f6d0eca-df04-4876-b562-0627613f7ce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853960, "uuid": "d204aa73-b677-4504-a723-5d31851ffc6a", "value": "x86_64-20220401-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca585fe2-b171-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1648786282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786282, "uuid": "bc2547be-727d-4f7c-8e39-6070f9513693", "comment": "Malware payload (N-W0rm)", "value": "1a2c99f71e9f69d577b1796f4cf99de7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786282, "uuid": "e6bc6bd3-bf2e-4bbd-b80c-7c98c53e2ecb", "comment": "Malware payload (N-W0rm)", "value": "280322d7e932602f964d8e6097822fe036590488125d486749748c096351ad30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786282, "uuid": "eedfd923-9874-4867-ab5f-73ab3b4025a6", "comment": "Malware payload (N-W0rm)", "value": "548ed25e38e5fde0919112fde62fbe03b18bfbaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786282, "uuid": "ceec25d7-34fc-4ca4-935b-c6473b262e32", "comment": "Malware payload (N-W0rm)", "value": "36f836dfea056aa45f61534dc60b02f9369eec887dacc29396d3743022edbde39125871b49bd95a1b5a536dd3ca489be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648786282, "uuid": "e48614b7-e58b-4759-8ec3-290f5f2cb2e7", "value": "T107656A5BBFA7C2B1D40AA37E884D02F93AA41F96138CDE1F11EDBDD852C31A1D411E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648786282, "uuid": "a99398a4-489c-429b-bf1f-890e4956d88b", "value": "40c2043c4a931142bc7f2173fe725119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648786282, "uuid": "5611f9f4-f7e1-4bc8-85cf-0d8306f40d40", "value": "12288:iHeQvatfgpbe5t3FEIb05lnLsZKCMGd/edQu2adqP6/pNow9BKqhH/DEw:YeQyVgk5FE005poRd/ybvNowSqhff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648786282, "uuid": "6a205495-0abe-40a0-97f1-858b8c49fee0", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648786282, "uuid": "09262022-1c2b-4caa-8744-93a12790db64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648786282, "uuid": "d42c711c-f020-416a-b209-1393cb646ae0", "value": "1a2c99f71e9f69d577b1796f4cf99de7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b885bb-b1c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648824018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824018, "uuid": "4cc95b99-7e5a-4311-847f-664d7fb5ae95", "comment": "Malware payload (Loki)", "value": "1c313fe7562459e017b46c4dd280e88b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824018, "uuid": "21f7172c-dd13-4f13-ae08-4b7d04e2bb79", "comment": "Malware payload (Loki)", "value": "283011e02f08ea4c1dfbf76d7322d2034ad3cbe6f0a839267adcfe2a56fcb2a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824018, "uuid": "c763454f-8d0c-42b3-b586-726604809d00", "comment": "Malware payload (Loki)", "value": "b42cbb395dd07114d23e390a82162005b1287617", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824018, "uuid": "57dc9f8b-2df6-4f78-bdde-9916dfe02e56", "comment": "Malware payload (Loki)", "value": "1ffa6ebf0ad8484c93a864bc07e28120162ff18272a8aad65a685b3b4ca61ee4637acaca36d9e79502961dfa63c05844", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824018, "uuid": "e4ce9f10-512b-457a-95bf-2e5be6c4ad39", "value": "T1EF3412007AD4C476E8B455722E3A150AAEE6F72B2038479F6750BF6C7C16785DE0F3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824018, "uuid": "e73ce2ca-0dfe-4c2b-8893-d0ad42c278ca", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824018, "uuid": "41fb7d1b-a8e9-4b6d-aa91-48ae71727c07", "value": "6144:HNeZmtF/9qx3CbkI25vjrf1VyFzg68TeZMyweyE:HNlb9qhak1dVyFL8Teqvef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648824018, "uuid": "a1540708-ae18-442d-92ba-20834f323946", "value": 239519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648824018, "uuid": "99700b73-4fe4-47df-b8f9-cc45c8e5ca9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824018, "uuid": "19583946-d106-42d5-b38b-3fe5fe443742", "value": "1c313fe7562459e017b46c4dd280e88b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82b3726-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648818947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818947, "uuid": "dfd72391-1ce9-4da9-879a-bcb9ddc60cf7", "comment": "Malware payload (RedLineStealer)", "value": "93ee7ca54308c5c339e51bd1a45aa295", "object_relation": "md5", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818947, "uuid": "1e3447e8-0bf5-4122-890f-d8bc4761abe1", "comment": "Malware payload (RedLineStealer)", "value": "2a0ceaf5ac0039a9409b47ebbe01ba3872726a6b6318bd697b8199396df49301", "object_relation": "sha256", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818947, "uuid": "a1a7e08b-93ad-4ab0-aa83-3b8e9ce0fde3", "comment": "Malware payload (RedLineStealer)", "value": "7ab6e83d5461b383419dfc5be6b2b3e6421cf8d5", "object_relation": "sha1", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818947, "uuid": "d37a018b-eafa-411a-9fd2-0ab147eeb3e7", "comment": "Malware payload (RedLineStealer)", "value": "2bb724d51ca34dde4bb34a29622d4a9f5f63d921cd439116692ef84d807582dc36ff3591151fcfa10e5dca931b547fb2", "object_relation": "sha3-384", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818947, "uuid": "e6bd06e4-df08-4988-a75d-5fcd57673c94", "value": "T1AF25127E0F0602DCE1EF7036C46E7615BE622FAE15615D980229742E483E12E94FF6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818947, "uuid": "08c09ba4-34d5-46e7-b1fe-0194c75747bf", "value": "724b80e3e7aa17453374375b968f8817", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818947, "uuid": "15f1c93a-80cb-463a-ada7-8e6ac5ddeeb7", "value": "12288:6XgGZZZpppppUzmOncMmvp+j16VTjY/GMrzTAx2VzUpIgiypSsKls5Bbpk3a+Wpg:GxZZZpppppUz1et1rGTiYeiy4s9sisuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818947, "uuid": "08431d34-b0ef-430a-ad73-39c103bf07fd", "value": 1057552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818947, "uuid": "461f3dd2-b247-4708-a78c-8055e1195366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818947, "uuid": "0f4f611a-edee-431d-af35-378270464c7d", "value": "TrdngAnlzr1649.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7e149e-b1d4-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648828806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828806, "uuid": "b3a800fe-fd18-4eee-be2e-2ac140a655fb", "comment": "Malware payload (SilentBuilder)", "value": "0591ce4eb656d52273c3b88236fd242a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828806, "uuid": "f6de2e62-a037-4f5a-bd18-09db5ab9107f", "comment": "Malware payload (SilentBuilder)", "value": "2a3a9f34754ac1e674a6cdc1f6a5a0d7ebfba0ec5d2ccddd469aac7adfc4182a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828806, "uuid": "f6961df7-8517-459e-aa3b-8e96fe16288b", "comment": "Malware payload (SilentBuilder)", "value": "4a176873b82944703a344044d95ad46d70b79702", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828806, "uuid": "e51aa37d-c64f-4e51-935f-ee387a0ad961", "comment": "Malware payload (SilentBuilder)", "value": "5b0d52c72b81d6e0ca073d3bbaa515fa17282d8755bac65db0e181cbfb174c6cba8fac48e2c610fb619676d60aafd215", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828806, "uuid": "8ed0bb08-644c-4188-b8fd-fcf060ec220b", "value": "T14133E996B659D969FA1187354CEB87E66322EC205F5F17833229F336BFF88B00647106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828806, "uuid": "dbfbd89e-908e-4f9e-8a3b-c881b21b4b1e", "value": "1536:bRKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+q43SaU3hTt:1Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648828806, "uuid": "f09080b8-f186-4edb-ad70-92e865045d55", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648828806, "uuid": "6cea8e6e-15fe-4719-bd54-539b4058fd39", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828806, "uuid": "92106636-4508-4d1f-b541-c7c5bc87d22a", "value": "doc_69156.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883f3115-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819672, "uuid": "a6feb143-500d-4a7c-bb0a-97541313bf3f", "comment": "Malware payload (Loki)", "value": "3c9fd2ba2dca2dc550f96ce666ed9266", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819672, "uuid": "c1c3aefc-2a62-43ad-a213-4dec354e06fa", "comment": "Malware payload (Loki)", "value": "2ad46fe28a20e5e42db731d5fa4f351bb1573c4911a8dcc6ad41bf6541515d45", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819672, "uuid": "8c6e186c-1679-49ef-bd71-e9eb3db6f6c2", "comment": "Malware payload (Loki)", "value": "2a7194a265e30cf687221992ee20ee9cd910d7cc", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819672, "uuid": "f9decd74-383f-488c-a0e5-f2582a2bdea0", "comment": "Malware payload (Loki)", "value": "15922c7846565822433b1281e8bb62f0b77112df160117fdb120f7a3cb40f269a89e9c82cafa218e506e5af17fc1828e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819672, "uuid": "76363e2b-d7f3-45dc-bbe0-516c963cf918", "value": "T1351412B8749F6CA9D90426BC093A988881A1FE617760CCDA121B320FBFBFD955C64D17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819672, "uuid": "f70a130c-7873-473d-9963-6eae58f1bae9", "value": "3072:ob6BI/5FAGWeLegPmVGYQcHqn0ELkHtLPUeS/9PjRVSi0JVyf5t/C7LNYVganozr:27xZeVVqnDIHp3SxjD0JVyf5tK1Yu48L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819672, "uuid": "77b1c6cf-011f-46e5-9759-a06ced9f68a2", "value": 192216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819672, "uuid": "e82cf01a-a974-4c34-8941-cbd3f7e906b1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819672, "uuid": "a8d24e30-ac62-460b-a186-019ca31f6ec1", "value": "SOA310322.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efeac94-b19b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648804195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804195, "uuid": "5a4e0855-7a21-4faf-aaad-a813dfb15f44", "comment": "Malware payload (SilentBuilder)", "value": "4c4a7becb13f9376540739aca209b061", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804195, "uuid": "2194874c-7717-4c09-b6a1-91ff2a7237f6", "comment": "Malware payload (SilentBuilder)", "value": "2b8d399bcd8fa64dfa792d108117b503f13a1d16c9344c1efe5a2cd7acd8b968", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804195, "uuid": "a8e05408-4392-4778-a769-31f4dddf78f2", "comment": "Malware payload (SilentBuilder)", "value": "34a4f9ba19c3e4ea5e206a88360bf20fe583f9d0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804195, "uuid": "2b00abfa-dd59-4c46-b2bf-5f813403197e", "comment": "Malware payload (SilentBuilder)", "value": "7f8e6901b709e31122713d4b122a39608bc1795fcc81e0e7d83ce8a04491ef35fbb8b30bbd614c68ccc886419b96c624", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804195, "uuid": "03f85af2-b3fb-4396-9a41-6263448e06d5", "value": "T18233E886B659D569FA158B314CEB87D66322EC205F5F17833229F336BFFD8A00A47106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804195, "uuid": "51a2cd64-9d92-4e81-aee4-8eca40400841", "value": "1536:8RKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+E43SaU3hzz:KKpb8rGYrMPe3q7Q0XV5xtezE8vG8UML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648804195, "uuid": "f86ce0bc-ad02-4c9a-936e-09b823495f66", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648804195, "uuid": "34306853-1edd-4b85-ad90-bd3655c68fad", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804195, "uuid": "8740bc3e-cf3d-49f3-bc55-94af52b391e4", "value": "Mensaje_7107855905.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3f8886-b1a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648806339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806339, "uuid": "9e766472-269f-4495-bf8e-151979104d7a", "comment": "Malware payload (Heodo)", "value": "848bc4a085b0017a4ad19b3d9ec95733", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806339, "uuid": "e2eeee58-d754-49d8-b816-927c658c8ae3", "comment": "Malware payload (Heodo)", "value": "2bcadebccd04288377e2d0d992da95317eeb57204cfcfb857e2b52935ed457c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806339, "uuid": "061ac3fd-a204-4632-88ba-5fee19a75fa3", "comment": "Malware payload (Heodo)", "value": "563e292e8d1c30b0b631726190ec187f08592e81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806339, "uuid": "b8a9fb99-c086-42d3-ba88-dfd31922d33e", "comment": "Malware payload (Heodo)", "value": "453ab0b7465c71b4aa8e65c526d04f29bcf318c70d23ccdff05f4d704ca231bd8ddf52f9f65099c97f80559987916691", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806339, "uuid": "5ecef725-66a4-4253-83f4-76b778d356a8", "value": "T18694BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806339, "uuid": "e6119e7d-2285-4cd2-a166-b49baa893d75", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806339, "uuid": "d5f2e8c9-501d-4293-bafa-50390324006e", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD7S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKDrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806339, "uuid": "d097a79c-7e8c-4458-9c5e-a2d51788e254", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806339, "uuid": "9b02b0b1-4cb5-4aac-9cb3-1989bc017839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806339, "uuid": "2ed7c987-a4ca-4e9d-ae2e-5d5fbb159a7c", "value": "848bc4a085b0017a4ad19b3d9ec95733", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d084552e-b1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648822370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822370, "uuid": "7ff9780e-c999-4a04-8df1-5128e9c7e459", "comment": "Malware payload (AveMariaRAT)", "value": "71fab84b9f391917e8680dafaedc0edc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822370, "uuid": "592b5322-2bbf-4561-b73b-db84c55fb313", "comment": "Malware payload (AveMariaRAT)", "value": "2c1776c56bbf7f46088ab391d2c787e5ba7ad1cd3379db0e51e41146045b7bb6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822370, "uuid": "9b30f755-4d26-4386-9d78-803b14abc68f", "comment": "Malware payload (AveMariaRAT)", "value": "0773af93fd3c823f4e6709f46cdd1416944efcd0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822370, "uuid": "a2e66edd-1aa6-45d9-86ef-b3dfa1f1dafb", "comment": "Malware payload (AveMariaRAT)", "value": "04d8444c1a5e8c90fb0d97db52ad434344adceea62beedbe016e372132139d4c7e33b8cae7f067497674ae34bc86f580", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822370, "uuid": "91097d0c-e0c2-4c9c-9259-fc1d2779be12", "value": "T162510834FA95072DDAB28735E8AD5201F4227C42FA5ECE490143138670D61C7E5EAF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822370, "uuid": "b1e2093d-27b2-4a91-b19d-bca0d9e9736d", "value": "48:8v5a+hCMJ88MJ8J8Hc9CFDCUUhUhgyhM+qlk8MJ8WMf6RXWiZDAItB:8v5pCMJ88MJ8J8Hc9CRCUoogyhM+Ek8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648822370, "uuid": "5c071f77-a918-4bf2-97a1-9d6e180851cc", "value": 2676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648822370, "uuid": "a142e7bb-857e-4c22-99f0-fe5e6d6b249f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822370, "uuid": "44e9e8b3-da5c-4845-806d-dc89984133c6", "value": "SC147985478.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1932e89e-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hydra)", "timestamp": 1648799729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799729, "uuid": "0193ca5d-211f-43cd-b75b-4597769bb287", "comment": "Malware payload (Hydra)", "value": "768ec2246d2c92330ba8fafe6513963e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799729, "uuid": "95f80a17-aa60-4421-903a-32ffc96a367b", "comment": "Malware payload (Hydra)", "value": "2cca7cac692513aa01467dd9cda3ea98a2a8cde74380b2826294d283a83f4ce7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799729, "uuid": "664173e1-877f-4a7c-961e-c77f9870ea9a", "comment": "Malware payload (Hydra)", "value": "dbfc889162a1b786c14afe37618d65dca701d0e2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799729, "uuid": "50571a11-0496-48a0-9b0d-3edb5615b038", "comment": "Malware payload (Hydra)", "value": "2f037fc407bb9a05565288951d293bddfdd4d6a20502a8723e8d576610a2e5d9a593c0b5e551a63c1578d642f1ad1733", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799729, "uuid": "15f564f5-66ba-4f5b-beb9-d1c74a164992", "value": "T19FF533A9944BC036DEB85871612C5CCB569FCCEA47A6381A5B24B2CC94BFAF4F7050D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799729, "uuid": "4805b3e2-ab20-488d-9d35-945cac936d4f", "value": "98304:J7vowDDYhXuZBe4Mqo7IEtOfLMOaizYYAmBa0zWFZUG:+GYhene4Po7IEtOjMOBzYSBI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648799729, "uuid": "c65b1a1c-05f9-4b87-9dea-d232e229eef5", "value": 3637090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648799729, "uuid": "45ba7ecd-9bba-4549-b1e1-f00dc79ac011", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799729, "uuid": "078ffc53-5dab-42e3-9ffc-a3b448869e6c", "value": "bawag.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d891d3dd-b1a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648808640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808640, "uuid": "504e8f5c-dd01-432a-83c5-190d5c3cbb2e", "comment": "Malware payload (Heodo)", "value": "ee261bb1b9e8cd5d3ce4e30121efe28c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808640, "uuid": "9a19a113-f132-4b6c-ad76-10a553e1b266", "comment": "Malware payload (Heodo)", "value": "2d22af6935884305ab17ea253e63d459337d3890bcd0a57329351f1c09165440", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808640, "uuid": "ffc835af-2d98-409a-a84d-ec5ced34997b", "comment": "Malware payload (Heodo)", "value": "bc136c6ca83f7ea6ff8bb0fe32693d9fc640c7f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808640, "uuid": "bb6e0d07-2d1c-418e-ba43-e7d3df43987a", "comment": "Malware payload (Heodo)", "value": "70a35136c67d6d4130257bfb12129289536c6cd9122329a71432a27538309df4818a57d3fff8c1b22481b1c4e2020528", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808640, "uuid": "329e99c5-1877-4878-8125-6e6d1a6517f2", "value": "T13494BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808640, "uuid": "63124687-aaa0-4cb8-8301-0555d24bf380", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808640, "uuid": "6060e6b5-5ea4-4a13-8b43-66b16326f46c", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD/S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKvrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648808640, "uuid": "d51a45a9-e74e-4bc4-ad19-19e604a50736", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648808640, "uuid": "9b9c24f7-258f-4518-ae6d-1a2b674ad888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808640, "uuid": "7f6d95c5-856b-42a4-92ba-006b9efafb02", "value": "ee261bb1b9e8cd5d3ce4e30121efe28c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6495bd-b1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648823330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823330, "uuid": "de488088-302b-4f79-9025-cd0565bae494", "comment": "Malware payload (Loki)", "value": "f726fd6a7230b32e89603a181effd380", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823330, "uuid": "5eab5e91-68df-4738-aead-1266d2faa5e8", "comment": "Malware payload (Loki)", "value": "2d4db38cf9cb9e42160b40381f4f053326b6cfae1dcaa5bc0607f5e382c1a8ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823330, "uuid": "b37617a7-9d0a-4794-8639-e16bd0a5dae8", "comment": "Malware payload (Loki)", "value": "e4f1f9a747ddfcf679b55a0b68985f2021bf20ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823330, "uuid": "7811d796-cb51-4eec-8005-4806b1a9ca96", "comment": "Malware payload (Loki)", "value": "7897fc3599fcfe773a4ad5bc98f0c8bd382b575a4ac9c92c18008de68c12881d0df232bf68baf01525c98b00a2edbbee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823330, "uuid": "e263153c-1822-4544-badd-ed0b10f57656", "value": "T189C4120439B89B57DAAF96FDA4900224637A921DB418E7CD7CD260EC5DCB3F10A523B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823330, "uuid": "decc16df-7db8-46be-9b09-2168cda48c45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823330, "uuid": "1ceb80e4-c639-4908-8fdd-6e2e27fb805d", "value": "12288:NA49Jhq8jmBtWhTDW+Pq43KCfQUKdGFa:99JhDst0DWeKdU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823330, "uuid": "b3f8361b-8e4e-4fcf-9022-c4d0e3dd8bb3", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823330, "uuid": "2e0c6f75-ecdc-4cae-b761-16308f19d8e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823330, "uuid": "16d1a8a2-c228-4092-a151-577eb3f9565c", "value": "f726fd6a7230b32e89603a181effd380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364d430f-b1cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648825547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648825547, "uuid": "e1ee6e97-4bdb-4d02-a064-a48d01526fd1", "comment": "Malware payload (AgentTesla)", "value": "add8cfb56e29419c9502ca5496c837e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648825547, "uuid": "ecfdc0e0-5e92-4b5b-aaa2-b32bca010562", "comment": "Malware payload (AgentTesla)", "value": "2d687768258a430a93f253644d18ca98ec3c778a6d69b2bde524deba6e0fa727", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648825547, "uuid": "cd7399ea-425f-47ce-9ec4-a377ca5abadf", "comment": "Malware payload (AgentTesla)", "value": "6889324cd8de8f96b756d4e3cbd68c72fcd93747", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648825547, "uuid": "6bebe52e-fee4-446d-8afb-0f9c417e27a8", "comment": "Malware payload (AgentTesla)", "value": "6a5d1046e3280d0dd7c22ae0dbd2c3f26ea1bd186b0a8cef3f7cb3140c321629120bcdae99de8f7e4f68d77a1ade1252", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648825547, "uuid": "3f60ebe1-33fd-4ad0-958c-4a451b11fee3", "value": "T151D423543BF48894F5F76B7919B86D101BB9BF47AD28020E4E80B21F86706D4CE63B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648825547, "uuid": "04eb95f8-ba7e-4ff0-a20f-cb2bc38d0a1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648825547, "uuid": "908cb5b0-7d57-4ddd-948f-28d299600489", "value": "12288:K4RzrJJ9Hib5c59JQ+s3ujGIWSnVxqtMpXkYChxybYWu8NIZUZ8fgTUS:j9HiNcpxs3uuSVxOMpX/AxyvucGg85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648825547, "uuid": "079b246a-646b-4371-90fc-8af0900a9e1c", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648825547, "uuid": "40b5fe57-5dc1-48ba-b09a-295530899ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648825547, "uuid": "38b42b18-edbe-44e9-8e43-3f631e87b047", "value": "Nuevo producto Pedido.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e748bf99-b1d4-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648828851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828851, "uuid": "9d8cacd7-0127-4a13-b506-32d6c614fc72", "comment": "Malware payload (NanoCore)", "value": "1274551b41e9c82873e3ffb97537cfa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828851, "uuid": "48928aa3-3a6c-4d31-a97a-449c2bb36bce", "comment": "Malware payload (NanoCore)", "value": "2dd7e7f8070fca15dc8439798ce059a95f3441a3bed37db96289f0542d25b943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828851, "uuid": "010217da-bed9-4e68-97d1-513381275b57", "comment": "Malware payload (NanoCore)", "value": "19847c73c243538251f039f4ae49046399e11237", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828851, "uuid": "1529e3cc-451c-4017-9525-6d39429fa4f2", "comment": "Malware payload (NanoCore)", "value": "872217a5e84911120dea07dacfc35b922f6f434519d770918a1357ade44cf953859b529359c9d99108c441a812995f2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828851, "uuid": "317c2167-efd0-4cc8-b409-da853e88db98", "value": "T15014C05677A88A2FE2DE8679611646439378C2E3A8C3F3DE2CD454B74F663E4060B0D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828851, "uuid": "347ff385-ca47-4724-b5bd-687b856c5a02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828851, "uuid": "e7a2cb13-6c25-4a48-aaaf-6bfb9bd8ce56", "value": "6144:MLV6Bta6dtJmakIM5/IL//akvOnbBjYZUWY:MLV6BtpmkiqTOnbBjYZUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648828851, "uuid": "b5a7cd48-875b-4837-8850-59f91472f95b", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648828851, "uuid": "0a727f24-6468-4625-b431-8aced600367d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828851, "uuid": "6abd2058-5d5b-45e0-935c-366f492f74d6", "value": "1274551b41e9c82873e3ffb97537cfa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b51ab5-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819364, "uuid": "e9237252-1e2f-4cd7-8208-817ad6941835", "comment": "Malware payload (SnakeKeylogger)", "value": "062329ebc11e063eb42b11478198d9a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819364, "uuid": "f7c6d511-5070-4b12-bd7b-ce994f47a962", "comment": "Malware payload (SnakeKeylogger)", "value": "2f2ec9a036c5b461757504cf496a01dac23ac2d39cbee481978bd3d5e612b407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819364, "uuid": "bcbce2f6-84a5-48dc-91ac-4c03791b397c", "comment": "Malware payload (SnakeKeylogger)", "value": "83b8fd3d134aec765e5a3364bce69cd93996b452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819364, "uuid": "9a4af6c4-ff32-4f96-8344-2fc778fba90c", "comment": "Malware payload (SnakeKeylogger)", "value": "1ed3428a365aa73979abf10dc5fbbe5dc5fce2ab9867cba366feae33ea09f46b51fec1b42176767a6ed6fccbd418cef0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819364, "uuid": "6217bfdc-adc4-4c1f-9377-566a4eaf6dab", "value": "T162B23A446BD48F32E1B781716923474497B9DA12CB3B370BDAAD94229EBF1C0AF93644", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819364, "uuid": "4cbb6cb7-5793-4f7d-b8cc-9416c288a5e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819364, "uuid": "8873a2ff-8542-4a14-a19b-acfc88f82d1f", "value": "384:WS31u5SdzAq+k3bDsHS1f+zm3OkqUA/yAH+172Ih18MUJgm:xI5Azd/3b/+hz/6gJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819364, "uuid": "c4641fcd-b7e4-42f2-a479-f4db91e1f372", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819364, "uuid": "7b34b304-2eb9-426f-bb42-ac11b07938b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819364, "uuid": "f08e1825-08c6-4522-863f-0ab62b6067e0", "value": "PO Order RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd80302f-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648800112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800112, "uuid": "6a409369-4157-4143-90d7-c607b3a9aedd", "comment": "Malware payload (Stop)", "value": "3485c263d36d4b29c9cb27cbb4434172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800112, "uuid": "6a6af5f4-a639-4e8a-83b6-3376884dea49", "comment": "Malware payload (Stop)", "value": "2fbd58e933ac02775649129f2d72a4a40c011f1075d4714052141c6c0813b049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800112, "uuid": "c6697002-c9bb-4f34-ba5b-b6f0dd86d739", "comment": "Malware payload (Stop)", "value": "d35fb493b469e8c3a3cbd1eda2b442a6502983b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800112, "uuid": "4ef0e0ec-df66-444a-8c57-37ba966bd35b", "comment": "Malware payload (Stop)", "value": "7653ca20aad5275aedbf42cc15224abc4c4e629744b204254396e13ff747eea21e948db69d0ba35c066f9c67d9fe46f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800112, "uuid": "6f604a29-7ee4-42de-8bb1-32d7405da161", "value": "T1FCF40200A6A0C035F1B751F49ABA9768B93E7DF15B7491CF61D526EE0638AE4EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800112, "uuid": "f05a19ca-6d62-44c2-8b0f-3181becea4bd", "value": "4b0932ad38c639ac88a395249c08ac7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800112, "uuid": "d6d77be6-9092-4de5-ab63-6e67b679643d", "value": "12288:bP7ouw+6C+VkpGbnDmS9Nmop7CyVAuK95vSqQckuX6eRvKbTZxESL2V/1sQ3:bBOVJD60NVp36u4djHJKsv89fyV/1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648800112, "uuid": "3717fe3a-7bfa-4074-80d0-286910e05425", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648800112, "uuid": "7949d381-61a0-4e0b-a2fb-88fbd83e84eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800112, "uuid": "0148071f-8e8c-4e6b-821c-fc919dd69d3a", "value": "2fbd58e933ac02775649129f2d72a4a40c011f1075d4714052141c6c0813b049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6f2bb7-b1c2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648820942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820942, "uuid": "9eb41c6f-3a23-4777-a1e6-a170bc94e476", "comment": "Malware payload (Heodo)", "value": "1e32dc7599a577264f029eeb25e921db", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820942, "uuid": "b1ed793b-6cc7-434e-8fc6-70863d3c1543", "comment": "Malware payload (Heodo)", "value": "2fc6ac6ec47e73ca5d49559a2ceacb73b04a2d660931f615e6e40cf76cdf804e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820942, "uuid": "f83109e2-3f1b-4de8-8a6d-1e7b8cdc4fa6", "comment": "Malware payload (Heodo)", "value": "443ce95af99029b9c3baad2e144e01a6fdff1455", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820942, "uuid": "953fd5c4-10d7-477e-9d45-62d9f5794e8f", "comment": "Malware payload (Heodo)", "value": "86f39fd7b49928cea77d7c87983e01ac1f543053f4600eb3beb8fbcab702556e0054915e58c6a4cfd2cd7ecb41dcea5c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820942, "uuid": "9275e9bb-d3b5-42ad-9a55-5632c315642e", "value": "T19633E996B659D969FA1187354CEB87E66322EC205F5F17833229F336BFF88B00647106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820942, "uuid": "0ba5c3ad-4fdc-45c7-bc1e-8d66dd56a449", "value": "1536:bRKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+q43SaU3hTZ:1Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820942, "uuid": "2050b87c-addf-47a2-b34e-c3eead2c9f59", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820942, "uuid": "472c496b-a2bb-4b21-a150-582a03e7f895", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820942, "uuid": "a7daff81-6971-4f22-a9d6-ef46846b3c6e", "value": "MAIL-0104.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3976c69-b197-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802645, "uuid": "1f197262-7d2e-42e3-b5f5-3e266caace4a", "comment": "Malware payload (Heodo)", "value": "41802edde3d291b17f7388bc433f7dbd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802645, "uuid": "9ab82cb9-5e68-4fd6-922f-37f4756ced55", "comment": "Malware payload (Heodo)", "value": "301a3f36c2ca0c50392b8a3c5d4ef582c375333f97b6c017b74f9ff06eb1703d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802645, "uuid": "67637ae8-c4b3-4848-aeaa-2a8d29b05057", "comment": "Malware payload (Heodo)", "value": "03dcf0e8b2de25857a50b3856e1c1bc50ae8e470", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802645, "uuid": "45ba5fc2-e694-4fd9-8b96-e43eab06869c", "comment": "Malware payload (Heodo)", "value": "329344a57a52b2729a8b1ab39366f7b936094638ec87144d58e694561c61d75e654fed74bb85fc4ea023d7ce6b1b1d3b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802645, "uuid": "46b7a10a-f120-4e39-b7fb-55a994229fa5", "value": "T12894BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802645, "uuid": "83b2a895-40e2-43fa-9d7d-c96dd342bee9", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802645, "uuid": "b99f3b4c-25bb-4679-9ad1-532a66103490", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDzS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKTrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802645, "uuid": "d8d896e6-9244-4805-a3da-4a3caecac12c", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802645, "uuid": "07c4e2b2-88e8-4e09-90fb-392578c55a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802645, "uuid": "5243fd50-667d-438a-8561-2c4ce57ceee3", "value": "PCikbggdGJYnbegXetS.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7ffcdc-b1c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648824058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824058, "uuid": "438d2b43-24b9-488c-b25a-963c308f7471", "comment": "Malware payload (Formbook)", "value": "ccac95b19a538a7bb7641cb89d9b3179", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824058, "uuid": "94330f17-be5e-4954-adb2-f7791c1ab0ba", "comment": "Malware payload (Formbook)", "value": "308d882a5267dc2b1e74498c052ad6f0ba7e29544f8872600586b9d2dfe798f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824058, "uuid": "a69b6326-e406-44bc-b3d4-f1e83948acf8", "comment": "Malware payload (Formbook)", "value": "d23b91af4db38f962907973534cea0ffadeb85a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824058, "uuid": "4e98ac8d-033b-4227-a393-12d9afc0ae46", "comment": "Malware payload (Formbook)", "value": "b1b7afe91a483a63a858aaef2287dc37e6ad40d9db080cf3c3d49441f3c6ebb49de3434ba2f770b884b4e0d40155795d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824058, "uuid": "1d8f1a01-41f3-4a48-ba9f-70a129569292", "value": "T1FD34125C3358D1A2ED9307371F322AA26FB9DA061156230F8360BF9E3925BD2DA0F755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824058, "uuid": "316ce864-74fa-452e-ab56-5e3bc18f221d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824058, "uuid": "2c9c1a6b-a1f6-48ca-a999-e95f8b1b5ba4", "value": "6144:HNeZmGdBkY4jUwIZjhKibKvYP0oFgOF7gqcLr:HNlmj4jU/jhKibKvY8Eg87gLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648824058, "uuid": "8a182db0-d46c-4663-a907-2aa07016f4e8", "value": 248961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648824058, "uuid": "c53d51cf-4779-434c-9394-e5ba78876c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824058, "uuid": "4fa38a80-630e-4796-9cd0-d8b19459545b", "value": "ccac95b19a538a7bb7641cb89d9b3179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc82006-b1b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648816782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648816782, "uuid": "97699ea1-7c96-4e15-ad73-513dc3c90850", "comment": "Malware payload (SnakeKeylogger)", "value": "531e850ce7611a55476c55c188bb0f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648816782, "uuid": "75e6da30-db65-4e17-8456-c5a29ee0bc5e", "comment": "Malware payload (SnakeKeylogger)", "value": "3142524efdca29ed19bfb8261b38bad549c427aaee7cb6aa0ac035845b880d0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648816782, "uuid": "86aab41d-f7a5-4c7b-b612-d1a4298d915e", "comment": "Malware payload (SnakeKeylogger)", "value": "454ea7d562c03a835a8dfe8c065d6cd183e56229", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648816782, "uuid": "651e5733-8006-4faa-99c9-fa4081cc0450", "comment": "Malware payload (SnakeKeylogger)", "value": "c6edba40e7b9c030d3ce5382999dbbd33ef5447cdb0f0749ac630f6c17c27b4e9f87c21147491c575ba7e9e2ea8c0788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648816782, "uuid": "c7055bfd-0432-49dc-8952-16e2566aaaa1", "value": "T104B4F13E77E5CE13C6645AF680D2522003B2E39BE6B3D74D3DC502994E123E65E8678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648816782, "uuid": "b3a78c36-1bef-4dcd-9883-4d170e8bf018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648816782, "uuid": "43d3657f-41f2-4ccd-86f7-c88e113177e2", "value": "12288:IqpqEGlR1DGxdyEupD1ruHq8zVBa/uNe7PfLLWl:FpqEabKmpppilzO/uk7zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648816782, "uuid": "eddc9d61-db3d-4383-a9fd-d09ad2061b58", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648816782, "uuid": "a0f11c85-1364-4f80-bcf9-c9b18903f3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648816782, "uuid": "a82ffcfd-48f3-4b7d-9e1e-a96b7f051f64", "value": "ING2022_04_0100088877,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0434bc97-b1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648811719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811719, "uuid": "22259f7d-eee4-458c-966d-212bfa5c185a", "comment": "Malware payload (SilentBuilder)", "value": "eaafbdbb1910aeaf5868576d2111a16c", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811719, "uuid": "be642310-7a6a-4a1b-8d27-84f9ab94aa24", "comment": "Malware payload (SilentBuilder)", "value": "33797e5c19cfb844f69a3cf9e2481436cfc8036e72f06ff9a4c83f1a49a57fbb", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811719, "uuid": "c5a809ab-1d74-405b-8373-1c4d5cf8f5fc", "comment": "Malware payload (SilentBuilder)", "value": "cd51405c7904ecf7f89e456d6d33e83bd07e4949", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811719, "uuid": "2824bff4-ce3c-4e1d-b63f-cdc49de2a6ef", "comment": "Malware payload (SilentBuilder)", "value": "881ca66b782d617248fc571750b6e6649447c7c108daf2bf4e7bb2c3e836885558cf55cdcb763f959de41fbd9a476f06", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811719, "uuid": "f3e250e6-2073-49b7-be4e-c875c327aaa5", "value": "T19033E996B659D969FA1187354CEB87E66322EC205F5F17833229F336BFF88B00647106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811719, "uuid": "47744c6a-3e82-4b57-a046-ada3fb314766", "value": "1536:bRKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+q43SaU3hT5:1Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648811719, "uuid": "01ef5473-fd0a-4628-91b3-4e2ee18fae96", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648811719, "uuid": "a1d000e6-6b4b-4929-91c5-33611d75929a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811719, "uuid": "eca68732-85e8-4061-aae6-8399421a469e", "value": "ZJ 0738694.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b486cf7-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648835166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835166, "uuid": "0619fd3f-6364-4dd2-9839-f977ea4dd98e", "comment": "Malware payload (Heodo)", "value": "dae0234bf06522fda266140559e01e7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835166, "uuid": "c628e9f1-70b6-45d4-bb7c-500fbbbb0f8f", "comment": "Malware payload (Heodo)", "value": "3381003a76bb17b640a51b6281e90e0defee1da3d816b47c1797dd148d0ba1ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835166, "uuid": "28d3736d-9a79-4060-8610-f51d872a7d60", "comment": "Malware payload (Heodo)", "value": "99e4572372cd1d4b150a15b46e84e941c02cedf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835166, "uuid": "7c7f495d-5dd6-4c42-ad15-60bb0278f154", "comment": "Malware payload (Heodo)", "value": "8dba189d70ae874112dd3b3e26e94afb226950a9458b901b14ec086bd1fa21dad60ace4fb5acb893e082ad2a1078a3ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835166, "uuid": "e3c5280c-cb64-4519-8869-266a30e81410", "value": "T1E294BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835166, "uuid": "ce7bf351-6281-49fc-a84e-f06de517ad64", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835166, "uuid": "7a441e03-052b-4f51-a8e8-ba665754d2ea", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDhS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK1rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835166, "uuid": "139f1af5-ee27-476e-bbfb-e63d18911c6a", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835166, "uuid": "241a972f-056b-4a14-8799-51502f3c79f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835166, "uuid": "2afee6c1-7d4c-493d-9ac6-907e3119b211", "value": "dae0234bf06522fda266140559e01e7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042c8bd4-b1ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648840066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840066, "uuid": "1f52378d-3d53-4ba7-9430-ecbd07f09af2", "comment": "Malware payload (Heodo)", "value": "80898975498c11946a35053d32250224", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840066, "uuid": "193be427-f565-496a-a7ad-971dd0a67e71", "comment": "Malware payload (Heodo)", "value": "338df0c615a347ba478e20b647843085b6c8a0a2c1ab70686b41670a497fa290", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840066, "uuid": "765daf2e-a31f-4901-a54b-1a87bf0589bf", "comment": "Malware payload (Heodo)", "value": "cdcedac9e0344a36ecd48a209744779a86b23a5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840066, "uuid": "856c4c62-072e-47d3-8e67-721c07e4e51d", "comment": "Malware payload (Heodo)", "value": "319c846fc2ef217f775225178d313b37e020dc4c94f7c5de052644374cddc807b23b5fa1e99f703b2640b058ea596b9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840066, "uuid": "35e8b397-f2b9-4c73-84af-e5ffbd32c3fb", "value": "T15C94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840066, "uuid": "c602a4c4-fc09-4bf1-b14b-632145d60d19", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840066, "uuid": "4cfd5cf3-bbff-402f-b15e-9ebd63a7c8a5", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDbS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK7rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840066, "uuid": "b616085b-543e-4a5f-ad70-bca25fdaa8cd", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840066, "uuid": "60110f78-a63b-4c71-9dba-b98dcaecb57e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840066, "uuid": "78642f18-d4d0-4ef4-8800-0dd08d4b2149", "value": "80898975498c11946a35053d32250224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f22fb3-b19a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648803934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803934, "uuid": "e2f8549f-13ff-4036-86fa-3634781c9da0", "comment": "Malware payload (Formbook)", "value": "8e979dfae67fc4d9924043303f1da412", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803934, "uuid": "8e1f9052-61f0-488b-a802-9783a5136cb8", "comment": "Malware payload (Formbook)", "value": "33f000964a4d13270a320e560ac85e4a7093c5e53df2854e660b3c3ef50f638c", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803934, "uuid": "14dcc58f-7a9e-4b8e-a107-fbdee74f8273", "comment": "Malware payload (Formbook)", "value": "2569036a88cade63d040bf6befcedd6d77491484", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803934, "uuid": "c178f828-c7f0-445b-8c76-a0bf3dae3684", "comment": "Malware payload (Formbook)", "value": "224c567ad435136c4684923a8825fe2636fa2d3fd0eb881d5b7ffb63046367979faf021c68c9f3dc573a31e23fcf23c1", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803934, "uuid": "dcd03706-70c7-45af-9aa2-3703207b3cec", "value": "T125B423402A097760CE909F712B77A96B37CA0A4E3334BB2DCA75E1404731F5BFAAC945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803934, "uuid": "f3975e0d-97dc-4372-a214-79171153fa1b", "value": "12288:mRpicPLFofpNIGVnq3cJqZvF51RdbxgVG2/LhMcBy5JUzq:mrPLqfI6cvfvbxgVV/LhpBbzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648803934, "uuid": "f35e2f67-94d1-40c7-a60d-2b33aaf25bad", "value": 534628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648803934, "uuid": "fff4aafa-524b-45da-8ce7-3f103151803e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803934, "uuid": "822e87dd-65b7-4ed2-b76c-9a4fa1bb671a", "value": "Request For Quotation GM-0034.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3864d656-b1d6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648829416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829416, "uuid": "fcc081d9-35fb-451d-b48b-2eaf8477e787", "comment": "Malware payload (Heodo)", "value": "0e60fb28c563c62a5ecc14ee55897425", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829416, "uuid": "93ea2c5d-bd3b-44e4-b1e8-27e667987f71", "comment": "Malware payload (Heodo)", "value": "348549f367d0f2f8fa0a02b218311f44b0bd8f9fbb566f4ec153c183d498cdd4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829416, "uuid": "1c36bed5-ee86-47d1-9863-44a32e268b1a", "comment": "Malware payload (Heodo)", "value": "7447f9043a608a4027386d2c74ed865b372ab85a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829416, "uuid": "045f2eea-d732-4711-b3cc-5816f403c986", "comment": "Malware payload (Heodo)", "value": "3e7e8e16681cf2caa87aa59694744333feda39c82b4707044146abe09544536e81f3d607c357cd11a0c00304accf17a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829416, "uuid": "a3ea4a41-35ef-48f1-86a1-bdaa72a2b700", "value": "T1D9059E0675E18477E2BF01310E66777E67FEEA504F205AFB23909A8D4971AC24E3631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829416, "uuid": "4e53158d-3ccb-46a7-891e-774b4d4579fe", "value": "2d2fa1ca6236044d56cef7b752fe5a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829416, "uuid": "7fa60ae6-198b-4357-93f2-8c3608af1a4f", "value": "12288:OBOHvWMwoyDdgp4W5dhdu1sRcwF8b3UHv8qDznxN6t:OX/RgaW5dhB8oHvbzn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648829416, "uuid": "2ea819a3-5462-40b6-9421-0612ebfccb60", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648829416, "uuid": "d694900b-1f7f-4edf-ac56-08492419445a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829416, "uuid": "d2ea2198-8be5-4d1d-9c95-9950a1a8c999", "value": "jRH9aRDO9i7VSNNYlYA2abFJwRvnJsB2ZC.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbee2970-b1cc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648825342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648825342, "uuid": "824b6b6b-4fd2-4fd9-866c-87338abc8be1", "comment": "Malware payload", "value": "7364f1da81ead7aa33f01ac19d7d6b39", "object_relation": "md5", "Tag": [ { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648825342, "uuid": "b4f3dbd5-aca2-4a2b-a0aa-83e0cc2c3e88", "comment": "Malware payload", "value": "3562fd71332555b853226bd01b7885c0bbbeebadeacd5bf5764aa74db8dd89c4", "object_relation": "sha256", "Tag": [ { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648825342, "uuid": "5b64f36b-bfd0-4eb4-b031-342b11c5aa12", "comment": "Malware payload", "value": "48139ab3b0f4df7da54a45a2af5e7f785fee791d", "object_relation": "sha1", "Tag": [ { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648825342, "uuid": "69cffa74-69a3-4956-b64a-ca67c1f95da3", "comment": "Malware payload", "value": "24767485163d346f2570f15819eb9e4cfc8a4fc91f33d2bb841422315cfe247556f6aee05179a14b2b60e5661aae95d8", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648825342, "uuid": "4cadde07-4fda-4ed3-b95e-ad620fd3115f", "value": "T1BC5138633652B97A10478B36368E16F9847BC511C69E604AFACC8E9CF4DCEB2374C2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648825342, "uuid": "e9ad7b8e-f54b-4bb8-9f7c-227221a2d2a9", "value": "48:q+MThimb7RWDF7+0h7np0IBN++appLEUI2kIfVF/6NIIYMhmqV:BGT8Df1Ybb36mIxgqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648825342, "uuid": "edc15db4-3865-4c27-abfe-85e893354d86", "value": 2642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648825342, "uuid": "67a9e6d9-87dc-4499-95e5-5b2a6c8b7416", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648825342, "uuid": "178a4007-6cb4-4160-b471-1a0dd2721790", "value": "0dDK6mTD.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04af657-b1f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648840838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840838, "uuid": "d726eaec-b8f2-4b71-aa75-5b631f723acb", "comment": "Malware payload (Heodo)", "value": "d66cd568d8bdd4bb9c76a62cb94f556e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840838, "uuid": "4d25db39-b705-4b93-82b7-18c7898ce095", "comment": "Malware payload (Heodo)", "value": "3577437bb2a8f7d84a50747334238a7f6928fe468047c9a1c3333339b31c8716", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840838, "uuid": "d9d6423f-2c09-42d3-88c5-dea0464656f8", "comment": "Malware payload (Heodo)", "value": "5fa0a892445dc1771a88f1d95c3a8bd1c0c5c62b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840838, "uuid": "dbed4059-a507-4b02-aef5-a237cd154cb9", "comment": "Malware payload (Heodo)", "value": "44d2edb60491ad0f36defa8f401e3c846d3d40f8446a78d14b3e277afc8cbe99b7d6ad8cb121e704af84b90efe6e39b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840838, "uuid": "a001e18a-4fa7-414b-8220-40a0f1ff834d", "value": "T107F4AE1231A3C075DEAF11744A566FA9A6F9FA146B708DD3A770CB3CC9309C68B36217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840838, "uuid": "72d88167-e213-42f9-b317-1a354c9d9d64", "value": "078cf8e17700d87242408b8588acd2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840838, "uuid": "b1607d89-fda8-4424-abb6-31d65ed3cd66", "value": "12288:y7pLgbqIjZbwqHUM6AyJrYj2azO8BOg1s3F2r/:y7ssqeFYtzbO53F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840838, "uuid": "08c8c616-c3a8-42ce-911a-6a4e1608d4c9", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840838, "uuid": "7fc210ff-40e0-4e76-8885-dfa7fbe0d296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840838, "uuid": "4a080e64-712c-40c4-ba39-9e3896e5445f", "value": "d66cd568d8bdd4bb9c76a62cb94f556e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4465e3f3-b1e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648834161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834161, "uuid": "9fdb0890-e4af-421a-84ea-59333eda296d", "comment": "Malware payload (Heodo)", "value": "ba069201eaa412a237e7dd994cc15641", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834161, "uuid": "a138ed0a-6f92-4ece-a67d-81d3ce24dddb", "comment": "Malware payload (Heodo)", "value": "35c05f1c98f1210700cdc615c0cea067a9aaa6f465352b27eafc06bec529ffe8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834161, "uuid": "ea41d17a-62f8-4c79-bb1a-04845ccca12d", "comment": "Malware payload (Heodo)", "value": "e2102ecd2ccbe3f715bd4b4f5f09af7318dad0ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834161, "uuid": "91e54205-0902-4512-a1bf-b4a0727389ee", "comment": "Malware payload (Heodo)", "value": "6a013d5890d3d9f7d6b28066edc6c2aca180d3203d12ecd9ad793c4e41ba4888d5b35fab5bd5ceb63354e0eece048b01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834161, "uuid": "eeb6eb58-20f5-4a8c-af2d-baef50d24b52", "value": "T10994BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834161, "uuid": "997fbdb1-4061-4624-b0f2-e02364b03a63", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834161, "uuid": "7bf8e339-1575-4ad1-add7-d52f625a8f64", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDJS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK9rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648834161, "uuid": "5a8f1604-8b59-4515-bbbc-d4d4779b8879", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648834161, "uuid": "e89e0f03-26e8-4476-b348-5d1dd0c4d8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834161, "uuid": "60e3d143-a534-44c2-9040-46407c5c8eaf", "value": "ba069201eaa412a237e7dd994cc15641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3686c7e4-b187-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648795483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795483, "uuid": "02ad8c4c-408e-410a-926a-458fe162574f", "comment": "Malware payload", "value": "208875c0e9a1c35f3ce84947c028b55d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795483, "uuid": "555c3cc9-1486-425f-9093-7df73b078254", "comment": "Malware payload", "value": "3755f1bc62c47b5faeefba2da3846c1ae4aeddb9a6b347da0087bf2d0854e500", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795483, "uuid": "690043c0-b8fe-4c29-a711-e81a11ec9601", "comment": "Malware payload", "value": "8d084126a83d8b8192ddf4e5032bf38948f2eb09", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795483, "uuid": "ba8a2de2-4852-485c-b58b-eb1229ab4c8a", "comment": "Malware payload", "value": "1d23735532f5082ef3249a066393445cea8dd90aac4142801a16ef7c2a103bd5d2344faf6b90baf496fa715b08a60eee", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795483, "uuid": "575f15ab-e467-4a24-aad7-2ff9a20dfb1a", "value": "T1E61412D9792A35CCE251E9BF34D9106207E89FB8C81B938334E27505EAFCC0B5B76916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795483, "uuid": "570b150c-5d09-4a48-b3a1-0d2a69f57693", "value": "3072:XVLrUUygBIcL7EezSJyD6emu28YJlgVfAQixIYVGLN8cCAW6NR10uoQvat2oVWs8:WWIwBzSJyDr2Xb8VYV47lRGuVit2oVWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648795483, "uuid": "16997759-6bbd-4a86-b62d-bd56fdf021ad", "value": 192040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648795483, "uuid": "1c1d3af3-55dd-4fa6-ba0b-452fadecd2a6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795483, "uuid": "f6a80c63-128d-4a5a-8015-02b666898df6", "value": "MAN POWER NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5b490d-b19a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648803979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803979, "uuid": "e21c9bd0-41fa-435b-a4d8-c6f98dda3aab", "comment": "Malware payload (SnakeKeylogger)", "value": "6f45b441ab75d414861d744ac723e9d8", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803979, "uuid": "38e5eadc-4b84-44e9-8a09-bdddb9689a8c", "comment": "Malware payload (SnakeKeylogger)", "value": "378077640429c6cd0f36cf0c2605d85a5c7b18edf174e2db068f36f79b741dab", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803979, "uuid": "33440f41-f40f-4fed-8f6e-a7d56c0c952b", "comment": "Malware payload (SnakeKeylogger)", "value": "9048dca61c331871acb73f9f5879fc90be16cf0b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803979, "uuid": "9a1de35f-f326-4b38-9501-7012c180b038", "comment": "Malware payload (SnakeKeylogger)", "value": "8e4fcaecf5059ba06e408ba3f54edb1dd1c5ecd3f2258b4a8b35d84109e98673e055f564c54ff7ccf8b8b972e18ee08e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803979, "uuid": "81c64ecd-57f6-44de-8952-d226840cd222", "value": "T1C814121CBE30D212C865D63DF9EE3ACC62B3FEA1888C705CD55877899E3E4026D76192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803979, "uuid": "7badc919-2b26-4b04-ab2e-29f6261c43c9", "value": "3072:pckHaPAYkh98acBHnQxhsfGkDiTgx8vCeLGDb4HfyqcBCJifZPa4BiX3gbgxZaUE:mGYkh98lnQ4hDiXHLGD0q1Wif42iXc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648803979, "uuid": "2a54a6b2-cef8-4f98-bdcb-c9c028cee33c", "value": 192280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648803979, "uuid": "c2b862eb-9cee-47fe-acf3-6f372492b18f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803979, "uuid": "aa1eacff-f7e5-4afe-8ac4-5089ac22cc2c", "value": "50%XprepaymentXform.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30a4c23-b1d4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648828844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828844, "uuid": "5c95250c-28e2-4d87-9d9d-1d1c82981499", "comment": "Malware payload (Formbook)", "value": "0b87473ff163964ec111f298547075b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828844, "uuid": "2fbc5a72-3a50-408c-977e-81325efb932b", "comment": "Malware payload (Formbook)", "value": "37b1b8d180f05d9be7c5a9821e9313993e5becaf03a5e46f4dc9711ad44ceaaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828844, "uuid": "76431560-dd3b-4bac-b1cf-affd930b6f95", "comment": "Malware payload (Formbook)", "value": "3d0a1065612c4cfeefb24322acf9cb43d904362d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648828844, "uuid": "86dccd82-0758-4e53-8884-5def3dc2a2a6", "comment": "Malware payload (Formbook)", "value": "8c632001241b4f49c6f847a7aad08c753f1406f353285895b3c29be187dccdc660cdccda984bd3af4240d877d88f855c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828844, "uuid": "8ddd6708-7452-442d-874e-51923ca6af32", "value": "T199645DB919559B4FF26E1C3D81A83B89A0B059C593835D4DDB2C39FBF5F5308A0CB84A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828844, "uuid": "251656e3-ca4c-46cf-943d-072a2f094f51", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828844, "uuid": "a1dbef4b-a270-4371-8f08-71a6698bd292", "value": "6144:RNeZON827N5wptBh8EF6+ofNxn1g50EG8Y0lWNe7I+4auF9PX:RN7NvJ+ptBCU6++gr86I+69PX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648828844, "uuid": "6f821eef-1482-4b16-a788-f561d1f2745c", "value": 314584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648828844, "uuid": "99f9166d-1d77-44f5-9124-fb3905d98aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648828844, "uuid": "93e903d7-e44a-454f-b4d9-94cca316bf98", "value": "SOA March 310322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc57317-b181-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648793131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793131, "uuid": "753559ed-f037-479e-9b84-3e6e0fe01d71", "comment": "Malware payload (Loki)", "value": "7321ecacd0c776a2ce7158533d75677f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793131, "uuid": "9efa0093-f3f9-496b-81a4-b03d915c4a25", "comment": "Malware payload (Loki)", "value": "3891aba869b31cf5145e28ff2f5294e99a1e931c317d629d54ad645106cbde88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793131, "uuid": "13d27fcf-ee51-421b-9317-98c4b961bfdb", "comment": "Malware payload (Loki)", "value": "f35a4f511ea11f81385712711ecb0ab133c6c9b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793131, "uuid": "dda21ddf-94a0-4204-8c2f-901cdfc22545", "comment": "Malware payload (Loki)", "value": "c4b6c0ab556b994b4fb1b04c897a29199cba10b35f8157263da0729b84d0e7e50fe5d43707bded5e27a6ff03b7967cee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793131, "uuid": "96d17870-9750-470d-8c45-19d2d199ba5d", "value": "T11DB4DF14EC64CA26DBF96AB82463506047B86E54FB4DF73A98C6B0F8D9F63B050432D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793131, "uuid": "070fcc89-6a43-4d1a-9f86-0aa92bf309ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793131, "uuid": "d47ea1af-449d-44bd-94d4-e2c237373ff2", "value": "6144:1rZc9IJSIWmS2p2N5Rg0YpNRBwHZ2YH5+OS4MxHXrwaL7hCa9LlS38tbp:II0z2p65Rg0SRuw4r28Guy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648793131, "uuid": "37976e54-3598-4ab9-92a1-cc14e887c201", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648793131, "uuid": "164b82c2-fe9d-45cf-a34b-1ef97f05b761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793131, "uuid": "0840b6fa-068c-4c33-96b5-2c50bb6e50e0", "value": "Shipment Document BL,INV and Packing list Att.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1044900e-b17b-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1648790265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790265, "uuid": "27f5daaa-4a1d-4ced-bcef-e99178a25320", "comment": "Malware payload (CobaltStrike)", "value": "b77872623d8a150b092bc48a03702040", "object_relation": "md5", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790265, "uuid": "3628bb1d-c8ce-4304-8211-030df34a5a2e", "comment": "Malware payload (CobaltStrike)", "value": "38b52db9c9c30782b229c8a1309faa25e8916ddd918ff6fcce14b40f4b2b353f", "object_relation": "sha256", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790265, "uuid": "75aec817-d50c-447c-9600-c0c95d9967a8", "comment": "Malware payload (CobaltStrike)", "value": "8641dde9bc39b759ec08b30a46341172f76cb1a2", "object_relation": "sha1", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790265, "uuid": "7a5e28a3-12dd-49c9-bcee-818a7d7af7ec", "comment": "Malware payload (CobaltStrike)", "value": "d572e98d1418d237e5eb01bc007224d77da419a5bbc7750fb2d209a6d4e773c1a9fec1ecbc2631af37182e57ec1c5110", "object_relation": "sha3-384", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790265, "uuid": "7882b54a-abb9-433c-b5e4-c66488813f5c", "value": "T13984F157B3FA30F8E4268635C8715A06F771B83243258B6F135846AA1F272D19DBEF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790265, "uuid": "083058b2-5618-4ef8-85e6-ecfbb0159bbc", "value": "07044be2c40e611c29183d5d3b7eded7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790265, "uuid": "3668e3f7-1216-4930-934a-8ad830008254", "value": "6144:gg8S8bLU2IVqD8t776MYJ9hSprlcFdr7UTi5lWw4dJ:gg8mHqy76MChSMnru+Ww4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648790265, "uuid": "7313e217-86c4-4f7f-bd1a-c1d02b2abdb1", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648790265, "uuid": "8d44f0a3-ef0f-44f0-ba42-f7c36c33699d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790265, "uuid": "e6dcd0f8-a2be-496f-9c80-88f2f5a0e031", "value": "38b52db9c9c30782b229c8a1309faa25e8916ddd918ff6fcce14b40f4b2b353f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec8b36e-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648820005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820005, "uuid": "17b72ea0-f44c-4e56-bc6d-27f18e24cc0b", "comment": "Malware payload", "value": "b263e9fce60ff904f9951f20aab8a0d4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820005, "uuid": "40b5f23d-6cfd-4821-84c8-d311236fc8ab", "comment": "Malware payload", "value": "38e50eea1f2c8a100e853b756e13b1a29f5643bd728c730a713b2f7960ff66a4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820005, "uuid": "c9cd4934-1a10-49d0-850d-aed967b53300", "comment": "Malware payload", "value": "f2ca1cd80783681bde25361df56366baf9d9b96e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820005, "uuid": "4151e9c3-dccd-4aa2-9fc2-398191f30b6c", "comment": "Malware payload", "value": "6dfca99c18b88244a412814437bf71e6689191d49a727899420197dcd0c8f3e406e11d05dac286bcdb9bdc8602fb9a7f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820005, "uuid": "116f20a9-89fd-49f1-b05b-119d84d60bf7", "value": "T166D2E685AEE9E77E57F9B06BE1024A789098C4D7C12E70EED0B3775B06052C3C6F1929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820005, "uuid": "91c2b07e-abff-47f5-a063-76f922f74924", "value": "768:Yeeeeeeeeeee9ODypg0F9Zd96eeeeeeeeeee/:Yeeeeeeeeeee76eeeeeeeeeee/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820005, "uuid": "dd9e19d9-6872-49c8-a83a-ca3956ff12b5", "value": 28441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820005, "uuid": "37e65369-4b7c-4d5f-aa18-816770bd940c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820005, "uuid": "7076bedb-8287-4d65-84b6-88a652b4580d", "value": "Releve__ID0021558501.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b992421-b20f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648853957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853957, "uuid": "243673f9-b711-44ae-987d-2023a9520e4d", "comment": "Malware payload (Mirai)", "value": "bebb47148e87d456159ce2858149ba1d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853957, "uuid": "6eb546ed-ee44-4892-8fde-cc3e6945e6fa", "comment": "Malware payload (Mirai)", "value": "393c04a98f811058e115098b39ced7eece9803448ab0d6d82073b61df599d748", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853957, "uuid": "d9991605-1d88-41ea-af1b-6c1cb91f0ee5", "comment": "Malware payload (Mirai)", "value": "ec821c34f344100dc1b3ad6840feec7df800e3bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853957, "uuid": "dec26b7b-0d4e-4425-b87f-144911eb5864", "comment": "Malware payload (Mirai)", "value": "556afc618222a8d4b410d45eca9d337b3c966271896e13639055afb7cbb899a63e2a3ec3d773ff8f4ed5c475831a7cdd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853957, "uuid": "871683ba-1a23-40b6-af22-0ad65968f51d", "value": "T166D34B46FA408B17C0D617B6FAAF414A3322DB94D3DB330699185FF43F86A9E4E53606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853957, "uuid": "9669f8a4-028b-466b-92bd-3a76b653334c", "value": "3072:rlpkszDbZ1v0oa1WKMd9ZHAiUYbtguM/9Fxa:rldzDbMl1WKMd9BASbttM/9Fxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648853957, "uuid": "cb8c7a41-d7ca-4518-887b-62b135a4cc51", "value": 137868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648853957, "uuid": "845d023d-bb87-41b7-9331-357ed93d5fdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853957, "uuid": "dd65f91d-863e-464e-8e63-c2a151184b00", "value": "arm7-20220401-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5041926c-b1ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648811418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811418, "uuid": "455a1017-7c66-4d45-ab16-ce456c8f5733", "comment": "Malware payload (Heodo)", "value": "0633b06dfd3271281bbafb5804a3387c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811418, "uuid": "6cf44a1c-6cd2-4a01-8176-18afdea114a5", "comment": "Malware payload (Heodo)", "value": "39836edd732822c1deb35cbc066c36affbf2939723eb14b779bcf953fbb2d6aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811418, "uuid": "1252ae31-f8e0-4c7d-b84a-09e02f6e7d00", "comment": "Malware payload (Heodo)", "value": "4e1bcf6b827f16ce65bf172bb006b8db7839ba38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811418, "uuid": "2e8d66b9-7392-4a63-9d70-f887161599c3", "comment": "Malware payload (Heodo)", "value": "aeda9663669c1960f20d5a0e577e0819d4724985bec3c280e88af2bfdfc8221d18e961becf4db87b21a7a8236d138822", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811418, "uuid": "8327ceb2-c510-47d2-93a2-9252e9651729", "value": "T1C694BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811418, "uuid": "cb36c36b-70c3-4052-aa9a-d53126c826f3", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811418, "uuid": "db4b144c-a4b5-48a2-bde2-4cb3567abe54", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDFS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKhrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648811418, "uuid": "3432f8c8-dc5c-4444-8b5a-6119df0bb5b0", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648811418, "uuid": "38070f38-e7ac-4a32-b36e-024082b26c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811418, "uuid": "8a474046-02b7-4e17-adc8-f54e3cc050a6", "value": "0633b06dfd3271281bbafb5804a3387c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a3ab54-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648819102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819102, "uuid": "4e082b2d-bafd-42bf-a39f-f03cafec86a5", "comment": "Malware payload (Formbook)", "value": "02a922bbd5a983fb351ebf4d0c2370ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819102, "uuid": "70ebbe60-b707-4159-a7e7-497d208a9f86", "comment": "Malware payload (Formbook)", "value": "3a00a090c263abb496651ab7cc34306e224c62b14c3a8b85fe56d30c51af1bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819102, "uuid": "66bf4b35-6fc1-4031-805f-11903eca69ae", "comment": "Malware payload (Formbook)", "value": "cd2ccc1597efaac9c295314b7abd99514dc2f1d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819102, "uuid": "472fe83f-4999-41ce-bd72-67da1b608632", "comment": "Malware payload (Formbook)", "value": "55952ff8237b843bb576fe66fc5024b5a6f3e10292810ae8f8d27ef891cbc94148bd6968298308e3b2e80bbcedd100b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819102, "uuid": "1603ab77-a95b-47a5-8491-b248517d8063", "value": "T19734124977F4D439C0622E315C716A772DDBE02A1079EA0F1B607F6EBC32643590E7A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819102, "uuid": "610e9af4-1fa1-474c-acc0-284d4a3e372d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819102, "uuid": "58b80fe2-ac48-4bc7-91e8-86d765cfe1ea", "value": "3072:l1NjcVVnLpPunblsMsDMcMG5dbRoB695wUW8l/n1h2DRUsydwqBSI71sWgy8yZvb:HNeZmlf2/RM69fW8jh2DkXYcIJWKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819102, "uuid": "0493a145-e9ab-4288-b5c5-493bfacc4f58", "value": 247881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819102, "uuid": "22b01f56-6ec4-4477-a534-cd81fd7f9ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819102, "uuid": "26d75209-5d7b-4580-8541-8d20d5b8188d", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adf31f1-b1a7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648809368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809368, "uuid": "3b9ac0ed-e7b0-4e3d-809a-5073eb5b8500", "comment": "Malware payload", "value": "7b33d507a6642ce6572b9bdee6f85981", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809368, "uuid": "f1c1d69f-d1e6-4677-8acd-1516181dc6ed", "comment": "Malware payload", "value": "3a32ae630c1681add5675f8081ec5f923c06a3f3e3c3d6d6427c8e53b09d32df", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809368, "uuid": "18f1aa7a-8fda-4daa-b61b-7b32d97fc76b", "comment": "Malware payload", "value": "c3f926876f719e9744f5ff3bd69e1fec9c2d7638", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809368, "uuid": "74e8d6b9-1ad1-4322-90cb-ff7e1fb23b90", "comment": "Malware payload", "value": "65225d5d020e3824b2fc99cb39ba575a0a8828c9a3f58b2ff61fcb3534c615171d62ab16acb04d27d2f721299e04e629", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809368, "uuid": "239718b2-4bee-4ae8-9414-10287c70ad31", "value": "T113328DBDCF04FC1CD155C97E852667E4FA081243E662B24DA0A237086FD14CB1BF64C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809368, "uuid": "59150603-e767-466b-94c1-d5f2f913eda9", "value": "192:ScIMmtPxmg0gz7KkIR5bv/0opt0xZjNsXynSHbt+MD0q:SPXugSxtUZjCX4S7pD0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648809368, "uuid": "c1954706-4840-4692-ba4b-3d12f3e2910b", "value": 11285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648809368, "uuid": "dfcd018f-d1a2-443b-9a3f-1365d47c0372", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809368, "uuid": "fde89fcf-d510-4a32-af50-1f93d379d67b", "value": "Attn.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d3749b-b1a8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648809742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809742, "uuid": "bc646da7-08bf-4db2-b4e5-eafe1bac7b2f", "comment": "Malware payload", "value": "61ab79e571d41efd843c7a8ac904cc68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809742, "uuid": "981b513c-7eec-4253-a01b-a68751c21838", "comment": "Malware payload", "value": "3ae9278821900919783c2f327586d49c0bdd394e820c72c46d0f83a849d309f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809742, "uuid": "8b082010-44e3-46d9-8b95-b8abb6b43ebd", "comment": "Malware payload", "value": "6b4e238c5e0c89f67d3187a518383ad539aad5c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809742, "uuid": "360e4745-2155-40da-8eea-93151394fd7a", "comment": "Malware payload", "value": "423c990aa1e1aadd3aed2c6872bda5af2e1351f4b9083bf5bdde67caef6ce297f41c8a639c780e0783b7601512889337", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809742, "uuid": "13cf83c4-5b2c-469b-b241-56d885fc525c", "value": "T1A2848D2235C1D072DAB211304F69E77196BEFC300F2116DB63E47A6E5E346D1AA36B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809742, "uuid": "dab0b50f-fa1c-44f2-8c02-7241395398c2", "value": "6144:9wTBqvKbr+R2Yyw8LrrbyNH0hkdR3y1z1bvMWWvgeYyNdAONLu2ChyiE:KT7+R2Yyw8/rbyNH0S3cz1bv3eRdHIsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648809742, "uuid": "2bbfc478-bdb0-4026-88d4-18b6a6369758", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648809742, "uuid": "c1a1d792-0afd-45c5-905d-18ad4100b60f", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809742, "uuid": "2fabd20c-c27e-4062-a488-a2ee6c43734a", "value": "3ae9278821900919783c2f327586d49c0bdd394e820c72c46d0f83a849d309f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bb7a25-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648820102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820102, "uuid": "78ebdf0b-1761-4068-948d-44be32b91b9a", "comment": "Malware payload (AgentTesla)", "value": "5cb9a756eee56aa418209890282e4d91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820102, "uuid": "7e56fa82-2721-4be2-9e06-297ab7db0e9f", "comment": "Malware payload (AgentTesla)", "value": "3b35160a0221a2abd530bf26c039844ed986971c906fcb6e6feedb8978d076b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820102, "uuid": "8d4e210c-d3ea-4c1f-a1d4-431657e65c12", "comment": "Malware payload (AgentTesla)", "value": "3eeeeff129119249d7251b6b61b2d5f04278cefd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820102, "uuid": "48ec263a-a6cf-4788-9d2d-5e106b27b978", "comment": "Malware payload (AgentTesla)", "value": "1e7a94f1e3a513837ef46e06b4f981ab72a70fd1c84002ec9a257126976fe09d4979c7973dd730aa3834c4dc39d66460", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820102, "uuid": "efafdc7a-43e0-4bed-b717-15ae5a636b2a", "value": "T16A15237333D88E10C2FA5B72425185851732B92B3632EE0C76CD3A4E1A7BFC552957AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820102, "uuid": "1254cab8-c10d-4a4e-830e-c3a6c29ff61d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820102, "uuid": "101b4488-e955-4352-a0ff-60beb09e5b82", "value": "24576:8D3mc9F1wLy8seZGzvtaSB32gt78KIYI6RN8dzKDC:wH998Z2vt5ME78KW6RN8dzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820102, "uuid": "af09261b-004a-4036-89c2-db0e94b5bccf", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820102, "uuid": "e4dd8290-0d65-4d75-bc72-1c94c241f7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820102, "uuid": "115a14d9-26c2-4bc4-bd8e-d2752c05432b", "value": "Your new DHL pending delivery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428c1823-b200-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648847472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648847472, "uuid": "6ba7f331-c171-4483-817b-6a911bcc7bc1", "comment": "Malware payload", "value": "c4d42daf10bbae8c4fc481250cb5b069", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648847472, "uuid": "a5753ac7-1297-4d37-b86a-f32bc4ec0112", "comment": "Malware payload", "value": "3bdec631e082e303b957cf11a67f5600ee67f94b2d2fe683abfd5d23677adeb2", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648847472, "uuid": "f0632f8e-49e0-45cf-ac49-3f6df0d8be32", "comment": "Malware payload", "value": "9a38ef3aec16c02f548b9075e74e74ed58d6013b", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648847472, "uuid": "8fef72c5-5790-46c0-a845-9bec7dc60242", "comment": "Malware payload", "value": "e4692af99088db40ec12a32e90ff9fecfb47670ac2040e259a35150e13b1feff2535a49f9e5c4e21dc5b8e60dd63c80d", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648847472, "uuid": "7e373787-affa-4140-b77f-2366a7454227", "value": "T1EE955B2B5252DA2CC18AD13007EF6B722351F9AA9B163A5F32D467363FB5CD1031A74E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648847472, "uuid": "d62ab8fc-6f77-41da-bac0-f6b82945e254", "value": "24576:jcfFK/ShZUi5fhfv8Fou97TdzCkENCCVy6pS/cEog6FVanr:jcfFKahZ35Z3uxpzfENCCVZpAiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648847472, "uuid": "bb088925-80d4-490d-8ee0-95799e76cf8b", "value": 1885888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648847472, "uuid": "42d6a288-ff52-4218-a005-15580dada373", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648847472, "uuid": "16fb7f4b-2aa3-4eeb-9140-dc1c715eac2d", "value": "3bdec631e082e303b957cf11a67f5600ee67f94b2d2fe683abfd5d23677adeb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21fb827-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648818937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818937, "uuid": "ca64dc9f-e879-43d5-b36f-f03f29c832db", "comment": "Malware payload", "value": "811bcf62ead45d21bbab91e272555f50", "object_relation": "md5", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818937, "uuid": "c124b1f2-d278-4b40-a43f-101e4b0a689e", "comment": "Malware payload", "value": "3c3bf835742e7a36b7a7c7866965e351077c08c48479f2cd988133bf65f22cef", "object_relation": "sha256", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818937, "uuid": "2c2ceb82-a4b9-47cf-9985-40b6b448204a", "comment": "Malware payload", "value": "a01d4c55c017099609118aafd0796aae3c6529c6", "object_relation": "sha1", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818937, "uuid": "1a05275b-b063-4198-8906-5eea0029278e", "comment": "Malware payload", "value": "5870c47f154344d032b1ff5733d1d572633b51f7156160132ec270cbf7eaeac513855db9a267cf24405ddaf0309a004d", "object_relation": "sha3-384", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818937, "uuid": "1e766f81-fafd-48aa-bcb5-03a1f96c020b", "value": "T1EB35127E0F0602D9E1EF7032C46F7645BE622FAE15615D980229742E483E12E94FF6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818937, "uuid": "d911fbd2-19a2-408a-a0f3-67fe0b3b03ef", "value": "e5b3ce3bf01043af19ef55e0af6f44ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818937, "uuid": "3a93e264-b58c-41e2-9409-f7d7d60508f3", "value": "24576:dZZZpppppUAqLKEBR7+Js0Lm9v0lQpOyTlP6AzjO:dZZZpppppUZP+Js0i98lcOyZP6KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818937, "uuid": "20a8ca57-eaa9-4308-a60a-f55b07b488e5", "value": 1058640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818937, "uuid": "f1fd6f50-c0ab-4c9f-a5c9-e36267aeaa89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818937, "uuid": "ceed979a-5836-480d-ab24-9cb5e51895da", "value": "TrdngAnlzr9562.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7b710d-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648818738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818738, "uuid": "775c0c6d-5e6d-4b7f-804a-b5ccf4f02c44", "comment": "Malware payload (Loki)", "value": "d0d4b9e2c19693627f7c31b486beffa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818738, "uuid": "afce9385-73db-4de2-93dc-65f2162ece50", "comment": "Malware payload (Loki)", "value": "3d1c6fe9a112f3345793c4ccd967a1096741be7ab4c5d4b2f30532f561addc2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818738, "uuid": "2a210f56-ca04-4e87-8d86-c475cce8d4f2", "comment": "Malware payload (Loki)", "value": "7b03603614227dcd4b0a52735236274344651001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818738, "uuid": "d71d3da3-e7e5-468b-8dfc-0dbfe401a6c0", "comment": "Malware payload (Loki)", "value": "f2a44f3d07d445dd0ef46f67f2fa24a122681c8caafe0057d5706b21895a2868b4af8cb9c9c3b0eeceefd3e47e0c27d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818738, "uuid": "7223127d-700d-46e4-9aed-d0fde9760518", "value": "T183F4120336D45F12C2ED5B71259218842A77BD3B3422FB0C2AD9709E09F77C5A7A639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818738, "uuid": "0e30af34-cedc-40e9-a2e7-16730d5ba760", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818738, "uuid": "9ebfbd1e-fae2-4738-a0d7-8d41c278fe5c", "value": "12288:SUuGJSI3zIcR6sgVUFarj2KYctlN3MYEow2FKxoOnT2:WGJSuscgsgVOKYUH3rh3O6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818738, "uuid": "c1c1add5-74c1-4409-b84c-a1001d32b5c1", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818738, "uuid": "063b06f0-3849-46a1-a04f-f5a51f723324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818738, "uuid": "f0263040-ae49-4809-9011-3af6d73979f4", "value": "detalles de pago.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0079604a-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648819444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819444, "uuid": "1b3345c1-950d-46d7-af2c-69ec5b28bfaa", "comment": "Malware payload (RedLineStealer)", "value": "134bd28bf9c17bef55bcb4a5e75729d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819444, "uuid": "26714e3c-49b4-4c88-b329-99300bcfc2e2", "comment": "Malware payload (RedLineStealer)", "value": "3d4df6d8b149be7758c42907bfbfdd49a0ea6a235b5fcee7d244bebb6af16809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819444, "uuid": "08339265-7749-447f-8e99-2c74aa018305", "comment": "Malware payload (RedLineStealer)", "value": "d3aa67d4b241aaa6fc86ef0178f1fb14080af3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819444, "uuid": "c3869774-fb8f-4b46-9b70-395ec8a2f790", "comment": "Malware payload (RedLineStealer)", "value": "d7858323ea0476de898c7a0b8c52d88af1584be65caa1d969985a7ca5f7a41a8229ad8db0334c192e8bbbf33f29bf6c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819444, "uuid": "6e54266b-275f-4ce5-b9ab-6fede70e087c", "value": "T13374C010B790D035F5B716F489B993A8793EBAE09B3495CB62C516EF1634AE0EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819444, "uuid": "f9471627-14f9-4c80-ab76-8156b046cba8", "value": "0ae6434a5f502e4848fb7a3df766bf78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819444, "uuid": "0fb878a7-b88b-4c23-be80-578fab9a70d3", "value": "6144:x/UOcy585dO9aYaXOxNLdxzQcVHQ8lsjrCC186hYQy67+2Hza:x/fl585dO9Hayp1QcVwbjrr18CY++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819444, "uuid": "542d9c20-40e2-404e-b55d-c0c0275f572e", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819444, "uuid": "55e97cbd-16bd-4da3-b382-4f0e961c63fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819444, "uuid": "4852450a-7383-40aa-9545-d0812fa9b046", "value": "134bd28bf9c17bef55bcb4a5e75729d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e18deaa-b20f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648853961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853961, "uuid": "691e51ed-1200-45ed-98fa-393348d2168c", "comment": "Malware payload (Mirai)", "value": "2887294fc993240ca662970163e4995f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853961, "uuid": "80eac3a4-ee7c-4563-89bf-28207b43b00e", "comment": "Malware payload (Mirai)", "value": "3d604bc58e44905f3a49568c8859559c0b8826ad5ad92d85f9d4ec10a3c3ff19", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853961, "uuid": "be1996aa-cc96-4c6c-baf1-8e58db63c720", "comment": "Malware payload (Mirai)", "value": "9fb16c9ceb523274c6c2d59a2cb0b3a1c2c4583b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853961, "uuid": "00c55dc7-58c8-453b-b267-1ddacf1a2c20", "comment": "Malware payload (Mirai)", "value": "b9c27a37f652593cbeadcea5faadccdb4f08b6ac8e2f327c66779cab124dfad13ee419d775ae3209e28d26aadfed874e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853961, "uuid": "915e0d51-7ab0-4c89-95ae-f9445f5a5d55", "value": "T140531885BC919626C7C053B7FA2F018D372997D8D1EF33039D291FA0768AC1E0E57A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853961, "uuid": "b1493c37-0341-46e6-842f-a64210b5b63a", "value": "768:CXj8Yv/GwgcJLEnzQTirCSisxKDoKkl0InB2oUlUISI41++ZnxFGq2XKdhNP3N/I:g8YvHgcJLgpWSdK+lGwcPIw9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648853961, "uuid": "fb3ba4ef-db5b-42f4-a161-fc1023fd14f8", "value": 63640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648853961, "uuid": "d401b906-b0b9-48fb-982c-35ef2441053e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853961, "uuid": "ec2a6531-2247-4adf-ac83-f7c21dec8f17", "value": "arm-20220401-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e188a774-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648818963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818963, "uuid": "70925b9a-722a-4030-b480-db79ff658671", "comment": "Malware payload", "value": "ed2727b1076c806b6d9f744282bf1039", "object_relation": "md5", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818963, "uuid": "395b31fb-cfa2-4fa8-b960-fd05a2752a32", "comment": "Malware payload", "value": "3d616db3bac20e1f2aeb4aa9ad6c53a64fb2ae692ddd4dfbca34e7552a772c13", "object_relation": "sha256", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818963, "uuid": "ba26483b-4792-4884-90b5-a66a413adf44", "comment": "Malware payload", "value": "05a6d0e26500b9c8fb8324c5132fdcf46c638fac", "object_relation": "sha1", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818963, "uuid": "489c7bce-d402-4e85-84dc-9ab5a10ff5de", "comment": "Malware payload", "value": "8fdc82093979c86ef411113f39fa97e82ab95c8b1c7547398c1248b7a690d0436e5b2324e08ccad8e7589ca18e08b126", "object_relation": "sha3-384", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818963, "uuid": "e58584c7-22ea-46df-9e70-fc453636e1e7", "value": "T18535127E0F0602D9E1EF7032C46E7645BEA23FAE15615D980229742E483E12E54FF6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818963, "uuid": "f4e405dc-492f-49e0-ad1c-c17e16312b91", "value": "4671658c22236be683919824937a2871", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818963, "uuid": "b80d2816-3d73-4c9d-8cd2-9dd04b738600", "value": "24576:OZZZpppppUogicjXgv6dqrp2xoF5U+UqZ6LAS1+HB31:OZZZpppppUGcMvnd27TLAc+Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818963, "uuid": "c85ba8ea-24ba-4238-83bc-555843d80e1f", "value": 1058784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818963, "uuid": "78bd813f-eef8-4ca1-a4f3-6ce6999704b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818963, "uuid": "bc33fada-1a48-4045-95b3-42fba0345922", "value": "TR15Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2b31cb-b1b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648817050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817050, "uuid": "4b1ef020-699d-4422-8843-b2b8bc0b66b4", "comment": "Malware payload (AgentTesla)", "value": "648ab5fc1be7f187be8572e58ba43c07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817050, "uuid": "34ddb6ca-a494-428f-b963-8ee4ec52e8ca", "comment": "Malware payload (AgentTesla)", "value": "3f6530552bf12fb63f283efe0ef43d4dc0808f9b59cd27437825d77f2cb61c56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817050, "uuid": "0102c233-e575-4234-92ae-a3a060b0d016", "comment": "Malware payload (AgentTesla)", "value": "49b6a4e863f29b4486489dd60d4a87906f6d5897", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648817050, "uuid": "ac4b00bf-80a8-4c9f-9817-ca5e6ce10268", "comment": "Malware payload (AgentTesla)", "value": "cb7ada4778dd976c617e40e1942788d46db4b1f6679d849661b92fdbca7e056259d353fe00c20a753ca82a0debc6dc4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817050, "uuid": "f9e78b66-5aff-477a-b59a-febec488db87", "value": "T104C4011D76E6CD02C16815F280E351110371679BA673CB9E2DD033C69E523AB3E9BB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817050, "uuid": "51751157-9945-4684-a843-d81d36b6805b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817050, "uuid": "de67f27c-3728-4c3b-addb-6947b1203ddf", "value": "12288:YvFJ7QQtt3v/zT8ixSunhBQ+XKRXpREjZgU2gr5y:6wQtt/bTDxSu7R6R5REj6gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648817050, "uuid": "92461936-90ad-4e7f-a2a4-e6be12cff04e", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648817050, "uuid": "bf6dec9d-b19b-4451-ad51-a55e57dfe161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648817050, "uuid": "e97c1cb8-99c5-4fb9-ab17-0809cade213c", "value": "Aviso de llegada DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b598308c-b211-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648854967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648854967, "uuid": "4c362052-78ef-4aee-8a7e-af92b8cba2ff", "comment": "Malware payload (njrat)", "value": "a35955c88c4df2c75d8ba866d6e1d2d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648854967, "uuid": "8840afcc-061c-4f8c-9e2c-aa472b635324", "comment": "Malware payload (njrat)", "value": "3f69a3f80f865d5c42473f9c586c5302005f988fb2e2ec09228e9e7dd5277158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648854967, "uuid": "aa24126a-5def-492c-9e20-109996c742d5", "comment": "Malware payload (njrat)", "value": "d47d183ba4ac100859dcd7796fcc27488a29b4eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648854967, "uuid": "8e978b51-dd7b-4377-a190-e0643c3afcef", "comment": "Malware payload (njrat)", "value": "975f7b07a31ad7f8063fc642e1846b6ce71990a01fc6a155756486e15c30f4f8ca27e5c8c33f88df1b86696bd45e7cce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648854967, "uuid": "e7598342-e441-4bdf-84b6-b349d55d1e90", "value": "T1CC5633A2B9D2B9B3FCA63C7911338C26025D957970C1DC20B4C51EA894BF677E334E69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648854967, "uuid": "9bed3844-0279-4206-977b-342e1c486c8c", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648854967, "uuid": "b70b18e9-d7d5-469a-bdd0-858aaec36b9c", "value": "98304:xWqJ34vfza9E723r4B/gf8BXfwcTxrsEN/Os7EBqBYDzL/1:xWqJ34Xza92+cBYE9JxzBOY4Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648854967, "uuid": "3f35c881-8cff-4ce2-a563-73e455260031", "value": 6433792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648854967, "uuid": "049e2d4b-2de3-43a7-ae91-b70e210f0592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648854967, "uuid": "0308565a-a56d-40e0-9f31-ee591d153c5e", "value": "a35955c88c4df2c75d8ba866d6e1d2d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c5afa6-b1a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hydra)", "timestamp": 1648806548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806548, "uuid": "50942a6b-d185-45bb-846e-7215468b0643", "comment": "Malware payload (Hydra)", "value": "c34d943b9dc1618d424af57cbdfa4a6e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806548, "uuid": "7b437758-96d0-4e40-a259-3bd36c585a0f", "comment": "Malware payload (Hydra)", "value": "3fe3d4f0cbdebb784d1a96dc7d9a4ecd4e9c080860bfa87e50084930aa0d4198", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806548, "uuid": "ce884955-7d43-4c83-9b23-7cd93222adf7", "comment": "Malware payload (Hydra)", "value": "6e6487c3b689201b43621b47319a7f6514fa64ea", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806548, "uuid": "cc0bc395-ff9b-44f3-8986-9c23abe60e08", "comment": "Malware payload (Hydra)", "value": "6831e56a146a738614c9049f271d1f231d6387bc702c876c17756bf9048d1e3dae60f885372045dd8b750c08018d6df7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806548, "uuid": "6540d0db-d575-4e0c-af0f-f3d794b8fdbc", "value": "T101F533CD76681172D9E509735064D2BFA1318E8E66137192253AB3FCEC3A6D2E7630E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806548, "uuid": "f8c81733-8c1f-4727-b1b0-27a5724238b6", "value": "98304:IJQSVPA3KjAL5n1pP2yIYrpCaQTBUvEwuW9T7qMpj:3cg1ZIYdCa7vE4rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806548, "uuid": "6d324d90-ec3a-4d49-84b3-d468cd2ebc4d", "value": 3587062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806548, "uuid": "608ee539-d484-4605-94ea-65de1a71a71b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806548, "uuid": "27d7726b-a92a-498b-a0f9-a6ba5097638d", "value": "bawag.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516a22a6-b1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648821727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821727, "uuid": "4f7e86e4-9558-4484-8f5e-d6137964b46c", "comment": "Malware payload", "value": "4432448ffac34480656ea24354100940", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CS4.5", "colour": "#060F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821727, "uuid": "b1610e18-d96c-470b-a7e8-2e9c7e1bbed5", "comment": "Malware payload", "value": "4114796b6e78026b46e22ded9c368760129544f70fd9955fe9fc9b1e804d96b2", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CS4.5", "colour": "#060F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821727, "uuid": "9a825699-6130-4b96-ab24-4e820e7675da", "comment": "Malware payload", "value": "f67c73d11847ed55fd546aedf6dbe548f83ae713", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CS4.5", "colour": "#060F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821727, "uuid": "fd57424a-dc96-407f-a772-0ff7113df847", "comment": "Malware payload", "value": "869586d9e750a9e47828085f3b9eefc21e42a75a5023933a99ce109728fdf16c004b92857b76067e4c6756c588c0afb2", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CS4.5", "colour": "#060F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821727, "uuid": "74392436-69a4-4213-aad4-68ca9aa4f8e0", "value": "T14D7171583FDA694ED896F446BD2EA8C11E3C1EAF95C62C00B5F49220A4B7C2591F2B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821727, "uuid": "5771527c-2903-4f02-8d52-87cd001d1fa8", "value": "48:CwgG6Xb9R/9lOvj7vMZ/+VInj3uQt13IFR64/0kpxg1Had9A0lg+LJV0ljW:pg5SvvvOmVeLx1Yn64MkAwrA0lgUV0la", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648821727, "uuid": "c2370672-09ce-4690-a5cd-f57eea11f6ef", "value": 3551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648821727, "uuid": "97cc5042-5a0f-483e-909f-b0dd6f6ee8dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821727, "uuid": "09142c1a-98b1-4beb-b190-67007bb53e59", "value": "powershell.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06257da-b1ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648812492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812492, "uuid": "0113e17e-9b20-4a69-b21d-669de92d095a", "comment": "Malware payload (AgentTesla)", "value": "40859baad1f64df90689fc6bc0956bf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812492, "uuid": "b8153eb1-69da-40bd-aca0-e75d651f7531", "comment": "Malware payload (AgentTesla)", "value": "4218efc02631e4e9817f6fc7f6ba0094a1d35c1ae7aea12c694f4c3c1066e123", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812492, "uuid": "3c3dff33-267f-44b9-999c-b81c3ae6a0d5", "comment": "Malware payload (AgentTesla)", "value": "05ba7a318b03e5a7411811707c7718f92c6d26fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812492, "uuid": "3e778787-cb03-4f91-bc90-273d462c33ea", "comment": "Malware payload (AgentTesla)", "value": "1e189934427029fe037e614fd77f7bdb291808f80245676d4d7fd50398a169c2fccce02eec7497071bc33d4782a08a48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812492, "uuid": "3353ccff-92fd-478f-9695-f417794e25d0", "value": "T187B47CAEF2F47ADFC84BC07199581C69BE5078A7630B8503E11711A9DA4EAD7CF143A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812492, "uuid": "d4a0ebbc-7dea-48ab-b5a2-feb53af52634", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812492, "uuid": "1f3066e3-b2c9-4da4-9616-cc87ba99e128", "value": "12288:d5beFpWqFbNJM2VG6AFELEqdgcJDJl2Is1VzCq0OUzRh/BSazQCtJC+93Ke1S:fcWCM2VGXQHb2ICQ/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648812492, "uuid": "de07bec5-398c-4ea8-9b47-424a2dc9cd4d", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648812492, "uuid": "476de770-1633-4a30-8fa9-0a810cd52728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812492, "uuid": "12fe9027-52e4-4846-adcd-35a2b378d7be", "value": "Swift-Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc34c91-b14f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648771739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771739, "uuid": "9ea3d9cd-1004-47f5-aea0-85391505d88b", "comment": "Malware payload (Heodo)", "value": "5dcddcd3d3e4d9e96e9ec97dca2fa5ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771739, "uuid": "f4f63f06-0149-40c2-9dad-289b91b0cd72", "comment": "Malware payload (Heodo)", "value": "4230dc850a0506a29d16dfd0f6336d8719fff7fe62d21b1ae6771ae90c58c1ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771739, "uuid": "4617a3eb-3706-4f8a-b8b7-b07edaa68a9b", "comment": "Malware payload (Heodo)", "value": "077d6efbdc09cd0a7f4fced678ba159fd407377b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771739, "uuid": "3cc8b755-7cee-46f1-afc3-c53fe9a7ffaf", "comment": "Malware payload (Heodo)", "value": "de5815101e72bca4db1a86a1bbb00e1d6c34186011368589b31ea8a0b34c010c139cecf482544c3f5f28cfa0d11a3f2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771739, "uuid": "5c2096dc-0dd7-4845-8b22-1982d80b0a41", "value": "T182B4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771739, "uuid": "4fd86e43-8c52-4ee4-a7fd-adf13c3e5c3d", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771739, "uuid": "703f61cf-f604-44a5-a481-8cc91119a03d", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQBJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzPDIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648771739, "uuid": "d510957e-5598-408e-9878-2bd6a5c4cf51", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648771739, "uuid": "9ae8be8d-8cad-41d9-ba5a-4c9063173214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771739, "uuid": "8e9d2a00-990f-421e-ae02-79ccc0662889", "value": "5dcddcd3d3e4d9e96e9ec97dca2fa5ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c602bdb-b20f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648853958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853958, "uuid": "bc86380f-c6f4-4b72-8a4d-456319ff21ae", "comment": "Malware payload (Mirai)", "value": "a046234c73144b79059f8aa66dfd9790", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853958, "uuid": "785f984b-dd4b-489c-a97c-94f3c167c0a8", "comment": "Malware payload (Mirai)", "value": "424a409ec53704b6d5e9086b03efb9fa3897ba035ea1363ffba445e0fef8f61a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853958, "uuid": "5d899036-88eb-4aee-9061-406a8d3f7d3b", "comment": "Malware payload (Mirai)", "value": "c8c58360d1decd40b8d82234a01f1bd74c011a09", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853958, "uuid": "b77632d6-b4f6-4936-8658-f2644f58dfc0", "comment": "Malware payload (Mirai)", "value": "646fad9e219701702bb1255f1fc79be15631006a7749be1fc42f7df405bc36a96a3d87d4f9297f661d51b77e1a9d057b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853958, "uuid": "fc446256-c663-4d37-86da-1f1143622562", "value": "T123532AC0F5CB45F6D807483460ABF23FDA32D53A80719AADEF9A5E32D927701621639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853958, "uuid": "c6a670d6-9349-4041-8335-cb2d1da579b2", "value": "1536:/rtk/Bo8rY4OjkMGtrV6krsTdD2ujLlr1UdS:Dtk/prYZgtpU/jpr1OS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648853958, "uuid": "ee08bc39-68d5-4e1b-9702-869b9575b01e", "value": 63440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648853958, "uuid": "fdfddcf2-c7ae-42cc-9c77-671539bf4972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853958, "uuid": "144622d6-ee35-4c4c-a4c8-124f4112a0cd", "value": "i686-20220401-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f683c3-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819633, "uuid": "22a4ca18-ab05-470c-89d2-0c47246f40d6", "comment": "Malware payload", "value": "31262fa87aa83c9d58c3ae3e32827e0c", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819633, "uuid": "0aa77260-841a-4b62-b662-9020380393ef", "comment": "Malware payload", "value": "42ba6f80e87870782c7df19a0d335f31f9660616baca483c3fc2a7ce44570767", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819633, "uuid": "8cf2db37-48c3-4786-913e-19a9784ea03f", "comment": "Malware payload", "value": "d01039b254208556998d687029c1950d7189896d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819633, "uuid": "28fccb82-bec0-4fab-b30f-cbf1b345d19f", "comment": "Malware payload", "value": "4580f84a91f4fa04c9869cf43dda3571aed9436301f17b1281b8008df29ae9755aece52786a15a28b439e60359b5be8d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819633, "uuid": "372c3ffd-03d2-43f5-b232-7a2da6a2e869", "value": "T128140102B1EFA928FCE47DB586128E5892DCEC11C374595E51DBF22C7E7C6216E2C2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819633, "uuid": "20c52b4a-3bc2-491a-b2b7-dae2e03cfbac", "value": "3072:oh/aJ50CyiVt8niPnA/npH463y35dTen2iKneHm6Ps2tEC1wjmKmXW2WDvN:g/aJXb8niPnA/npH40y35kn25e7hm/m+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819633, "uuid": "2c122e4c-31fb-4adf-ac67-313666a21526", "value": 192424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819633, "uuid": "f5a0d698-5fea-43a7-85f7-ef46b758f312", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819633, "uuid": "9ad31442-85f7-44f9-9237-4217f1bd682e", "value": "PO_UTRA001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8fbb9a-b1a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1648810203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810203, "uuid": "9107982f-5177-4b8c-9d5d-3b4cb3fcfec4", "comment": "Malware payload (Gafgyt)", "value": "5059a86a2e7650c7c4adbb3a3e94ecce", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810203, "uuid": "97e1dc92-f233-4fa0-adf6-efe3ab46d95c", "comment": "Malware payload (Gafgyt)", "value": "42cf396d7f01e7e2e0f7dc7935b752042903f7eb8ba5bd104252555933411a3b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810203, "uuid": "47dda08b-6fff-46d7-8319-0367cc3ad1af", "comment": "Malware payload (Gafgyt)", "value": "07f7b7081e4eb64044f12b58bb3e75b48d8c5c2c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810203, "uuid": "9aa301b4-6697-4c61-8170-9b5c9c416a11", "comment": "Malware payload (Gafgyt)", "value": "4d774f16d128343490e9e828898642296c37bc54bf6cdcec170e2fec350152c898de26ebdae21e1985ac19b55db5d4e7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810203, "uuid": "2f2cc6af-9eba-431d-8195-8e81827d5c3d", "value": "T111F2F10142BE7D68D560DA7810FEB9056E1EA10CA108C5F8FFD576BE8DD07392E4A691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810203, "uuid": "75738e61-95de-4f45-b05a-467659fb5226", "value": "768:eJ2WkmLAf3Z+vqK/x4c2CYCEWzvTTVsLnbcuyD7Uiyqc:ek2sf9K/x4qYCEW0nouy8Zqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648810203, "uuid": "c37eb65b-94e7-4fb7-aeb2-d332cb328475", "value": 34460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648810203, "uuid": "7c388fe4-cab2-4bc6-af63-854106b87d47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810203, "uuid": "ec744be9-e0e7-4e49-ab36-937bcc478673", "value": "xmogum.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db98312-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648819708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819708, "uuid": "9e5e63a1-2132-48aa-8322-77642bcc97e9", "comment": "Malware payload (Formbook)", "value": "168919fbb4b9b2d53ea3281422d34ca1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819708, "uuid": "fbf1b6c7-eca9-44a2-9b32-93e3faa84d23", "comment": "Malware payload (Formbook)", "value": "4313c71d581dacbfcb2c36cb533d5086885b3f70dbcc2de6b60c8a30502676c7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819708, "uuid": "9707892e-5d5a-4f6f-81b2-fe9480857f52", "comment": "Malware payload (Formbook)", "value": "5c808d2a95b45100546db75e13e564215b521daa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819708, "uuid": "abc508ad-6fa8-454a-b530-030bca079f11", "comment": "Malware payload (Formbook)", "value": "258aa6978c2916992ce0c7beaab7498c56161425342b819c5247b22acc1a78d465a5710e93780658ffa20afcdb702b2f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819708, "uuid": "1042b6dd-9ca7-4fb1-8a1f-782edf42fad6", "value": "T15B1402E5BB68E744EA84877A9C37C6C7C951ECB37019D02BECA1BB095D38DE09D512D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819708, "uuid": "f7781ad1-bd27-49ad-a1c2-948d3addf1a0", "value": "3072:/mrKzQuGrXzHbbzB88RjGgdOeEFmzGdUBBRuFK5Xa/KS3ZmOklsVpFv2O9sQPwpi:+rK7GLzHXzW8xGg1zGdkRuU9w0EpLPwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819708, "uuid": "4169437e-128a-40a1-b64e-1ea7c536e71d", "value": 192344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819708, "uuid": "c272e30a-6f78-4d77-b29c-0fe8ffac40df", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819708, "uuid": "17cbfc41-8b33-4a6b-bb7c-846b710a4980", "value": "orden de compra 31032022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a1db88-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819376, "uuid": "c4a9a971-2130-441d-b6c7-bab592b3735b", "comment": "Malware payload (SnakeKeylogger)", "value": "7b44e993409b5ab04ddf891e6d9e634f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819376, "uuid": "55994dcd-2564-4670-bf8b-e1b6cbfb0e87", "comment": "Malware payload (SnakeKeylogger)", "value": "432739649c3243627847c6f3cc58ee2698a7c2f1e20016fb78bc308ee5516a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819376, "uuid": "4ba0976e-13bd-46bc-9163-87b5dbf97866", "comment": "Malware payload (SnakeKeylogger)", "value": "5dcac019679d2ab991a1fc66d188f3add925c85e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819376, "uuid": "4b885dab-036e-4039-bbe0-d5c3def1e7de", "comment": "Malware payload (SnakeKeylogger)", "value": "edfb7aec5a5691acdf1daa0e7c8334268a9773f78de70ace6a9b5bde99ac3174c57eb0213c84e0247c903cea3495d0e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819376, "uuid": "fd41f1ad-b0c7-47dc-823a-8f105c12e19c", "value": "T1792502193BDC8151EABD6AFAF4B080C48BB4BA2B2537F74D050269ED06F67019E63753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819376, "uuid": "2fea2b95-5b7b-4e55-8523-b835d51460ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819376, "uuid": "9a322bb4-abfb-4ba0-bc17-4c99e4a4199b", "value": "12288:vKA9OEP2hNWIqgoppuEwVKplNmmrBYMJ3XRM9SxdyqPEC00qgMPsWDbnW8kbm7uG:04KWXhAiNzR3hsSxsSngQOK9Bhjtbje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819376, "uuid": "e82270b2-70ea-4b3c-9baa-c45a3f98e6b6", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819376, "uuid": "8725204a-3257-4758-8b70-964f3765205e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819376, "uuid": "c1736e89-583b-4d4e-821a-d547d22445d9", "value": "7b44e993409b5ab04ddf891e6d9e634f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3ef7f9-b1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648837691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837691, "uuid": "d3dcb791-396d-42d5-b477-f3df90b803e7", "comment": "Malware payload (Heodo)", "value": "90b70dc1d64cf4916037a4acc455d953", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837691, "uuid": "827df157-e744-4232-b74a-0581f50d44ba", "comment": "Malware payload (Heodo)", "value": "4524753f5f3e05b6fad256fbba05cc9a89b606383a0ac7659534f95b074f1931", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837691, "uuid": "2ca97d42-5acf-46e7-8d0c-7424088abc65", "comment": "Malware payload (Heodo)", "value": "8218756e535ba565f104418885474883f46ae968", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837691, "uuid": "54b625fe-d80d-47c1-be9b-8aaed151988d", "comment": "Malware payload (Heodo)", "value": "cc9b6907585575d605f6f52b07fc7c283ef236a4e02fb0e844af7f712ebebaa3381d93ad7dc37daef1f4aa0188ec6a55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837691, "uuid": "ee932568-c491-4c02-9760-5b46d44b01f9", "value": "T1C094BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837691, "uuid": "b3a5eefc-6087-4f79-a66e-716f11742e45", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837691, "uuid": "bc8b2e7e-cca5-493b-ac56-76a66aef21a9", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDHS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKfrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648837691, "uuid": "06a8c378-96ca-4ce8-908c-02c3e390e961", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648837691, "uuid": "ea4ade33-35c2-4f19-9008-8e3a4f53cf08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837691, "uuid": "5b5acdb4-3013-4fe5-82e7-3befbc5d5abf", "value": "90b70dc1d64cf4916037a4acc455d953", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e62e59d-b1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648820461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820461, "uuid": "fbd7dcfb-7099-4d9b-9938-fa9f4682ad8f", "comment": "Malware payload (Loki)", "value": "b2b36a865ba50309ab7a61d5ace5432e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820461, "uuid": "c49fb0fb-be4e-48b1-a0c7-be91d7dcc1a8", "comment": "Malware payload (Loki)", "value": "45991db7013985d9b6cb6ad796bfaa69c6569b0a1da7cc1803a2c5e4f7332760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820461, "uuid": "05207e27-d7f3-41dc-8320-55412a4e9f86", "comment": "Malware payload (Loki)", "value": "c7ebd7f813c149a9af33ba255bee0629ed9e60a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820461, "uuid": "c5d699b9-3869-4725-b049-b155c25b6e49", "comment": "Malware payload (Loki)", "value": "683c305ad34182bd8ae77c7de20f37a5212f3f649119f7fda8ca9366cc27490d9e0c9808d56daa8063a99341051dc449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820461, "uuid": "ead03fa9-c6d6-4faf-894f-6c4cf8a70bf1", "value": "T1C0341220666DC187E4F74B726D796A382FEEB91820724F4F4360697F3D665C01A4E3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820461, "uuid": "ff639265-faa8-4199-85be-6f6315a27d54", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820461, "uuid": "62976e75-6ba3-4cc5-957a-ddfabad902df", "value": "6144:HNeZmV2w/XjB+0Ng+jqLQAeuCQ8bjcG4It2890Y+:HNlVRl+GZqLQAmQ1G429qY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820461, "uuid": "e79c59e9-3454-4f92-9f07-52dabf795cf9", "value": 236846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820461, "uuid": "6e7e91cf-46f5-418d-88af-162dcedc798f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820461, "uuid": "92d57b30-66c1-46a5-a832-ee8e3d145b55", "value": "win32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c3d5e4-b17b-11ec-8e58-42010a9c0032", "comment": "Malware payload (ConnectBack)", "timestamp": 1648790272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790272, "uuid": "d5de79f1-1a61-46e4-845a-dcc4bb64d861", "comment": "Malware payload (ConnectBack)", "value": "7d15209ce8f856c1bd4708a1b35657be", "object_relation": "md5", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790272, "uuid": "9437e6bf-db71-4a50-a215-45f70ee3f247", "comment": "Malware payload (ConnectBack)", "value": "45b511d329707f5285907977ce15b1bf4e1f51f69f0fd7a2597052b94e8c44ec", "object_relation": "sha256", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790272, "uuid": "acdd1a8a-9d88-47e6-8faf-609fc8d60c9c", "comment": "Malware payload (ConnectBack)", "value": "d26d25386c4ac787027e718c86201cadcc085932", "object_relation": "sha1", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790272, "uuid": "50f4d58a-b071-4d9c-881f-23ffb122957c", "comment": "Malware payload (ConnectBack)", "value": "6c248da3d469d5199f8ea72eb7b09724b8acb3a31ae6925c2d49fd9af3d1a3e2d265848759a5c8d54a2b91d93124eec7", "object_relation": "sha3-384", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790272, "uuid": "cb9a53ff-0a1c-4355-b15a-58663f93bfe9", "value": "T1B7D0C0331B1AC0EFC6D0023F15740C6CD77B8575070822710810DC000C092002F22C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790272, "uuid": "eeb2a032-bcfe-44c1-aeaa-4f4d7de6ab0e", "value": "3:Bnks//xlEldl1llXllS/rltll3llvlfXwvlltPNTSiPHZYC1E3V/HQqoRQC+ys5t:BnX//In8/r1GBxH2TV/Q3RQdygg5XJYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648790272, "uuid": "5fe59fff-d4ed-4de7-904a-c22488f61757", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648790272, "uuid": "7d477f71-8aa7-45b1-8950-e28efe781a80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790272, "uuid": "4b379ec4-9ffd-47a7-92f2-e904a06c43f8", "value": "45b511d329707f5285907977ce15b1bf4e1f51f69f0fd7a2597052b94e8c44ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fadfb3-b19e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648805678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805678, "uuid": "2f0bd788-117b-4344-b091-c06e5878dd8b", "comment": "Malware payload (Heodo)", "value": "c24201a0c016faccab9c05e04b766284", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805678, "uuid": "0deeb86c-2862-4556-9074-08cd4f0488fc", "comment": "Malware payload (Heodo)", "value": "46a65114c2caeee7bae37a2abb13f84a11ca1aa8c4a4f3702e7bfaa26a528aa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805678, "uuid": "9e32bf9e-f764-4c44-ae9a-a4a1ff9ab28e", "comment": "Malware payload (Heodo)", "value": "b6ea0b5b90618774b8615c91201ab2be47010f12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805678, "uuid": "59b27049-0a05-467a-aece-a4e830c9146d", "comment": "Malware payload (Heodo)", "value": "ba2e28a972f4b7352681e94efe40e5ba1f8a03c1f39cc88bc603eb8ee90fd8c2e8bfc4355284503daca900fd8f797333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805678, "uuid": "a8a55a4c-5f90-43c7-a30c-1d0a9a929db7", "value": "T19594BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805678, "uuid": "d9710a7d-34f2-4915-91b9-63705bbb5754", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805678, "uuid": "bc426af0-41a7-421a-9438-f80e1b588a31", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD4S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKgrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648805678, "uuid": "78f83a6c-eba9-4b1a-9de5-99e60be4df41", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648805678, "uuid": "63669427-c7ff-4bf6-94bb-7ca33f41d358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805678, "uuid": "c24e13fa-565f-4675-b2ea-c8f5a0ec3ee1", "value": "c24201a0c016faccab9c05e04b766284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da5e906-b192-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648800380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800380, "uuid": "6dc551d8-e690-4492-a733-e7d162cefd8e", "comment": "Malware payload (Formbook)", "value": "45cffe65add625cdfb4cdffe44ba1c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800380, "uuid": "4f3d56cc-de0a-4d74-aa7e-9586afd5af54", "comment": "Malware payload (Formbook)", "value": "471429e2686887cf2416e11d6d9c2a36f639f7b971db1d7b013b933ae3f3bd6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800380, "uuid": "51b4250d-5279-4ef1-aeb1-d444e8422425", "comment": "Malware payload (Formbook)", "value": "9444b0623b8b8cb4eb63417944381e657ddb3c61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800380, "uuid": "dafe1b99-fff1-4228-bd38-035781d54ddd", "comment": "Malware payload (Formbook)", "value": "40138278dc7f3343fa8a5a46f7918dc2b69328e00053724adf05ac36a617ba400598790da7849b73555f7cdd4cf03c1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800380, "uuid": "a2cfc564-6795-485e-a027-3e26d5db45b1", "value": "T1E1A412085AB88F79C57E63FD8892505483BC7216B642D3081EE774EA6DDB3F106523AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800380, "uuid": "5a89b8d7-cbd7-4c56-b7b3-ac2b7a4f2971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800380, "uuid": "7ee08520-f3c0-44e3-aa76-91621e9fe233", "value": "6144:nZ/9/UFKBo4E9VLsN7e/ZQrq5NSgvPHlOmm23k5+ZvP3Y9GnH0ElPHcIXYAV+:7/yKUVAe/KySg3K+k5+e0HtP8IXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648800380, "uuid": "4412900b-6bca-401c-903b-5f6f260a1bf9", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648800380, "uuid": "fe259fdf-7de4-4053-8b30-c4171c8c91a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800380, "uuid": "76aed885-2102-408a-afdc-be4f9961dd5e", "value": "SHIPPINP.DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e249b7b-b1a8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648809669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809669, "uuid": "7edee9d3-8175-404b-a630-c13318ca5bec", "comment": "Malware payload", "value": "5ad207a4ae5284cb8eab6a875a5065a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809669, "uuid": "a5f04fda-d832-40b3-818d-718da7b6a7f3", "comment": "Malware payload", "value": "471481a1c3d17c5586f337c77234ddd793697dff895236b96d711405c845620f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809669, "uuid": "5640e898-d695-4fe8-bca8-6825d09d4c8f", "comment": "Malware payload", "value": "2a35a464206c485f25886f2f4ee725dae909c508", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809669, "uuid": "3ac7e184-bd1f-4afa-a0e4-a75d98af2f3f", "comment": "Malware payload", "value": "ca4654e1a832ca79ea287b687bae1e9f89bd407711c7f7fd6d805de499be030f16f6c7ee5ef17033142802a8b16fe90f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809669, "uuid": "1484d7ae-73a4-43a0-9ccd-01dbe870fc5f", "value": "T18F849D2235C1D072DAB211304F69E77196BEF8300F2117DB63E46A6E5F345D1AA36B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809669, "uuid": "4fc85237-8e40-42b9-9ba8-04da325e339a", "value": "b23e5f1509a3767dd0d657ba73a3b3c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809669, "uuid": "de327168-d32e-4eeb-b209-6938dcb7b1fe", "value": "6144:iTBqvKbr+R2Yyw8LrrbyNH0hkdR3y1z1bvMWWvgeYyNdAONLu2ChyiE:iT7+R2Yyw8/rbyNH0S3cz1bv3eRdHIsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648809669, "uuid": "7d0b239c-938c-4f70-8d91-515ae51682d0", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648809669, "uuid": "bc69904f-9376-4e62-af59-663d64eafc6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809669, "uuid": "7bdd81fd-1dc9-4bdf-a2a0-0adc585126cb", "value": "471481a1c3d17c5586f337c77234ddd793697dff895236b96d711405c845620f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0849e3-b1bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648818044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818044, "uuid": "9f4b10cb-b522-431d-a00f-f1a8f66cd035", "comment": "Malware payload (Heodo)", "value": "aba0e375179b7876ef9d3ce4032df858", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818044, "uuid": "3741e17b-5c7c-4b6a-bb01-1934b94430bb", "comment": "Malware payload (Heodo)", "value": "472b2959166c5ce48fb19523113634e446956d78b5c8dd4083f4961e9b4345e2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818044, "uuid": "f6b94b85-c617-4433-8d3b-a79f047385a4", "comment": "Malware payload (Heodo)", "value": "e05ca3f6985d387e5b20685246e9f763f3350c8a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818044, "uuid": "e635a88f-7546-4f77-b158-3fb158b538fa", "comment": "Malware payload (Heodo)", "value": "7cf901bdb0e8728bb9ea5ccc4d13c57491223d349fb1d815751b54d0d5ca53ca93e8967f7c4852f0794d0bf9be13c8b5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818044, "uuid": "b1333508-bdf7-41b1-96de-6c13c97eaaa7", "value": "T1DE33D796B659D969F9128B354CEB87D67322EC205F5F0B833229F335BFF88A01647106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818044, "uuid": "bf13b792-744e-4c9c-ac3d-76c3b7b7ffbd", "value": "1536:ORKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+/43SaT3h86rdKRFv4:UKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818044, "uuid": "419ec009-80af-4cd7-96b3-3c1c116e5121", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818044, "uuid": "a8706e2f-bffd-4b88-ba3e-f7eaba661a95", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818044, "uuid": "2416b096-d48d-4bca-8a65-5f5ba8042f43", "value": "Untitled_0104.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a368d071-b1ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648838186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648838186, "uuid": "fa88be17-c5f9-4498-a1a4-4256f19dd60c", "comment": "Malware payload", "value": "20ea405d79b4de1b90de54a442952a45", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dstr", "colour": "#B7EF2D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "vpnfilter", "colour": "#457646", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648838186, "uuid": "2dcb6643-3f1d-492f-9044-a3c0f90656d0", "comment": "Malware payload", "value": "47f521bd6be19f823bfd3a72d851d6f3440a6c4cc3d940190bdc9b6dd53a83d6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dstr", "colour": "#B7EF2D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "vpnfilter", "colour": "#457646", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648838186, "uuid": "4c12e4f8-3b9c-4eb2-a6e8-ccd43ba55dec", "comment": "Malware payload", "value": "261d012caa96d3e3b059a98388f743fb8d39fbd5", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dstr", "colour": "#B7EF2D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "vpnfilter", "colour": "#457646", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648838186, "uuid": "1892ea5b-51af-4b6e-8600-735d72246154", "comment": "Malware payload", "value": "fa9a42665142d78bc1971579e7aea196ef27be55433bb6d745a166dfccc35ad691d19a4bff4bc2336e43c95e0d819457", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dstr", "colour": "#B7EF2D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "vpnfilter", "colour": "#457646", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648838186, "uuid": "dfe639c4-481d-4cf3-9c8c-d6f324a8c6cd", "value": "T14753955A6A21DFFEF5AC823047B78A20A39933D126E09689F25CD70C1E7034E595F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648838186, "uuid": "a591bcd7-75be-4185-bc6c-3ac60f598783", "value": "768:bKN9VhXeyS8YK51vUnIPe0qy1keeBqU2UkkHaBlci5yRI8/u:bKvvlYesk/teBq5ScyRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648838186, "uuid": "53acc4b4-becb-4769-83cf-9bb4fb610e85", "value": 60812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648838186, "uuid": "7d4b69d6-66d3-45ec-995e-e54ce01cc065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648838186, "uuid": "3d501cd3-d5c3-402d-884c-a17fe5f8374a", "value": "47f521bd6be19f823bfd3a72d851d6f3440a6c4cc3d940190bdc9b6dd53a83d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127b6f56-b1b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648813891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813891, "uuid": "62b797da-7079-48c2-89b5-873d7106a53f", "comment": "Malware payload (AgentTesla)", "value": "537aecdd6fdfe502042e80d1fa2fd5a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813891, "uuid": "993039e9-a57c-456a-9ba9-9cb50bfb9dc6", "comment": "Malware payload (AgentTesla)", "value": "49a9d39a546af011f10b52efa9f9fa003524a7585fb08f3101da8d090e6b93e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813891, "uuid": "7e2dc5bb-068f-4afc-b777-e14e0f136ecc", "comment": "Malware payload (AgentTesla)", "value": "57b8199dfa1070dabdde00684049aae64160c93c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813891, "uuid": "57f1118e-eaf5-41eb-8d1a-e1956192aa69", "comment": "Malware payload (AgentTesla)", "value": "07401f2f1eff2105efc2ef81ff86fce4659ad7864145cc6145cebb6ba74bd3a624687483fdd79173344553c2299a857b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813891, "uuid": "f7cb0006-ff0b-44ee-b66b-def2ff7bbc74", "value": "T1A8C402257BF9CD13C16897FA84E7112003B2A38EB1B3D7492DC502D95E427E2AF45BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813891, "uuid": "0173b996-ef8f-45cb-9e6f-dbd1a38ead79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813891, "uuid": "10ed4643-8e00-4ea7-b794-e34a243e05be", "value": "12288:r62mf1XjGmL+9iCHB08HDiNgxfXzzSAq:4tGma9iCHBPmNgxKAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648813891, "uuid": "074b413d-e3f5-4848-8939-56634d7e9796", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648813891, "uuid": "e5575ff7-a7b8-420a-8823-49a4551b9e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813891, "uuid": "2c6beade-ce40-4c7c-84e9-834e02f4a289", "value": "Transfer slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91b2ed2-b1c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648823270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823270, "uuid": "77da855a-69b0-4ff1-8ca5-3b445a5bb1a2", "comment": "Malware payload (AgentTesla)", "value": "de95dbc8c36ef59f19887a10e1b2be52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823270, "uuid": "3c0922c4-db98-456b-be44-acca09e0ab49", "comment": "Malware payload (AgentTesla)", "value": "4a61f8888fecd11b033c9de00f3a0e51783b12b30c2b9f8d4ee19c534dc1cd37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823270, "uuid": "1089c614-01ff-4002-8564-b692a6bacd5f", "comment": "Malware payload (AgentTesla)", "value": "e03e2012c9fcb99fa314d7d03c1f1bddced1ccf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823270, "uuid": "7659d43b-6e9c-4dab-9dc8-15de5c9c23bb", "comment": "Malware payload (AgentTesla)", "value": "fd762a80d95e77870b15f4fe3017d4e9655f8bfa684e0d77070b45b2f43b522dfb1bbc44884c15cf8794938352a23966", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823270, "uuid": "48b2ae30-5666-4499-b904-b218636d63e1", "value": "T16BD4E0027B865F45CA99637D1964D2B063F0FDC72501EB2F3EC86EAF36772806B16242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823270, "uuid": "302f847a-cbd3-4d9c-b821-e03c21c596b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823270, "uuid": "69028e80-5429-48bd-8d41-505636a599b0", "value": "12288:jxFhdKpsH/mzBMdgpUyc15YLgdo1VxAv5p:j3Poy/mzImNc0nrqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823270, "uuid": "c7b6818b-1878-4be2-b628-8cebbbaaeb7d", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823270, "uuid": "fa9deb91-f5e1-47e7-92c3-7d1c8ff8c952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823270, "uuid": "8fe146b5-b82a-42ed-9c0b-506b2bb40012", "value": "de95dbc8c36ef59f19887a10e1b2be52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab4c4b5-b20f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648853955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853955, "uuid": "7d800142-aab2-459d-a8f7-eabab261b490", "comment": "Malware payload (Mirai)", "value": "2ae702d0e362d553be174bec3f720570", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853955, "uuid": "6fd7d8af-a3c9-483e-ad6d-a3fd890153b3", "comment": "Malware payload (Mirai)", "value": "4a701ee0db3c72326d1aa32a428234c849c1b93713c51840d99ee0fd0bdb9553", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853955, "uuid": "c2b59f98-fd74-4236-89e7-404ae86426fd", "comment": "Malware payload (Mirai)", "value": "754c2e2833ec1eca18c594f73194f6d028e3abe9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853955, "uuid": "29c71164-3be2-4367-ad1e-d39ac852b1bc", "comment": "Malware payload (Mirai)", "value": "a985e11b75466261c506e855fab36502ac3533be447d89d9ced29a546a818d983c4a789cda6cdb71b94ef1b697f8fd33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853955, "uuid": "e558eb8a-5934-438b-bedc-e9d02d91c414", "value": "T1E583A20ABF614FFBE8AFDC374AE91B45248D501A21A97B75B934D418F64B20F08E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853955, "uuid": "df60c375-9fd0-4d05-823c-eaec47511e35", "value": "1536:XvJBaCJuk/p0h9Hi4in2zni0S30v5ayYgcCWvl6rJ36QhrD8Z0p6/9F:XhBaCJuk/qF4neni0S30v5ayfcf2D8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648853955, "uuid": "32663f41-b25e-4179-9caf-d1a43a48d9d8", "value": 81184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648853955, "uuid": "564f17f9-ab13-4c22-bca2-a30a964353b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853955, "uuid": "cfbc5494-d3f0-4d67-8da5-ab1182c475a7", "value": "mipsel-20220401-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec7f6f8-b1a8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648809751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809751, "uuid": "db1dc09e-7790-41a3-93c5-074d5d3ad4bd", "comment": "Malware payload", "value": "22b0a8edcb6b9bdc1da7d6faf6170e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809751, "uuid": "d9bfccba-a0b1-4a0d-b938-70f56085d681", "comment": "Malware payload", "value": "4b268f9eca9ea0afba9ddf7f94c120496e5b7f5e85996853906146f37bc3747e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809751, "uuid": "c3536cb0-ff14-4a56-809f-ad1ac40a3f4f", "comment": "Malware payload", "value": "c62f33f7a175d99334dddf38f235d0e5bf321eb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648809751, "uuid": "a07f0ef4-4c98-40f0-9acc-804a2f479422", "comment": "Malware payload", "value": "74bed55276842cd752f3d8612cc11e3ca96d897142ecbe06d0b2a99ae5540474c9650cc02db91ff979aeffd548a9e51b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809751, "uuid": "1e43d717-caa6-47e2-9701-1a483df98b67", "value": "T14B849D2235C1D072DAB211304F69E77196BEF8300F2117DB63E46A6E5F345D1AA36B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809751, "uuid": "8979dcea-f46e-4256-91c5-1782c24ccfee", "value": "b23e5f1509a3767dd0d657ba73a3b3c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809751, "uuid": "3046d727-8238-42b8-8079-b7b41a9ba405", "value": "6144:iTBqvKbr+R2Yyw8LrrbyNH0hkdR3y1z1bvMWWvgeYyNdAONLu2ChyiE:iT7+R2Yyw8/rbyNH0S3cz1bv3eRdHIsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648809751, "uuid": "f1a67f03-059a-44cc-83c3-b8bb7469347d", "value": 375615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648809751, "uuid": "f1dcd69e-e220-447c-902a-a5fa5430369b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648809751, "uuid": "1be3de10-b593-4ddf-9dff-ceaffd30f88a", "value": "4b268f9eca9ea0afba9ddf7f94c120496e5b7f5e85996853906146f37bc3747e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79925f1c-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648835109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835109, "uuid": "aaaeae5b-a1ac-4e89-9622-39bc83d4b824", "comment": "Malware payload (Mirai)", "value": "97a7a357b8290a7236a5fbf45f17569f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835109, "uuid": "3b2dfb30-55db-4d03-8c4a-90c4357bbe88", "comment": "Malware payload (Mirai)", "value": "4c541797f9a4baa19e9c8a736a141c2e860ce77854f5be1f695cc257342aba2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835109, "uuid": "1d84a3cd-036c-491e-8dbf-bf1f630d7167", "comment": "Malware payload (Mirai)", "value": "db4e96337e4463cca3818d57b56fd7185b519f2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835109, "uuid": "4bcded08-73c8-486b-a282-62d0b10a4f74", "comment": "Malware payload (Mirai)", "value": "4860784ae81d35211728de6ef5d01771fa3495d8c3e472e47850ba0dc01c7b7b6991c71695d8b6eb7ed0e5844022cf26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835109, "uuid": "f61535a3-5ad5-4160-a6b3-9d8945333d8b", "value": "T11493A50D7E219F7EFBAD823987B74E21965833D623E1D5C4D16CEA011E70389241FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835109, "uuid": "170b14ad-f878-4b28-8dce-49e8367b0d5d", "value": "1536:2Ef1cYdJsTt+UW7tt3LO4/54rKPpR1p7efR4IXSW5:2o1cYdYO7LbxiKPpXpS4IXP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835109, "uuid": "810c78d7-d9bc-4cbe-8389-a1b8ddbcb017", "value": 97044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835109, "uuid": "dd5be7b5-ef8d-4f7e-95ed-1859636f4c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835109, "uuid": "355cbacc-15ab-47ce-a7b6-fd9df6244a00", "value": "97a7a357b8290a7236a5fbf45f17569f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d922554-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819600, "uuid": "d2391706-e8e0-41e6-a1d3-7bd3de82771f", "comment": "Malware payload", "value": "a708b4dc1f60171423bfb1bbfe6779f7", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819600, "uuid": "17158b50-d5ad-4d13-8bf3-abb2360edcdb", "comment": "Malware payload", "value": "4ccd8124892c290a1e376f23ded05cf4c3e9cc773b211e597542cb3b9219e923", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819600, "uuid": "1fc354c8-c3b8-49df-8fe7-c678d1df1362", "comment": "Malware payload", "value": "a4b4bdc7e7ae554ed483b6984f5569b7d1e7b160", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819600, "uuid": "762bf8e4-2d39-4939-b5b4-bdf0b5eb6824", "comment": "Malware payload", "value": "3a2c64699e348aaf5effc80172335138306f84bdca9e0cedf65969d03bd359f8f013376a550f13e30fcde18414d01811", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819600, "uuid": "4a9266b1-9285-44c8-ac24-81f7a5fd51c6", "value": "T1CA140213F5CAE1C3F09D6BB5A36C66B65722CCF4C60CAD2C8096FB15557EBD085282D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819600, "uuid": "1f3bbb5d-90b6-48af-a0d5-fe8491d9d3f0", "value": "3072:xj5DV764aDBRSJ81Zbn4fpBO09QYOViPGgH9az3dA250I65DoVce4ZEDrkpLGj1l:x5DVu4aDBg8b4K099deNAAhlWaApaj1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819600, "uuid": "9bd17dd4-6b75-475a-a93d-bccd9a3785e5", "value": 192168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819600, "uuid": "dd02427b-0db4-4427-8ea0-609a26ba55db", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819600, "uuid": "6421a840-c30f-46ab-9c0e-ff6263a6d9be", "value": "Payment-Lists.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaff2d9b-b19d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648805235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805235, "uuid": "b9205162-e443-498b-bd70-4027ac13fe83", "comment": "Malware payload (Formbook)", "value": "1e82c0a60caf481b2b1cfe025ad01d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805235, "uuid": "127199fe-d0d0-40c5-b2fb-5c96af2aa1ab", "comment": "Malware payload (Formbook)", "value": "4d18ce99f7d4957be349f2d1134ed4cb5a6eeb236c8c4107bf3e57b1a603002c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805235, "uuid": "a5c8379c-db37-46ec-8ecb-ed2c166efcdb", "comment": "Malware payload (Formbook)", "value": "eb50acfe488cd4d20b315cf480ad2aab0b5979f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805235, "uuid": "1742642e-49bc-4a2f-93c3-197fcc34cf77", "comment": "Malware payload (Formbook)", "value": "ea7c955728b65236ebdefe80e7ff355b5b60faadf5888ec8d9eb017b38a506dfe582f0fd2ce4385f4ed116e7457b6bed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805235, "uuid": "92ba59ff-e42f-4207-a9e5-9f49e25a252b", "value": "T1AB942C2C3A0E1AF6FD1FD130894D0A04FFA61B476240B9976BCB15FA874F1666E85C9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805235, "uuid": "9431a61d-d55c-4587-bdcb-3751abb4f83f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805235, "uuid": "b56fe76c-be95-4928-bddf-98a5f1a505f5", "value": "6144:9VkIqnxTSEDhxPdpjpl3XIFuXRwHJRCGvxBXeH6453oLdB1h2Fh:9OtWUddpjp1NBwzDVQoRThKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648805235, "uuid": "b53c4a0b-a2ec-47ac-ba52-0c2938051c22", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648805235, "uuid": "7795f553-8efa-4a22-9787-bf4904e21f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805235, "uuid": "d272a639-2d03-4cdd-be3e-c67a4554d8c6", "value": "Purchase Order TJX VAT No 0175B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1f6f94-b177-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackGuard)", "timestamp": 1648788808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788808, "uuid": "73e8bb6e-7e60-4a89-8bcf-ee7facea982f", "comment": "Malware payload (BlackGuard)", "value": "ac7d6f234f3bcb9c2c74f016b0302c39", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788808, "uuid": "15797c76-0981-4b9b-9fbb-ea564669fefe", "comment": "Malware payload (BlackGuard)", "value": "4d66b5a09f4e500e7df0794552829c925a5728ad0acd9e68ec020e138abe80ac", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788808, "uuid": "c421d158-050f-4783-b09c-a0c8886b5d9c", "comment": "Malware payload (BlackGuard)", "value": "e2ffff0ef2f0c6b5f6f60cc651cbc4d034b7a36b", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788808, "uuid": "cfc1763e-d26b-46ea-bcb6-bf91c61aa906", "comment": "Malware payload (BlackGuard)", "value": "e888b38477fa284843201a2a28ba3cb04206427faab2140c4f1b8b7698ef3d05a9c7c0b982279255852ec871c0faa61a", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788808, "uuid": "f6902be0-bcf8-40f7-910d-a0d5e9260db5", "value": "T1CDB5027606A4EC66E6AC0CB89122E336D5749FFACCE78042F4B5726FAA3135C3C55079", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788808, "uuid": "e8077042-55d8-4518-93d6-139d7b8c6713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788808, "uuid": "73e3dd38-4381-42c9-88a6-6030421721e9", "value": "49152:HGNjiSZTKAzkltDhTCcVX8saTtWycOLH+tkWJ0v2J3Y2phvjX5876zLm:mNuSZTKA0t9FFPE7HgkWJ0v2Jo2/uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648788808, "uuid": "31519b8a-404d-455f-84b5-03b8af301a1d", "value": 2274304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648788808, "uuid": "50f4eb2b-8883-4a45-b8d2-30a76ab1fe62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788808, "uuid": "ff93e582-c0d1-4686-9e98-43ed7d850040", "value": "4d66b5a09f4e500e7df0794552829c925a5728ad0acd9e68ec020e138abe80ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06234ce-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648820142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820142, "uuid": "049cc7cb-0ee3-4c4c-a371-6f7b5eef32e6", "comment": "Malware payload (AgentTesla)", "value": "46e8d8fb6d711339e61d29590e731dc8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820142, "uuid": "83d1e4cb-ff23-4f8a-9276-69991df1c0a8", "comment": "Malware payload (AgentTesla)", "value": "4ecfa27b9169773e66a6322bb814e41342b02636f840c4a7f4b46733a407e869", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820142, "uuid": "0c05ba10-8b18-4727-8e2f-4c7a3b2718c6", "comment": "Malware payload (AgentTesla)", "value": "bfd84672e007f1b2392a0eaf9ce3356234319ab3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820142, "uuid": "4561c7cd-6a5a-4a8c-b199-7f1e77ad1fe9", "comment": "Malware payload (AgentTesla)", "value": "aa7e7869dcdc0e29a4ea4ea5edc87a04461787a44beed606489be88e5af6934b755e563fd914dbd44d41000c819eb68e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820142, "uuid": "5aaa791a-6c8c-45df-a3e6-86dcfafd925f", "value": "T18715F05A366079EFC86BCD328E941C54EA307877270BD20BA443629C995E9DBCF152F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820142, "uuid": "62236fbf-4fa9-47ac-984d-6fb31d916547", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820142, "uuid": "6d9cee52-c209-4918-bc55-a5875a5e2085", "value": "12288:wLPts0C5UrD72DwcazJEPzc+LAaJ+VOCkIfuWG42VN3e3ruO2n3Me7UuEqH:wLtD8wFIh/CfjG3N3uroMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820142, "uuid": "874f2b84-ae26-4727-a708-bdb7afff53d9", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820142, "uuid": "8c62c41d-e318-4acc-a0de-04c985734b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820142, "uuid": "49c19334-4c07-4e77-bc13-0713571f831d", "value": "DHL_Mexico10106272873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a280ca-b1a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648808613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808613, "uuid": "d5fb0543-b36d-4004-871d-776e6df2d4e3", "comment": "Malware payload (Heodo)", "value": "b3a55090e4ef35022f5dab1f3056ada8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808613, "uuid": "ff11c99c-99a5-4a6f-a2d3-1cfc4995ce1d", "comment": "Malware payload (Heodo)", "value": "4f1c5c8c2920da4e6e1f5e51a16275ffa61fd35a07bff3f8bb734abc998942c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808613, "uuid": "b9c99a86-e189-4639-b716-7205224f4065", "comment": "Malware payload (Heodo)", "value": "9ca1f565af5a9910584f55c15ce8ecc74d8b9b10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808613, "uuid": "26dc3b73-15ca-420f-abd6-b6d5f431a975", "comment": "Malware payload (Heodo)", "value": "f866869bb731f9e67552e0217228691cfb64d6b31c3d2d8201e144e57fc036574302d7b4a88e801d257bf42cfce3a472", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808613, "uuid": "b78221c6-e84b-4d81-b8ae-73104a4caf14", "value": "T1A094BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808613, "uuid": "c414b9e2-b552-4ede-b01a-308fe36804f0", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808613, "uuid": "a3c821df-420f-49c6-85de-cfbbfe912113", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDCS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKersjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648808613, "uuid": "652eb7f1-e29b-4f9e-97d0-29ee90fad3a4", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648808613, "uuid": "b00e245c-b5fc-4457-bf40-4777e1fb644d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808613, "uuid": "00e211f3-7aa7-4dd6-8ead-51c641d1bdc0", "value": "b3a55090e4ef35022f5dab1f3056ada8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837819e6-b182-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648793465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793465, "uuid": "254a1ab8-8a22-46c9-b873-f11cbadf997b", "comment": "Malware payload", "value": "ef4f1330c7b4171707f6af1f088eea34", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793465, "uuid": "0438daa2-23e7-4376-a312-74f35736adcf", "comment": "Malware payload", "value": "4f2db37009c88374e860d841d02fd073bea75e3ebc45a51df3c4e1cea28d3c85", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793465, "uuid": "b5fa55b4-a525-415c-bd77-b0b10a4d3f13", "comment": "Malware payload", "value": "e5097a3d72f8376703e5edce80894e555310d093", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793465, "uuid": "22377be6-a962-42b6-b999-dc215e415400", "comment": "Malware payload", "value": "803db3d3e2b077e050dcce2c78ea1fab133b91ca9e93b36535290fb6615593bd7d97999c2bd8190616290d3c3a6293c6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793465, "uuid": "52535fbf-6065-4167-bc8e-5bc8706e5257", "value": "T191916C92110421EBD834AE7FFCF1849D322C3B117D67551E3C6B4AE9AB606112A4543A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793465, "uuid": "8f644333-acfb-4d21-92e1-731eb00ec2ca", "value": "96:xgWgqnn8cyFHBi/L60wcmSUXRKR29h6coWpB:a7qncS/L6f3RKRih6/WpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648793465, "uuid": "506a064e-b81c-448b-8858-d2ef87ce5c14", "value": 4311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648793465, "uuid": "3032e5f5-b39d-42f8-a588-3943c3e54ce4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793465, "uuid": "89af2a9c-8d3b-4899-8c35-ef744943a727", "value": "protax.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb991ffd-b18e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648798740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798740, "uuid": "dc1cb81c-1b68-4532-a626-5ed29a770761", "comment": "Malware payload (AveMariaRAT)", "value": "60950c6bd88c1c6bd39ce88b1dfb5cb1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798740, "uuid": "9c6d2151-cee3-4c9e-9d3b-113247cbb58b", "comment": "Malware payload (AveMariaRAT)", "value": "4f81725b23546bbd72ecf665813eca55f653bbae18380a4763399995078a437a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798740, "uuid": "07daa2e7-7f9b-4348-beb3-24b6cf00d3e9", "comment": "Malware payload (AveMariaRAT)", "value": "a106cf1a551ff8a726f9e47359a3d1f3e0cccd42", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798740, "uuid": "d77d712f-8f8a-4cb4-b3cc-509f7f50f5d5", "comment": "Malware payload (AveMariaRAT)", "value": "e08df4e3a57337c135eff5c826d103f6666b51f3cafacf9071a02d81c13187904112f2c9c3608d4cd49075add58fc4af", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798740, "uuid": "ff43b789-cbf3-4d60-a164-b84151cc17d5", "value": "T1BBD4120416B4867ACE1A9AFA60D3818003BAEE1B6755D34DADC2F0E995F73D106933F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798740, "uuid": "ea15cf43-725f-4aea-8755-122c13857e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798740, "uuid": "e4575cc9-7c8a-46d1-bf22-680124c16101", "value": "12288:tmiQjPMjCk6KAaZ9g2B6o81naprxEzGirz91dq2+WpQtD:DgrKAaRM71Ad6XrY2+Wp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648798740, "uuid": "592d7a5e-dbfe-43ac-bade-727d828b7d55", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648798740, "uuid": "fdb98404-13ec-4497-9c1a-c2ff9765bb80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798740, "uuid": "64dcca51-ee44-4db6-83fe-f719afc9a459", "value": "Q6TqN8JscK0R9aZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2d551a-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819621, "uuid": "13952b98-96f0-4535-b808-9cabc54d312d", "comment": "Malware payload", "value": "41f2e8fe514238a719a4f3aff5a031c8", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819621, "uuid": "f3942e52-93c5-43a0-8cb7-4343d15c9874", "comment": "Malware payload", "value": "508e1589c4f58fda1d46ee926ce8bf2fc60c5d13d3204e9495f2bfb9d9bcb4dc", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819621, "uuid": "69eba842-b9e2-4ecf-a456-aed995a8930c", "comment": "Malware payload", "value": "b8d07edf01e1ea98712e4d1bf34ae6f24977b8f7", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819621, "uuid": "1fd0bc1f-0f4a-4b9f-a776-6c29105afe1f", "comment": "Malware payload", "value": "c33b117edbac866469574fe30edeabccfacd4d2a8b84381efd0d4b161286dfd58343a110dfb9940066f2e9c2f3cb0e90", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819621, "uuid": "076d2b5c-d9f4-46d5-b8d7-dad274538a93", "value": "T1EE1412D6E6EC7D41F7BBF2373D279A205BA2FE635A2706A3102C7B3D41718056132692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819621, "uuid": "e1fe76d2-8f67-424f-8f02-61dea14e5e27", "value": "3072:JA7Lgq9Uy7vND9SrBBUx+Z2dPFu0yU/egouFRr4qzJpCryPLpZl1HQSNeNnE:6gMpi1BUx7yUmgZPdnCWLpZjHANnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819621, "uuid": "bf6dff1e-df73-4766-be58-10c47241dfbf", "value": 192136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819621, "uuid": "493a8933-71d1-4645-a7ad-42a8b2a68db0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819621, "uuid": "5c2c017a-c47d-4c07-880d-9072bdf4b4e5", "value": "IN022122.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5801b049-b1d5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648829040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829040, "uuid": "f1f627c7-a49e-4e7f-9fab-13745c6782ff", "comment": "Malware payload (Heodo)", "value": "aad48ef2833c759b1cdf3bbca8cec48f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829040, "uuid": "9e885d6a-26fd-46f3-a756-fd7d71b414fd", "comment": "Malware payload (Heodo)", "value": "50e3b002ef2e15a1c18a81f39c4fe01fc344120aa8c3fbd3bc04cc5071d41cd6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829040, "uuid": "de3620b3-f004-44e1-bc40-abd0acf6b41a", "comment": "Malware payload (Heodo)", "value": "e81dc03dec66ae0191fb22b9f51265c9f3bcadc0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829040, "uuid": "2ae50de8-a7f0-46d7-b93a-3025a4a3a715", "comment": "Malware payload (Heodo)", "value": "c8bee77eb474d958c9bea5a711b42f7d3c9eb57160f10c347d8630d4fb080a5874ac632422bc27fe196c112d476dafab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829040, "uuid": "5dd601b5-dcfe-470e-bb12-91df2092be7f", "value": "T14694BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829040, "uuid": "2d76b301-ed51-4799-bd6c-e31b94f28c7c", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829040, "uuid": "663a209e-e944-4cef-a855-8b410b0319ef", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDRS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK9rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648829040, "uuid": "ffbacaf0-2c5c-4ab8-81a8-95c354980418", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648829040, "uuid": "7d9c8e5e-01ad-4a27-a3c3-6aff23b31670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829040, "uuid": "20921973-ce11-46ac-b4a8-dca353482db9", "value": "sQolEe2Jz9mEC.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0580b021-b1bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648818164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818164, "uuid": "46e8d1ce-52a7-4552-b484-c722ddb17ac9", "comment": "Malware payload (Loki)", "value": "23bbb09307299f851dc3bcbe375c8434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818164, "uuid": "1afed43c-e91c-4ece-be8e-6b8fb0302549", "comment": "Malware payload (Loki)", "value": "51e971f651b31baaab73899b6887b31972d8cb6da3ecd1b84c2fd6c5b5cdf723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818164, "uuid": "2e035aac-68fb-4a3f-b70b-d3a46214c7bc", "comment": "Malware payload (Loki)", "value": "9e56c32df97970366d38f7a2909c8330bab4489d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818164, "uuid": "4318cf1b-79a4-4128-851a-915d4ee9b203", "comment": "Malware payload (Loki)", "value": "9e20c5421114f4c640892b498b0bea9fc8e56483f93eed0e7dc6e1ccecef823b3739f65d3508cf800e21a06dd73364a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818164, "uuid": "9560aa2f-e06b-422a-90d4-06daa16c74d8", "value": "T13C3412997BA0C47AD4A2D7B24E351A659FFDB61340F0400BC7709A5D3E33751AA3E7A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818164, "uuid": "0406594e-081b-43a9-a0cb-0e13ec701f83", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818164, "uuid": "f8b96d78-c206-4092-99f4-3e17c0e48094", "value": "6144:HNeZmT0iI4VR+iH9JlYgxVCnB3fMFCy2PYy:HNlldHzlunBvMFBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818164, "uuid": "2fac9325-0c0c-41ee-808b-2a4e2cc9bee5", "value": 239293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818164, "uuid": "c732efed-5a64-4932-a5f9-ff6dfe4af6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818164, "uuid": "0afa042a-faad-47d0-ae42-d57b103c91ca", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa48ffce-b19e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648805690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805690, "uuid": "1466a152-6c2f-4454-a7aa-41dfe1596156", "comment": "Malware payload (Heodo)", "value": "e060f517780875411bc6dbfe13a6864e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805690, "uuid": "485f617c-0b0a-45f4-a2d7-ab2ceb6c9cdd", "comment": "Malware payload (Heodo)", "value": "534b6de62e378ebe9a7d7e2da809890e565d60bbdfe3e2597f21388e79ad4f0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805690, "uuid": "df72637b-80d2-483a-b9c8-da919c644563", "comment": "Malware payload (Heodo)", "value": "7551e0e126773077a6e663098a4a0c4e4536de17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805690, "uuid": "fb5d8cee-fae2-40a0-9249-3f83ef237a9b", "comment": "Malware payload (Heodo)", "value": "dd111497027b1a46d20d4d9e3b2677994d0b8bc8431358e856c77a8dd0e356395c78f90e3c5fd2e108503eccd1a611ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805690, "uuid": "02d5a8f7-1412-409b-8405-e6fa0e65bf2f", "value": "T11B94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805690, "uuid": "619aadb6-369f-475f-a5d2-10515ef6e7f4", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805690, "uuid": "7f980202-f894-4400-8754-12845420a170", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDhS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKVrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648805690, "uuid": "a0f739bb-e2e8-4513-aaec-4eaea40cec62", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648805690, "uuid": "a45be1d3-4bd1-4e20-8b41-ecad59d3a08b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805690, "uuid": "da3dd3eb-81c6-4c75-b072-fa3fbf2e3a69", "value": "e060f517780875411bc6dbfe13a6864e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68296250-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819618, "uuid": "6fe42ca1-7c06-4379-ae65-4803c5190f01", "comment": "Malware payload (Loki)", "value": "334b5c91873ac4c3e6b9d98ba02953e1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819618, "uuid": "78fe0760-a80e-4b20-87a9-6104629988b3", "comment": "Malware payload (Loki)", "value": "5399f30cc28fdacef749fbe02a58e47915ac47fb46f17cba6aee3efe3eb5d52e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819618, "uuid": "35b7055a-bbc4-4443-97b0-0f18aa55b5fc", "comment": "Malware payload (Loki)", "value": "2d5b18fbe14ba90c4cd22c3ca8f6eaf7c20527e0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819618, "uuid": "105dec27-5569-4bae-904c-64084bbc5aad", "comment": "Malware payload (Loki)", "value": "e56f02156f9e707291bad1ff6a891b2a7ff78f6fa0550cf3204f034ced1325ad1b95f7d024eb64ada0e1ff0a5d5cbc5f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819618, "uuid": "2486bb15-a438-4e66-a71d-beba2b72e0e7", "value": "T13D141276915A89B6E3DF3D3903BDFF3379A28E08AE54839FB502371C063425B3A52215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819618, "uuid": "8bbede20-693e-4867-b132-7f2a2588b309", "value": "3072:p3/G+0Fr305mIL3EjPxJCvsDeJEqfol/IzFKfk+j93KrqUZlC6N:V++KCmIQjWbJEN/IIjordN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819618, "uuid": "ac143c3d-0d44-4762-8bfb-350628fc7123", "value": 192360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819618, "uuid": "bb52107c-c96c-4070-aee6-7278a7cbcb21", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819618, "uuid": "ca7745d0-c539-4739-87f7-fdf994584c08", "value": "payment details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4af8af2-b1b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648814190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814190, "uuid": "154e2ce4-97fa-4fe8-8c70-4dc2a7cfbbd1", "comment": "Malware payload (Heodo)", "value": "4297f0eca92a4e38080b0c58972d0b4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814190, "uuid": "f1000b94-7a15-4b2c-9f03-585336847308", "comment": "Malware payload (Heodo)", "value": "54079e2a12310382fa9b31d0c6992b4fd9091651e9699f25323ea56fae55d7d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814190, "uuid": "5c93ad04-f685-4434-83f3-a17b55d32b6d", "comment": "Malware payload (Heodo)", "value": "1acac5077c4e6fa89d09ef85219d91b29b4be5fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814190, "uuid": "4978e510-6cbb-4b4f-a4f2-102e62f742a6", "comment": "Malware payload (Heodo)", "value": "8a0607161dddf24f803ec2ec1dd2382ad8ebdf6fb64692d76194447bfdad2aaf53c94624b0516a9069f45d0acc28341c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648814190, "uuid": "faaeb5dc-b5ea-4082-9d71-430dbe7ab8d6", "value": "T1D494BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648814190, "uuid": "2a294652-baf3-4167-a0de-f2c51f53f14b", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648814190, "uuid": "afb85a09-1a4d-4d7d-be51-5636777b562b", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD8S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK0rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648814190, "uuid": "cddb51d8-7b64-46a6-8f08-a8752717130a", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648814190, "uuid": "8f0bc27f-6233-4b28-b5c1-64237b55af2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648814190, "uuid": "8919d7e5-d51a-483e-8c3b-b3ed003cb89d", "value": "4297f0eca92a4e38080b0c58972d0b4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d57936b-b183-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648793938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793938, "uuid": "13023072-1a72-45e4-be9b-aba364e9b719", "comment": "Malware payload (Heodo)", "value": "31fcbc2c66881027078f78fda2e24376", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793938, "uuid": "2fb4f3b0-e810-4283-bbb5-999984f63b94", "comment": "Malware payload (Heodo)", "value": "548f9f991ad45625eb1d5f6d0c6ec61a3a28b4ac849c28ae7ba0fb20f385fd8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793938, "uuid": "5f432ed1-be7b-47e1-b4bf-9641c45f15ab", "comment": "Malware payload (Heodo)", "value": "8cc683b086ed38b54d6ba8a0e3c73f18e188727e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793938, "uuid": "02963e0a-d8fa-4947-8570-db0ca4a95340", "comment": "Malware payload (Heodo)", "value": "a8ef2abf26b74282ec931257f4c234661a250c44bd1b00c86d266b0731c3389dc27a29e890ec411fbff54fa7981f9a6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793938, "uuid": "872e45d3-866b-4c6e-b335-ad3fb765dbb3", "value": "T141B4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793938, "uuid": "7f7fcbf8-d06e-42ae-ae8c-499ae9ba0adb", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793938, "uuid": "52da86eb-3104-48ec-b675-28e779853688", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQxJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzPDIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648793938, "uuid": "261247b4-7a58-4848-88dc-96caf7756ae5", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648793938, "uuid": "6e0b6fbd-a3ec-489b-b585-aaca6f1b948a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793938, "uuid": "49863708-76cf-49d1-87e8-a1ec9c825411", "value": "31fcbc2c66881027078f78fda2e24376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74cb1057-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648820069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820069, "uuid": "b6c86953-e96a-44a4-9644-03119ee59e02", "comment": "Malware payload", "value": "a273dee008a9448257a6609a5ad4a445", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820069, "uuid": "40ba2e54-b305-450c-af31-237d565e22b4", "comment": "Malware payload", "value": "54a8a1299a923f6fec724409611b95cfe4fafbd4037ce5ed03a4f7b93f8e5f94", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820069, "uuid": "3caac83a-d3d3-4d66-b117-8faa1422a86c", "comment": "Malware payload", "value": "8611029520701407519533dd87a44447ad609a14", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820069, "uuid": "e5b710bd-218a-4e7e-a662-b891fc7d6843", "comment": "Malware payload", "value": "2e2868ad0c6e0ca35c452f36573b98f507010cf0f22d6a3bdcccba16066b5e1af108fc51c1bf3da16dbdca4bbed4d590", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820069, "uuid": "f1b86177-df1b-4ed9-9f5d-aa539fd1e436", "value": "T1C4F25C827F5DF2AA6BE6B057DD460F7191A4B5CB87DD50E8E0D52F4A0A403E3C2B8847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820069, "uuid": "b31f8ffd-bfcc-4c2b-84f0-2f6d72a75f04", "value": "768:YeeeeeeeeeeeSOt0k99dz6eeeeeeeeeee/:Yeeeeeeeeeeef6eeeeeeeeeee/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820069, "uuid": "b8fb88f5-1327-43c5-ac07-3bb1cb343734", "value": 35641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820069, "uuid": "366f57f6-8c54-4bf0-a621-a4a8518177aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820069, "uuid": "f4f4c04c-c57a-40d7-9271-e630f0bf6e2c", "value": "Releve__ID0021558503.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a52c14-b1a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648808603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808603, "uuid": "523592fd-4fb6-4b79-8bd1-43eca782485e", "comment": "Malware payload (Heodo)", "value": "c9104be59d2f6ed57a7046ba8ca769b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808603, "uuid": "71da260a-0d93-4e5d-8541-eb4240402468", "comment": "Malware payload (Heodo)", "value": "5504bb18d4568d72eebb35f00ede50f122a3f614ccc10a63b9a68551458e62e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808603, "uuid": "eeb032cd-9e8f-42c1-a82e-e813a125e39b", "comment": "Malware payload (Heodo)", "value": "f20dbee857c1e816578d4a8596c9412554c09f39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808603, "uuid": "f8525187-bcff-43ba-aad9-db869e5a7ca3", "comment": "Malware payload (Heodo)", "value": "8752df6a43bce18af85446325ca6ac1cb730681d030be7d179ab96716e1c91d0ada8987086f1c86ef6fa1cbffce3f0e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808603, "uuid": "6f8e8f50-503a-4a6f-9a97-070f72fda544", "value": "T10494BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808603, "uuid": "1b00149a-4b5d-40d8-8259-6138a6911c45", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808603, "uuid": "cfed7172-7bdd-4552-ba9e-fa336d46295f", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDlS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKprsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648808603, "uuid": "7d7055b6-e58f-4375-a6b9-b491fb70a603", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648808603, "uuid": "0227fc31-2535-42af-8df1-898050a6aa39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808603, "uuid": "dae5842e-9424-40dc-9534-fc9627023fbd", "value": "c9104be59d2f6ed57a7046ba8ca769b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f69325-b19f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1648805783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805783, "uuid": "c656003f-f6f5-46b7-aa2a-3dc0f3a1fd7b", "comment": "Malware payload (AZORult)", "value": "10fa511e7a230d443c6bbc008ebdf1c7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805783, "uuid": "9ce486fc-1afe-49f1-a187-534a62d0d43c", "comment": "Malware payload (AZORult)", "value": "55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805783, "uuid": "a5f85c9a-723c-44a5-a270-24ad726e44a9", "comment": "Malware payload (AZORult)", "value": "976e29b1b050a70448ea23976deb8b7f24594e36", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805783, "uuid": "d1d3271c-56f7-4e97-98d1-3e8dc4d57308", "comment": "Malware payload (AZORult)", "value": "4242ccc38b4d2b2d9d305b42728dab1e534dc8f828c75e3668558b35eaf653ec6d7cc1e48d30e02c7b37749b74368383", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805783, "uuid": "376e0477-1363-424d-a4d6-b8662c30acc8", "value": "T14F854B4ED2414995FFC09B78DA7F6BE92B10817508F65703BBA66938D81F3A79F00B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805783, "uuid": "46a86692-e980-4dfc-bea3-df2eb251ffdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805783, "uuid": "2601110f-e3c0-46a9-a346-f7476fa556c5", "value": "24576:cOYIFAIu83P3+qKadCDWBRQMJfzokLpg+6C/MglGCTvZUWw:cO97ROqK6CDWnpP/RG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648805783, "uuid": "cd28214f-a98f-42ae-abf5-7fc4d648385b", "value": 1731072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648805783, "uuid": "8c09f3da-c811-4997-ae29-896d49fa1eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805783, "uuid": "dbc664de-6c1b-4030-a3d5-e12e06440117", "value": "PRODUCT INQUIRY 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ddb5e5-b17b-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1648790254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790254, "uuid": "fa546c15-6b1e-418e-895f-a5a4ba3eacde", "comment": "Malware payload (CobaltStrike)", "value": "d244b16f800fab450a5be43cf2756f11", "object_relation": "md5", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790254, "uuid": "450b01f5-17e2-4ad6-ab55-fdf858b670ef", "comment": "Malware payload (CobaltStrike)", "value": "565e43abd61b7a7bb27a653b46c81d48f893d478c8a36c945d2a986da9c91b10", "object_relation": "sha256", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790254, "uuid": "8b36e943-6a94-4263-954f-ac26c895818e", "comment": "Malware payload (CobaltStrike)", "value": "e328f285ef4405cd2c16676f24a6b46918429cb5", "object_relation": "sha1", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790254, "uuid": "921cbb36-2ff3-4fe1-b725-9d3b86f31a10", "comment": "Malware payload (CobaltStrike)", "value": "637c42ddfa9a1faeed40b3d71c157de78be4142745b0b90c34496d15a2a23f7b7e9dd1c8fb6f6ec54940ae0e479e2794", "object_relation": "sha3-384", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790254, "uuid": "2c98c0aa-d937-41db-bd2c-dbf20d8444ce", "value": "T1BB84F157B3F630F8E8268635C8715A06F771B83247258B6F035446AA1F272D19DBEF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790254, "uuid": "9d767ff3-a392-4618-b328-492a444cc63b", "value": "07044be2c40e611c29183d5d3b7eded7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790254, "uuid": "ec130eb9-47f1-4dab-bae2-c6f9b6ebb199", "value": "6144:ug8S8bLU2IVqD4t776MYJ9hSprlcFKr7UTi5lWw4tJ:ug8mHqm76MChSMIru+Ww4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648790254, "uuid": "a8e7bfe6-f61c-4c7b-bfb7-3b737a7b2463", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648790254, "uuid": "b05dc774-42cf-4ed9-a9d3-7e207b09e28e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790254, "uuid": "b2fb40ff-be34-4a5f-971b-e5a89bbf584b", "value": "565e43abd61b7a7bb27a653b46c81d48f893d478c8a36c945d2a986da9c91b10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0178efa0-b1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648823311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823311, "uuid": "6606fa2b-a4bd-47ae-8669-d69ebd84702a", "comment": "Malware payload (RedLineStealer)", "value": "6e00ff9abc3b0d0cdaae30c2e40efe59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823311, "uuid": "2a671eef-8154-4d61-b1f6-d3e98fbd60ce", "comment": "Malware payload (RedLineStealer)", "value": "56633dbf1eb43f772795a409d8bba5a5dc1e21ca111af731166dcb4fdab66ea9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823311, "uuid": "5aa790c9-059f-45cf-a8df-a1fee2709577", "comment": "Malware payload (RedLineStealer)", "value": "4ab6be221242795e15b2be5ced8ebe6e34a109b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823311, "uuid": "af413d0b-47f0-46f4-be80-40284fa960dc", "comment": "Malware payload (RedLineStealer)", "value": "5498921eb764d29d392b8816599750eb2b7b943c0115231cb4bef49cf0b4feaa78856074913995e48bfe86b8431c188f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823311, "uuid": "1a62e591-7c67-4a22-ad5e-10f20c35b1b0", "value": "T1F6E412F9E611696BD0DD49345F63ED118AB2EC3106771A2B2237B94E4EB83D63C43436", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823311, "uuid": "f92397d8-99f4-47b9-b66b-73512ced4be7", "value": "86115f751f9a8d46f3aa77958fa08005", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823311, "uuid": "7312384f-c374-4d72-8bd1-3b15d8932d48", "value": "12288:RrBKBeNdzuwSnm/+95QW6elkR5DjeKsg9xlulkwMvoL3gTiNENc08TuM59sMQz:FB2efqw705QWVlkfDjl9xkdQoL3UiNEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823311, "uuid": "dbc7cb5e-65e8-42fc-9338-4540d0db88f7", "value": 698128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823311, "uuid": "efdf0479-ede8-425a-a7bd-cc6464fe33dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823311, "uuid": "ed0177bd-57c8-472f-812b-5b8dc88a31df", "value": "6e00ff9abc3b0d0cdaae30c2e40efe59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2f0c71-b165-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648781103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648781103, "uuid": "be6386cf-61d9-40c7-b337-26a369526d75", "comment": "Malware payload", "value": "49c17404c6314b837c9f3b49aba9bf7e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648781103, "uuid": "a5d00573-21c8-46aa-a1b9-940baff8bc22", "comment": "Malware payload", "value": "57d84d42d12c04652cf87f1b1255e0f6ada7674751200ba1d2298941deb5cd44", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648781103, "uuid": "4c0b7d5c-3541-49f4-9051-5fad13eb142f", "comment": "Malware payload", "value": "dce337aa57cdf134e0c7a7101353777346e964e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648781103, "uuid": "19a9e1aa-3e1e-4315-9f91-f0b5d2692478", "comment": "Malware payload", "value": "9162456ee3898fed7bab78b1c1a8607eab7b21ad5fdde11ff61aeb526c94a9a2f080111b1cd7c3e31bdb6b387a8b703a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648781103, "uuid": "44fde928-04f9-4a57-9fea-d1847df1e10d", "value": "T111E3E1E6BB3D8C36878D158F10112C4BC33891EB246704A92FC75EEF856FE593235A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648781103, "uuid": "ce23e900-cf73-4b40-af32-9e6fc5e7efaa", "value": "1536:7eWksKA1XfoHH5uF+ZxKRedfFD8CXZZEi9U8IAZKoR+UwWfOULWB+tLZRLkKJKhB:Q/FnLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648781103, "uuid": "a95ab6ad-b0c3-41af-bf52-cdfb2c242703", "value": 148205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648781103, "uuid": "77f98cf0-8c3e-4884-973c-95d630050d51", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648781103, "uuid": "3954f6d6-23c8-4bb6-b4ca-8ecc67fc0da0", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e8e5fd-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648800096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800096, "uuid": "83497867-ebfe-46a1-9a87-dc566c579da2", "comment": "Malware payload (Stop)", "value": "548a4d607ed9e33eee7cad80c84d6e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800096, "uuid": "f488be52-a864-4ff4-addd-ab974f7db746", "comment": "Malware payload (Stop)", "value": "58800e8556bb1ecb9d1554a14cd59136cbf41bac263c56d8e0adea85e6fbcc35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800096, "uuid": "e53a5af5-2501-43e4-8ce2-ba06c302bd07", "comment": "Malware payload (Stop)", "value": "4d4fb77274a1f566db6f871cc4ff93cfb17209de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800096, "uuid": "dc4b5f1b-a018-4789-8758-197c99376846", "comment": "Malware payload (Stop)", "value": "64464a7a575c86f128288ba0dde6e9aa0e8b1471a187adc4b1e7c0f5c7a5cd1fc3b5b3868bd427e0d4406ef35f18dffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800096, "uuid": "690c33e9-ddab-49b1-8aea-7b95e59098ba", "value": "T1C70512F2A79CC875D4432230A825DAF45735EC62E5224942B7342A1E69B3EDC9BF335C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800096, "uuid": "3c78f8f9-dada-4c62-8cc0-72a4bb6dc9f2", "value": "48cfe16a49c9dcec905547ba5c78e3fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800096, "uuid": "996e737b-8da5-4c71-9f31-889983f5cba6", "value": "24576:wWpH/wAQhw6WqyZsb1jVSxtxpsiGHlDenuRtw:wWu/hwqyUOxiblDfRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648800096, "uuid": "51673973-cb43-452a-befc-a48515c80735", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648800096, "uuid": "006825a8-d5e3-4a9f-a2a0-0d5ff8b51374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800096, "uuid": "a63afe99-581f-4180-a9ec-b0272f0f04d8", "value": "58800e8556bb1ecb9d1554a14cd59136cbf41bac263c56d8e0adea85e6fbcc35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cc1643-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648820183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820183, "uuid": "30385bf8-3550-41e6-a540-829f2177751a", "comment": "Malware payload (RemcosRAT)", "value": "c3366b09adfe6787029b96fc329a39bb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820183, "uuid": "a5c9bae1-86ee-4af6-aa41-659cbd777e6f", "comment": "Malware payload (RemcosRAT)", "value": "594094770bf0aaf681c5630d48f00c97ab7e1d06c8c0da138e680b8da357118e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820183, "uuid": "b4d8b127-13a2-426e-82c3-482d56675ae8", "comment": "Malware payload (RemcosRAT)", "value": "a47d252f93aaa76a18a5b4d26b3bc3bbbc0390c0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820183, "uuid": "b86a8c92-5936-4882-85ab-de2370b206b2", "comment": "Malware payload (RemcosRAT)", "value": "d0af236777240d0563492273b754cf19f41649fa42fa54f5cbba0d109c62ec98f71e253c9e073a8945bf09be5079ebaf", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820183, "uuid": "28c18dc9-947b-4bd7-a1e3-0820ccfb8e01", "value": "T104D4012CB3C54B25E2AB4B34C061D9312B7A9D2454AAD31F70C83DA779A37C6C5237A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820183, "uuid": "46497412-69be-4fe2-8232-f0649172c48a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820183, "uuid": "d346748b-cbd2-46c8-a254-19db03bcbc7e", "value": "12288:Nse9iqQTtkG8VH1fRfFqepJu43PTX8bNVGJxXwKDi:Nse9iBkVVVfvqepJffcI/Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820183, "uuid": "240e0b93-b0a6-450e-800d-debafc9a1c7a", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820183, "uuid": "ac188c89-a826-4bd3-9418-4a8fb3b7c1a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820183, "uuid": "bd912737-b482-4183-bde7-837fe0af24b6", "value": "DHL_119040 receipt document_ pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94045e14-b152-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648772877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648772877, "uuid": "31f64cbc-d149-4c54-ac98-10c1d8ba52b3", "comment": "Malware payload", "value": "e4cda7ceb2bad2c2b7b396e1521ea4d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648772877, "uuid": "0f1d766c-7855-4959-9c07-513be41a5228", "comment": "Malware payload", "value": "5a0218941de268ebbfdeff771adfe55c60a5122ce6b6faf451affcb110bc9c29", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648772877, "uuid": "e52a4f1b-4a14-4a46-9a8b-159982201b95", "comment": "Malware payload", "value": "0e20506b31cf73fdc5659f89c5441ae688ff5f90", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648772877, "uuid": "65a96613-98c0-4e14-bbf0-a3351552a418", "comment": "Malware payload", "value": "4deaa27187606fa03edd3c5bfd02775ebf672c340b4a5741abc01495b5371f254d3c58db70d4051ad912e1a31abf7adb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648772877, "uuid": "d661b006-ce9d-4ab7-a2d2-e635278b6344", "value": "T193E4AE05A79ADD16C36C177380D7812483ECD417DAAAF75E2BE825F819033B5A9083EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648772877, "uuid": "4d36ba4a-f1d9-468e-8140-901e3ffd8b1f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648772877, "uuid": "b2de0aed-ef46-4e40-8e91-e4d8ead16286", "value": "12288:yNgiPU9CSkyJ4b95XSbB4vRfNfvDBNFHphPALNckz:2ICSgU4vRfhLFJF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648772877, "uuid": "3b42b29f-1bfe-446f-a490-b1b749577758", "value": 716289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648772877, "uuid": "02791cf9-3f6b-4437-950d-b8078ccb041a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648772877, "uuid": "f4d2134b-2078-4e07-a3b7-96fa9f8c50a1", "value": "Oddduuoiittnzw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8519b29-b183-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648793956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793956, "uuid": "933ed85e-4c8a-42b7-86c2-49beffa794f8", "comment": "Malware payload (Heodo)", "value": "d9fea44e26333f59d383c74a81a4b770", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793956, "uuid": "b3184f38-51c7-49aa-b250-2715807ded95", "comment": "Malware payload (Heodo)", "value": "5ae31883de2fa4af8cfdfd73d3a198e0beaf0bffb0ceacf3cdf0e39f4f2956a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793956, "uuid": "49e7bfe5-84df-4dc7-8a9b-5ba1a92c5529", "comment": "Malware payload (Heodo)", "value": "df2f03a244d0f869d76e356617c46e7a0ccea6b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793956, "uuid": "30122ef4-567b-4c73-a845-ddb08a2182bb", "comment": "Malware payload (Heodo)", "value": "2c7692b6289d363080300acc8096351cfd2c72fba2cc1e5fb10aed4781abb0f3ec0c48c286fb8fdd17d8bf1e2e1895c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793956, "uuid": "d8e3512a-c934-4066-8486-656f4fca0005", "value": "T1B7D47C0EFFD1C1B2D36B123019D5C64823ADBF2CEAA1C5B777A8BE1D69326C14512B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793956, "uuid": "15f9e5e6-6a46-4527-9134-a1b5cd6b2e9b", "value": "d63ab94f4bb6b5d2f0f6092bf07e00ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793956, "uuid": "10843629-421c-4872-ad09-9505d430acd5", "value": "6144:/6ZMFXzqfoSHr/mvcQYbi2HN8C8BgifO7y7ycuVqrWLWN7Ypsi6Ih9vH0/oUHahE:/8MFX47ivcQMNsrDjKJjO69cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648793956, "uuid": "23eb2194-c63d-4d76-967c-9bcc897e9da3", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648793956, "uuid": "5d4a60ce-e7b6-4ded-90a5-7d88ade5fb8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793956, "uuid": "6105be14-3e55-4244-a633-80dabb5e2c01", "value": "bat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5872de4e-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819592, "uuid": "597ba30e-b091-42d6-baad-4472f9b400ec", "comment": "Malware payload", "value": "c2eef93c3c18669ffd275b921f0d60c4", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819592, "uuid": "48bc8db5-0394-4d3a-bd61-a3c20344d1bb", "comment": "Malware payload", "value": "5c90e07a6581dba87a64a3cac37c21a885243050bdfa07fe2a37dac7ef65d222", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819592, "uuid": "033368e0-a3c9-4b11-8f6e-258afbe92afb", "comment": "Malware payload", "value": "a24b2b9c9f865196e0238dad5020b421be675c1f", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819592, "uuid": "c0539b8b-df9a-4767-9a54-c72c37f4cd1c", "comment": "Malware payload", "value": "1e8594322165758c062234fbd52f0b6a4b4d09dd455b6fdb6dc42ecfdbc2c688e90cc1b6bf8ccba436dbc2b8b75c18af", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819592, "uuid": "76d095c7-bf94-49a0-87f2-94fd0586c1cd", "value": "T1FF1412D332BF9A15F20A13B46B21D6689B92DC21C1C2B61A35A1FC1EF736F910D85273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819592, "uuid": "cd03619f-5707-426a-a9c2-bdcef72c59cb", "value": "3072:OSi45Hcn6+5DP8F+OO5n5uS00EiVQzwJPwX/R4MmCoLPkZAQ3WKLJyfe+l6mjIAs:Fi45WDJOO5wS0biSwJ4XJjgPkWQ3WKLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819592, "uuid": "1030c337-1610-48fb-b3ef-22ad94b72cce", "value": 192104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819592, "uuid": "b67a6a35-3a2f-4555-9e43-78968af9f728", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819592, "uuid": "e153838e-d8d7-4bb8-9374-5e6302b1a334", "value": "order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8adb57e-b1f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hive)", "timestamp": 1648842060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648842060, "uuid": "7bdcfbca-b9f1-45a0-a2a8-6ec17f1a0500", "comment": "Malware payload (Hive)", "value": "3f9c1455992239f4efe31f0e56773433", "object_relation": "md5", "Tag": [ { "name": "000", "colour": "#E32263", "exportable": true, "hide_tag": false }, { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648842060, "uuid": "4caf55b9-a595-4017-ba1c-cb2044817746", "comment": "Malware payload (Hive)", "value": "5d6c176341db385db8e279629a038781c08e15e33e052ac4c26ad58457871e4e", "object_relation": "sha256", "Tag": [ { "name": "000", "colour": "#E32263", "exportable": true, "hide_tag": false }, { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648842060, "uuid": "02cd4941-5c0c-4b81-854f-3cc074427f41", "comment": "Malware payload (Hive)", "value": "67a11f42f5e9ca4b5f2e906b34492bdc91b5ea57", "object_relation": "sha1", "Tag": [ { "name": "000", "colour": "#E32263", "exportable": true, "hide_tag": false }, { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648842060, "uuid": "67a7f55e-fc38-413d-9870-d634be6ee1e4", "comment": "Malware payload (Hive)", "value": "7df8b2196a0cde0537118b5d2c2ff6d8413aad92c3da2b599b54a273c20e0c9ba3bfc13c9e8a90abb7192b66086304e9", "object_relation": "sha3-384", "Tag": [ { "name": "000", "colour": "#E32263", "exportable": true, "hide_tag": false }, { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648842060, "uuid": "54d00f28-f1f6-467b-8392-163cc6d2cc67", "value": "T145763903FC9250F8C0AED130C6669362BA71749C473067D76B64DAB62F63BD46A79338", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648842060, "uuid": "68bed5f3-0d27-4504-861c-e86f1faa917d", "value": "6692f8c5a13cfd61f96822b541185ed1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648842060, "uuid": "a6c1e767-517f-402b-a883-3ced153a2051", "value": "49152:6fbF+F3plgWrb/TwvO90dL3BmAFd4A64nsfJ1WQepVT8CPIpyy+Y/zmZnHz1iDzj:6fotWfpp0JzcCKvxQunEnbVepK3dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648842060, "uuid": "922155f1-3747-40ca-9a26-7b6dd8fb8c6a", "value": 7579136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648842060, "uuid": "0ca13b60-860b-47b8-9456-b2ca2ae633f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648842060, "uuid": "52185a66-4d12-4a00-8c2f-085b639da446", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de77e235-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648818958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818958, "uuid": "e65aa08c-6cb8-4005-aed4-627a790ac97c", "comment": "Malware payload (RedLineStealer)", "value": "e66cd69894a5addaca7e103af4bc27a7", "object_relation": "md5", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818958, "uuid": "eb23a056-3c77-4890-ae2d-fa87ef072cb2", "comment": "Malware payload (RedLineStealer)", "value": "5df70b6d4395c363a2f97843733996bceabfc71a9b30f6ef7361161b34b45bc6", "object_relation": "sha256", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818958, "uuid": "cc16fa51-1ac6-405c-a76b-c0718716b68b", "comment": "Malware payload (RedLineStealer)", "value": "f97fedf73131b2874e624dbdf0f6bf1a620721b1", "object_relation": "sha1", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818958, "uuid": "60d9a446-0808-48ac-8d80-029575f11b75", "comment": "Malware payload (RedLineStealer)", "value": "96942126f07ea31418cf9ef051e3e75a4d8a05af2dda7c03ccde151448cafc5a0fb3ec9c2c041a96f754c6a947c42816", "object_relation": "sha3-384", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818958, "uuid": "ad64035a-fba7-40d8-b0c8-cc0a1735cef1", "value": "T15725127E0F0602DCE1EF7036C46E7645BEA22FAE15615D980229742E483E12E54FF6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818958, "uuid": "7110ffe4-fab6-4858-9bdb-ca377ed2ac39", "value": "e43149e3ea1b946c8acbdd10bc614a10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818958, "uuid": "63e5c1c2-f9b5-4d70-b549-afa2854a9cb8", "value": "24576:UZZZpppppUtXyY0Gz5HisqK5iezpGzNTS1k/9qt2utsF:UZZZpppppUsY0Gxis3wezQzNTSxHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818958, "uuid": "5e5af5cd-7e3e-4b49-b16f-b90f4a2d70fc", "value": 1052240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818958, "uuid": "d7370e19-0db7-4f8e-9eb4-82b51d0c633c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818958, "uuid": "11598e55-97d2-459e-b543-6d52baa4180c", "value": "TrdngAnlzr1645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e5b1f5-b198-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802760, "uuid": "6d733120-dc02-4ff9-93c7-a3772cea67b1", "comment": "Malware payload (Heodo)", "value": "1cf2523001cb7d84a3ba9f9cf7bc5956", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802760, "uuid": "f56b1fd8-58e8-4144-98ed-f37473d820ca", "comment": "Malware payload (Heodo)", "value": "5df779fe3afd156a3ecd32ef3de025d86105db4ebf061f818082e2e805f4e5b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802760, "uuid": "f24c2286-7881-4c1e-b037-647c78313b9c", "comment": "Malware payload (Heodo)", "value": "858c8b4cda5f4ec72d7875bccee257cf0b63799f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802760, "uuid": "ec348214-5c33-47bf-88fd-3a0999260a33", "comment": "Malware payload (Heodo)", "value": "616ba3190dfa6ed8f209bf9ff87e4afa591a9061dea4cad0693a6be0eadcc57182edfd844bc454aa8c9694fc2c72deaf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802760, "uuid": "8cc73954-1ef7-45dc-b334-add3682ecacd", "value": "T18094BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802760, "uuid": "f839903b-0c07-49f2-a36b-756f6c01f6df", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802760, "uuid": "e37e70c8-8200-44f7-bb49-82f1fd818c01", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDAS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKYrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802760, "uuid": "e79ee264-411d-4a99-acf9-bf2993b12e80", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802760, "uuid": "88889c6f-6888-4893-a557-d2a250453256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802760, "uuid": "80f568ce-74ca-439d-89c5-7b06131bb2da", "value": "PY8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf14fffa-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648818932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818932, "uuid": "1c5eae68-4abe-4413-a475-8ea2507eb858", "comment": "Malware payload", "value": "7ba300c276aa0c750e789e5cb18e3574", "object_relation": "md5", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818932, "uuid": "d2d3ca2d-52eb-4c74-8e99-21573269ebf7", "comment": "Malware payload", "value": "5e83f90e54bfad61111ff0ba791c63da7c5ad638d99dd66eeb1bf4994c51be9e", "object_relation": "sha256", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818932, "uuid": "8deede7e-966d-4ad4-8357-1e5bafcaddee", "comment": "Malware payload", "value": "4d89a1a815ba8e1594360a1b61d7801e55613d2b", "object_relation": "sha1", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818932, "uuid": "92999e1e-87d7-4e58-a9a6-d38dc6cd2964", "comment": "Malware payload", "value": "afeda03282060e49070f014e64997f9fdd58b76aa197ffa9054750e6aae65df4bebd5ebf4d87c8e75578b8aa9f2bdc7c", "object_relation": "sha3-384", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818932, "uuid": "ffd14365-91ce-4a0b-ab01-ad1a97208ba1", "value": "T10BE42325E740DB6FC03948BB8053ECB683DBFE55A6ADAF1B25487857CA3D3017C0468A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818932, "uuid": "e26c8bc4-e41d-40d7-a7a1-2a76cf41088a", "value": "67b547d1d2367fd95ec40f319edbd898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818932, "uuid": "1035379e-bf6a-4c99-aceb-6cd652342662", "value": "12288:HE+BbwyUekg1pORw4FV6CjZ3vwKz+xaLZZk0RchBXHcZ9QJ3J/1MRWL7Xz:HFBIekgLORwWV6o13xLvGBMZ9Y3Rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818932, "uuid": "8af3ac7d-d9fa-4277-8fd3-b41da3c8681d", "value": 714944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818932, "uuid": "e5a28dee-d9cf-4d4b-a786-1d4b1104b7dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818932, "uuid": "9d011843-bf01-4f6a-bab3-feb228e90d75", "value": "TrdngAnlzr10422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429ecbf9-b1a0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648806241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806241, "uuid": "63057170-c096-44b7-8ce0-80165ea324da", "comment": "Malware payload", "value": "3c66f9e5b4f2104f9ca8677d0f4e6c01", "object_relation": "md5", "Tag": [ { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shellscript", "colour": "#4DF479", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806241, "uuid": "99abb061-0a81-4caa-aa6a-cb1dfc9618f9", "comment": "Malware payload", "value": "5eba254e47a0d1668333b1718b9049874bd6149661822c86aa26d6e43bd52e5f", "object_relation": "sha256", "Tag": [ { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shellscript", "colour": "#4DF479", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806241, "uuid": "59e52248-5959-4041-ba5e-b4a46fda9692", "comment": "Malware payload", "value": "fe6e6b7aae438494333fc7d55b50fb4efd271194", "object_relation": "sha1", "Tag": [ { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shellscript", "colour": "#4DF479", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806241, "uuid": "7ae9e31e-6e2c-4cdd-81f8-aab098d72041", "comment": "Malware payload", "value": "0b1f066f18bc1a7c8f34e82a9995ba8126e946b0db5a935ae9a12ff9ee0637cadb2e85074d47ef29c517936a816539d9", "object_relation": "sha3-384", "Tag": [ { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shellscript", "colour": "#4DF479", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806241, "uuid": "bca5b0e2-8e67-4749-9410-ffe8e6855bf7", "value": "T16673969CE471ECB03D58CC69A9997218A8EFF09A91F376487C1D3E38675400EF9641BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806241, "uuid": "b91791df-2ebb-467b-85b3-43c54f896e0c", "value": "1536:ZF2Tc2HOdmQ4x5WCKUtq7bPZEMiFOmm5air0tI2:ZF2TcIhtsP6v47ccYI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806241, "uuid": "5febba45-a2b4-4b89-b7ec-944126149931", "value": 79686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806241, "uuid": "2ee0dbc5-6500-4c90-abb6-e3bd21710776", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806241, "uuid": "a1ac6c08-e052-4dd7-916f-908c31d88957", "value": "dktest.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eee36b6-b185-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648794611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794611, "uuid": "5153c485-fbbc-40e8-a741-23b654a8db5a", "comment": "Malware payload (RedLineStealer)", "value": "2185ac526b49a7674806a65bf3b48248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794611, "uuid": "77c468d1-a1f8-4ee2-adf4-d6efb8862e47", "comment": "Malware payload (RedLineStealer)", "value": "5f0eebff86919cfb5b817481098a0a5d9ec15cb8e9118d362865a67e0c349542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794611, "uuid": "af3a66cd-3a80-4b63-b8a9-0f53c0eec22a", "comment": "Malware payload (RedLineStealer)", "value": "39ca8b917239f0f083d362da7a6b79ee6e7071ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794611, "uuid": "02b06ed8-5b7e-4eb3-9e02-c46e690d82f4", "comment": "Malware payload (RedLineStealer)", "value": "c4ff4504f18a1cfc6b58ed1184deeed7f39d3fbcdd3c27ae4bff2601fb7743349fc028abc734f0774da08f58da98cbbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794611, "uuid": "c1f66419-0d3b-49fb-a538-237be38f6102", "value": "T123A34B9027CC9620F2FE4F7168B811A443F0E5177512E78F9EC960EA1F76B80E656BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794611, "uuid": "19a5e051-1306-4580-a1fc-17ae9b2ef6b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794611, "uuid": "a2fda560-8965-4084-8b0e-8fb7b9df3f92", "value": "3072:cGUUJZ/C8hYd08XOXfyjGGu1qBzp/LerVx:cGUMFa7u1qB1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648794611, "uuid": "740e47a1-dd32-4736-9383-46bbb24cd137", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648794611, "uuid": "ed709577-a519-406b-8a47-05ca5c362409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794611, "uuid": "eca69133-ea41-4b2a-8219-0b29035e8294", "value": "Chakras.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea5e075-b20f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648853962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853962, "uuid": "f25341c7-573f-49d3-b8f2-127c72859581", "comment": "Malware payload (Mirai)", "value": "d03987437eba9e190ff35690a9e5f7af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853962, "uuid": "58c8f5e3-a235-4c72-b684-a5a7256fac25", "comment": "Malware payload (Mirai)", "value": "5f41d2ff7dfefdddb0a07e7737389515dc41a379fec3c3169eb9d4517ac5254d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853962, "uuid": "4ef4fde8-53fa-4976-8def-b7658bf13d6c", "comment": "Malware payload (Mirai)", "value": "7eabf77bc08a7b84a1c3955ca37ce7a7fb98c20c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853962, "uuid": "4b1dbf40-c85e-41de-92c6-3359ab5e894c", "comment": "Malware payload (Mirai)", "value": "4cdd3497199b7ae3fb0b25d6131b63d7fd4d95a0190cae6c4f9a82339d0cc56761a1d84306965f5e6305aa7cafaebdf3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853962, "uuid": "45a22279-a414-4118-97f3-f7a9f6aa03cc", "value": "T15B434AC4A187F9F5D8051538307BEB725F77E43A603AEED7E39A9933A94560291033AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853962, "uuid": "f4109601-410b-48b0-9851-816e5e0cf976", "value": "1536:+arOTss6aiWqlByj2bu1bhuWh3PAUAAJsT:+hTL6aiFByj2bu1b0WhNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648853962, "uuid": "38536c5d-ab77-4d3c-9e42-3ec0820d64d6", "value": 58128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648853962, "uuid": "efc0a6ab-0344-440f-be87-11a1def605c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853962, "uuid": "7cfe1687-df1f-4438-9166-5703c5d401ba", "value": "i586-20220401-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73928932-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819637, "uuid": "6b404afb-9af9-49a2-af27-b2398b57ceb7", "comment": "Malware payload", "value": "6aff436169b06b7eae069cd719275691", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819637, "uuid": "717fd0bc-0b73-45f6-ac48-d1f6e7df7e64", "comment": "Malware payload", "value": "5f5911c84a7681749b4166ea58d4da9e7030cef204b3edeecaeb8782708d7263", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819637, "uuid": "7c193ec6-aa49-4cf7-b806-c27ecb0b4fa8", "comment": "Malware payload", "value": "2b3a684bcd912515a54e22bab7202bb210eb3506", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819637, "uuid": "27ea8174-68ca-4c91-80f1-cda7f6f89fc7", "comment": "Malware payload", "value": "dabe75ec35ab3e4c62e72e8d7d4ae457e512fb7744337bb4387967c1d81105bad1772765d33806eea07951a7f602e121", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819637, "uuid": "2bb7aa91-d303-4cb0-ba8b-b0d2b3e66505", "value": "T171141293B332D1A6E4519131476C1978ABB9FFE3780F99632341342BB6391ABD20779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819637, "uuid": "93575e4c-07ab-4d6d-a476-aa843ac5e3fb", "value": "3072:DRHIIR2CZR/37jrYgjmZOXv2yEJyjY7XF9q9fG88Xi2hKGgBByJKy7smG+etunOT:aQZF37jsD9iG8xGgB80ojG9tuBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819637, "uuid": "a8f41730-c5fb-42a0-b99e-f8a3d60d2242", "value": 192936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819637, "uuid": "d02c7001-0457-440e-b05f-6430418804b7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819637, "uuid": "cde63051-2895-4107-9e74-0761e178732f", "value": "OC CVE6535 _TVOP-MIO 1C 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39213cc-b1aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648810806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810806, "uuid": "b5f7de18-51ee-4cf6-9190-0255304dfbd6", "comment": "Malware payload (Mirai)", "value": "4b13601f186e6ac3ce07c858084e1bdb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810806, "uuid": "a8995df2-282b-4d41-980b-bb05bba0d837", "comment": "Malware payload (Mirai)", "value": "60d990c0aadc6b890778820225cf07422810cd6df6dcbff065bce4b55cc968dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810806, "uuid": "bf86452f-61fe-42d7-bb0b-6e7db225de2d", "comment": "Malware payload (Mirai)", "value": "2b6cff2bb19ea03360bca743c071e2244931234c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810806, "uuid": "45d0464f-c8d9-4f6f-b88b-ca48b9b4ab7a", "comment": "Malware payload (Mirai)", "value": "ddf8e494265d41f96062cda349eae69b1381240d89aeab82c9473e5403e079accd9bfd243b86a8d794e83b3d20b91001", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810806, "uuid": "5f816de0-9efd-4ee8-aae7-f825c2c7a7bc", "value": "T1CA632A55BC95CA26CAD023FBBB1E128D3715539CD1DF32039E296F746ACA91E0E37281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810806, "uuid": "edc25511-e995-4197-b9e3-0dd584a7060d", "value": "1536:CDfRRppc7nQZnF8ELja95uwvsCOS0kY3EUEg9E5W09Ww:CD5mMF8ELqjeD3ERoE5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648810806, "uuid": "f25a1c04-1806-4808-a529-e972d61e496d", "value": 67040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648810806, "uuid": "b24fbd6c-341e-44e9-a67a-822815973d49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810806, "uuid": "731298b2-8a4f-4bf8-b0dd-7fdfec192a4f", "value": "DEMONS.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd245dce-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648835223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835223, "uuid": "0045e629-1d46-45da-a5a4-6b5f2dfcda4e", "comment": "Malware payload (Mirai)", "value": "dcc157b2c284ac676000d64dd33f3ec4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835223, "uuid": "2c8f315e-08cb-406f-923a-f7cdf4c62a2a", "comment": "Malware payload (Mirai)", "value": "61840f2b675d31bf084345e4ecb22eb512a3d95e489b6b87ee98855ab10c2f92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835223, "uuid": "f1cfd9ae-ba10-47c8-8433-cca68b3442f4", "comment": "Malware payload (Mirai)", "value": "811e55a379005ff0db9551ece52c34a0eb370671", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835223, "uuid": "d87d2d8f-17c7-461b-963d-452c3662204f", "comment": "Malware payload (Mirai)", "value": "835795de10ee217a7b514527758d35c98646f52bfa6a5f6dca83e7d21b98e0f0ab527d861afd52d8cbae728d12a831d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835223, "uuid": "27a7c296-77a3-4f44-b139-38a0e977ecd1", "value": "T18B93B516BF615FB7D8AFDD3349A91B0628DC555B22A93B75B530C428F60B20F09E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835223, "uuid": "8a8a57e8-e4ff-43b0-9e70-b2fe2b5a566e", "value": "1536:u6ESdImJi1wPxIQzXfDMmRZ0BScsi/4ZyQJeJYX83Xvw:u6EbmJCAI8zREsi/4Mo83Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835223, "uuid": "216c78f6-b87f-4c2c-9eaa-9b71009cdfd2", "value": 97236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835223, "uuid": "20b1d5fe-614a-489b-9163-3d730a1be67b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835223, "uuid": "d8bf8549-db3a-4e27-8a96-db7c9ca10fe7", "value": "dcc157b2c284ac676000d64dd33f3ec4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d13b940-b198-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802957, "uuid": "0a7839c6-55cc-4497-ac3c-535a91e7f235", "comment": "Malware payload (Heodo)", "value": "e846bb7d31479decd6b0067bea205d77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802957, "uuid": "40e7899c-f605-4210-804c-552b22052ae9", "comment": "Malware payload (Heodo)", "value": "628d19e20cfe5d3c6087e74a6b1fa7addc2c3b40ad9ffb4c3fdd166f5e739eb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802957, "uuid": "1bd798d0-3009-47b7-b4bf-963c21a9c87b", "comment": "Malware payload (Heodo)", "value": "852e6fdc254d7730c16c9ef8850220a57da1fbb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802957, "uuid": "b2c77bac-55d2-4ca1-aae2-d8c0dcf91c44", "comment": "Malware payload (Heodo)", "value": "8b6c9dd8e96d25d0ce707cd0f62c7241dbd67aca1ff2dae07e5b3939f150e872c55141634c375dbdf4ae369b6704c077", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802957, "uuid": "4732a91e-2c74-4472-8fa5-660da22f7e21", "value": "T15994BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802957, "uuid": "8816964d-11cd-487c-895d-17ef2776fb7c", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802957, "uuid": "0241bb22-194f-46e7-9695-fd6b27ab78d6", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDuS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKyrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802957, "uuid": "06b34381-9c4d-4b8b-bf73-3c145022943b", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802957, "uuid": "b7b0a460-e811-4cf7-88a9-3375d7a4f151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802957, "uuid": "1e9b7613-19c7-4bbf-8580-9f39d02fc21d", "value": "e846bb7d31479decd6b0067bea205d77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d633ce-b1b5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648815267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648815267, "uuid": "c2f9638b-3199-447b-83d9-7a60f2b5d0a4", "comment": "Malware payload", "value": "943f3bb39b93756a294df88d5005b279", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648815267, "uuid": "addcd615-e221-41ca-89ae-b91cf84c9834", "comment": "Malware payload", "value": "6401737f522a3ee6796db3794641b1f95db3d3b75b242c381544c29fcb37cc44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648815267, "uuid": "970e3340-35a1-412b-8116-7952a4b817dd", "comment": "Malware payload", "value": "5e01a5a3849f61b653306703bcabae2858bad133", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648815267, "uuid": "2841e759-9d57-4055-ae9c-db33da8755e6", "comment": "Malware payload", "value": "8c67f632df5567d4272e89cd87cea4550f482433dd2d4d14ea888e777a7ec3c6646a076f5b452a0540a89476c0255f75", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648815267, "uuid": "416298c1-99c9-4f10-ae0d-546d9418c755", "value": "T10BD25CC26372CAB5D4B540BA8066F71B6FF9F24A93ED4963C39044DEBE206DA4835603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648815267, "uuid": "0b26b697-9e8e-415c-a3b8-754dd5b4f39c", "value": "fc0224e99e736751432961db63a41b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648815267, "uuid": "bfce65f1-0a24-4624-90d3-a7b59f4b1b31", "value": "192:oJ0qWTlJe7+eEYlG0s9WuR/wt9bBbwX9bjfac0Di+/jh50QPi:8QlJe7+tYlGRBR/QVbwNjgh5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648815267, "uuid": "cdf00539-0b23-470c-9cb1-ed8fee75fd11", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648815267, "uuid": "eda68f9d-3d39-4485-94f8-1f6907637c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648815267, "uuid": "f3907674-0415-4f0a-bfe7-0ae0f67382b3", "value": "6401737f522a3ee6796db3794641b1f95db3d3b75b242c381544c29fcb37cc44.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34140f92-b1b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648813518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813518, "uuid": "e9c49346-aacc-44f2-9809-bab56637c752", "comment": "Malware payload (RedLineStealer)", "value": "d870373e2ffd2b1788beaec4582f3f3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813518, "uuid": "04dd4abd-d151-4196-97e8-f748e7911376", "comment": "Malware payload (RedLineStealer)", "value": "64e046a94ea6f31a4a2cf9c77dc6e4f0d9e7455705668e8b354057c1d04f9b55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813518, "uuid": "cf694861-b75a-46a7-a54f-d722aa50e99f", "comment": "Malware payload (RedLineStealer)", "value": "5553327f2dd0792f4d2f2171a8fb7122ecfb18fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813518, "uuid": "a35e94f1-c112-4f1d-9cbe-e7476d5622ed", "comment": "Malware payload (RedLineStealer)", "value": "85cbc502619bf985eded9a8f37b9c6edbabbef4ec319877d3f02c0abec9c4d8b382584064e49f10ab112faa8076838b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813518, "uuid": "8d509df5-976a-42ee-b61b-a67b6901591a", "value": "T17265F56321BDC6D1F28D7E75A2280FD162716C1AABB1D14BC50BBED2D9336CBD8106D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813518, "uuid": "e7e68dd7-bf00-4b67-b964-94b45008f582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813518, "uuid": "54191cdb-f70f-4cc0-a138-b375d76093df", "value": "24576:nRGLcGCQqpodZT6xHwurnOqwvklglZeb:cbRqidZmauCqt2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648813518, "uuid": "7650fabe-a777-4e87-9f93-1d722b8c4acf", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648813518, "uuid": "be68ec96-dad5-46a1-aff2-a7a799cad5d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813518, "uuid": "aee31718-2e9c-4164-93cc-dcaa4830c5b5", "value": "RQF #00811-AL WASL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23563d83-b20e-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1648853433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853433, "uuid": "53b1fd95-7dd8-4994-85db-28f437aecaf1", "comment": "Malware payload (N-W0rm)", "value": "ea63ff6ed30b4e035ec1846f6f5a2aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853433, "uuid": "cadd18cf-cec2-408f-a633-c293165d9d23", "comment": "Malware payload (N-W0rm)", "value": "6571796333ed21546a13988d2ca18ad3f3e2cb9801993b6167dab8cafa0282de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853433, "uuid": "ff71475e-7182-4046-989b-1df6a1de7f80", "comment": "Malware payload (N-W0rm)", "value": "5c9accbe72cedac53eb3fff21688e0982c2cca99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853433, "uuid": "1043056c-e32c-478e-a1c3-00bfe462ea50", "comment": "Malware payload (N-W0rm)", "value": "55299809b1f5225182aaf026345402a03a1c28aee9b2e5e3c0a0afc111df50fef344c5fff5b7ebb398e4326a560f9b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853433, "uuid": "1f854702-99f6-49d5-8cfe-5bc47047206f", "value": "T1CD94E0F177AD84B1C447363098658FA0273DAD32E16046473B74261D2EB3ECCAAE675E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853433, "uuid": "949a47f1-264a-4e37-ad4d-aba07143b92b", "value": "1fb27c5c1f0c51182d431447d260c7bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853433, "uuid": "50021ed8-0a84-44e8-adcd-91af2cb24530", "value": "6144:cuXVlvVvGay8R4VAXr5fysKLYlhdq7JKQeuySuzbgwuO0Q7ITsqkqwVfs:cullvVxJgAbRybQq7QQeubunnwQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648853433, "uuid": "4cd5edad-42c9-435e-80a2-a3121d1af5f6", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648853433, "uuid": "5a4bc503-3d42-4171-bfe0-27ebc3502486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853433, "uuid": "3de20de8-a3df-47b9-a0c3-3e5568936827", "value": "ea63ff6ed30b4e035ec1846f6f5a2aaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb54f1b8-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819355, "uuid": "c8fc13af-c1c1-44c7-8366-4b85dffd3cf6", "comment": "Malware payload (SnakeKeylogger)", "value": "7d18df8c64b72036af7bcd084bcc9c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819355, "uuid": "bfd8d28b-3534-49cc-a628-d85bbe627f67", "comment": "Malware payload (SnakeKeylogger)", "value": "6573e34232322553dbd8035ed4d047827e2644fe1bcba2e3e70c374e56734728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819355, "uuid": "040b81e7-4b28-476c-8be1-36e615221d7e", "comment": "Malware payload (SnakeKeylogger)", "value": "ebbdf7eb92dda9c8fbfbeb8945a14ab7e3efa1ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819355, "uuid": "cb3403ad-8aff-4664-9660-fa3a52d4a7f8", "comment": "Malware payload (SnakeKeylogger)", "value": "027ad44735009c76577f4e8b476901f1d7d3f9fb224ca5b4334886c01d3c7c1a9b2ab08100d47d53d1e9afb446caf212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819355, "uuid": "8352b888-c317-4f74-bdc6-2abdf1304107", "value": "T10CF43AE9F7F07B9ED417817188054D67BA01AC7AE20F8053A003796A9E7E9839ED53D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819355, "uuid": "8d134c63-841f-4429-828f-ff5c08994c8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819355, "uuid": "3356b322-94a0-4321-8d92-5eb66294e70e", "value": "12288:ux+AfCuycMmC9gsdUq07fIbJXtEpLUgTnXwusgS23yd2OluON4fA9uwkCp:1AqijC9D0u23yd2OluON4fA9uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819355, "uuid": "712378e3-0c10-43cb-b5a1-e7cb1785a41d", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819355, "uuid": "fb594825-4f63-4715-bf74-5d28f16d5753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819355, "uuid": "a6dbebf8-d325-4858-85d1-b517d8ab097c", "value": "PO- ZA2214756000899800 List Xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94acfbc-b1f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648844719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648844719, "uuid": "5a9382ee-1a87-406e-8783-1af17eb33a0f", "comment": "Malware payload (Formbook)", "value": "28a4a0cb690136cc1f22d80c446e8ddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648844719, "uuid": "c9c15f03-5999-4811-8387-521f83ef02be", "comment": "Malware payload (Formbook)", "value": "657e0245d74e6c7b1c9df156b243b3b88cde2bda5a288f500056d77aa0b1ecf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648844719, "uuid": "4f66a28a-55ac-4a06-a58f-fe3b278d60eb", "comment": "Malware payload (Formbook)", "value": "8e3034e07f19c49ea6050e61b922c6893394dc31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648844719, "uuid": "882e9493-bf28-4c26-a7b7-5ed465111ca1", "comment": "Malware payload (Formbook)", "value": "c071b91b6575a6d4a3d5b45752f4cd168f1cbb0f7ed16ff2736d83496fe7cc853fa628845bd6f7891d88f636348bc862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648844719, "uuid": "f952c766-6767-459d-a56c-0c882a30799b", "value": "T1DA264B2453AC4CE6DAFE8331FC39943CF1F1AD59F294B3480559B1E85C79B44EA806BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648844719, "uuid": "56c7b4c1-c11b-4348-aa94-ecb20791b860", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648844719, "uuid": "80885ee5-2032-4806-bc01-7f678b797c60", "value": "24576:TtpFmAt0mAotStqoTeo1TPFPyfuDlExuSUNfmfsa621L5C4y6vAfFcwF4SsG9E+5:EA28Sh0ujN752hyNtkSsL+lhDXYQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648844719, "uuid": "f9570542-67a5-40a1-a9a2-929006320e0e", "value": 4468224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648844719, "uuid": "95bcb0d1-b062-49ff-b874-9a80e1289540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648844719, "uuid": "4578442c-8b50-47e4-b033-b9e0dc7db45a", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3aab70-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819388, "uuid": "c426014e-effa-414e-b6c3-407c6b56736c", "comment": "Malware payload (SnakeKeylogger)", "value": "14fbe82d7661d7ce3dbdc56508f16fef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819388, "uuid": "16e96667-64b0-41b9-ae2f-c4ea17b12676", "comment": "Malware payload (SnakeKeylogger)", "value": "660fde745eb4e289dbf3072c30f27eecbb0d974bfb35f44982d20ec1dac508d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819388, "uuid": "67c2e101-1989-4ebe-a429-53915ed45484", "comment": "Malware payload (SnakeKeylogger)", "value": "3bdc393d36b96bfa9a87c329a4a6f3b4fdb84462", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819388, "uuid": "f82906f1-3505-45f9-ab33-7ff0bc189afa", "comment": "Malware payload (SnakeKeylogger)", "value": "6dfbd765aedb18eb5a02f05b8fab9ccc22209ae76cb7c35f48d4db5e7ab7a31c7079a83b02130fa71cf8ec0929719667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819388, "uuid": "c29185d8-930f-4424-8608-e162ec693d73", "value": "T1B835123977DA1912DFBD4B3BA87011406B72B7274A77E30D208655FE16F23428A43BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819388, "uuid": "2419a939-a3fa-4878-8d54-4a3e26d191df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819388, "uuid": "9aa404e0-56f9-48bb-b729-27a0e85e974f", "value": "24576:mpLVpHpiu2DU9DqMTrNPsV0zcVONJ/apkip+2Ghd:m1Hgu249DlPsa9NkpppFGhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819388, "uuid": "1840ec1b-fc9a-4cd6-a004-fc047bced45a", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819388, "uuid": "c8c35821-a669-4636-b701-fabc67799921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819388, "uuid": "490e3322-b734-493e-b7d5-d7443a8e2100", "value": "14fbe82d7661d7ce3dbdc56508f16fef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8898662e-b197-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802493, "uuid": "eb548eaa-baf6-426a-8ee2-3241ec2e58ea", "comment": "Malware payload (Heodo)", "value": "122bf72e0e6220e1e9b55fdb0f6da5ee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802493, "uuid": "6243540b-c143-401e-8c40-d4a38588c060", "comment": "Malware payload (Heodo)", "value": "66ad333c077a456ff2366cc1e094ec5ea7e29202ecf977598b5a3ac9e10fc337", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802493, "uuid": "74c9692a-10c6-4a24-8142-3f5abee4f1f5", "comment": "Malware payload (Heodo)", "value": "f0cf6205f4d5d385cb5b9fe029ff5fc93e308c60", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802493, "uuid": "62e720e2-102d-424a-b2ad-54d76345bb40", "comment": "Malware payload (Heodo)", "value": "0f274d976ac0320cd51f413603018974458860220d430b86f8e36b4664ee3200ef030da108e98188a716e215b1737e76", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802493, "uuid": "5727175d-294d-422b-8d3b-af6eb946e00d", "value": "T1D194BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802493, "uuid": "9cb9a31d-f404-4a14-9e67-78281555157f", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802493, "uuid": "8ffce11a-df43-4c3f-bba0-002a6802d609", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDXS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKvrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802493, "uuid": "181560a6-f36e-43b4-b293-6842eb6f33c1", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802493, "uuid": "aae026fb-d333-4e61-9146-b8862caf5ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802493, "uuid": "8396ea4b-f3ff-4dbb-9f1f-717973402901", "value": "1ZO4zFXFBqnOqYKv1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053e1677-b169-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648782515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648782515, "uuid": "132440bc-31e3-49a6-ace1-a4566312c3d5", "comment": "Malware payload (Mirai)", "value": "0d4f9ed251f1af4b5a4ba2f8475e1164", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648782515, "uuid": "3df6db66-9802-4734-841d-8f18f5f6738e", "comment": "Malware payload (Mirai)", "value": "66eb4576366324fc40475b85eb9d373e399baed201bb452b96b43910c9180401", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648782515, "uuid": "469942e3-9e0d-439f-8aa7-4148c4a4b4b6", "comment": "Malware payload (Mirai)", "value": "1baaa9ccd491a6c437146fe1a9b9f705351af18c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648782515, "uuid": "cb9f4ad9-6197-400a-9209-d6dbbc065bfc", "comment": "Malware payload (Mirai)", "value": "b28e0fb3bc15f9be12cd4e2d40aac9c3f01a6d6703f09d60bce0ca48f805770e60ce8187581d2fba573b701745c673fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648782515, "uuid": "7f3a3936-2020-4bb6-82d3-3e1933e16b27", "value": "T12073D815FF651FB7D89BCC3309A81B0628CC665A22B93B367E34C918B54B15F19E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648782515, "uuid": "f91b47cb-6ad3-4a65-b6c4-e37e5865c156", "value": "768:lqwATxpQ5e+y4rdv5Y6ZDSP6gSOee2etJeGa7N/kWjrXilvo2KXZY10Uf7:lCTxq55WADSP6X/74JVSN/nJ26a10g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648782515, "uuid": "d62a994e-c44c-42e1-bf90-54f61256730a", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648782515, "uuid": "3ddb5dcf-8748-4d88-b28b-5c13c1207ba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648782515, "uuid": "52010eb0-032e-47ff-aabd-02ad39e2ffed", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6e0ad2-b198-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802898, "uuid": "ce7b3ce4-9d26-4617-bcdb-b361d8c94c00", "comment": "Malware payload (Heodo)", "value": "e99157bf7d6d15e483f6fa9dfd86d8a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802898, "uuid": "6e7da562-d015-4b6e-bb08-dc9575e924f3", "comment": "Malware payload (Heodo)", "value": "676cad47e7e842d6433c176b69db59dd01c30914cb8b08ba3cbc7a9ced6ca187", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802898, "uuid": "307d4d81-ead3-492d-a9e7-6e8bb8f72655", "comment": "Malware payload (Heodo)", "value": "b8032c7af2c33a594b62cb1f5289718efd66fec5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802898, "uuid": "32bed603-a35b-4f02-99d1-a80da6aff73a", "comment": "Malware payload (Heodo)", "value": "0ba042a1f1de6dd0893942a3095ab7b4cb0990efbea1cdf3b05e1934d40d844c43539c73e4016efda4a4429ed7340d67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802898, "uuid": "54e3363e-81ef-4095-8540-1a00be89f1c0", "value": "T14A94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802898, "uuid": "35db4208-063d-4382-91e7-7dd8068234cc", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802898, "uuid": "18c54bc9-8dfb-4268-84cb-2c178873e25b", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDyS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKGrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802898, "uuid": "4156e397-a614-4d7d-9d19-153182b842d1", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802898, "uuid": "582e79ec-9e57-4faa-a8b3-f3d11aae4b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802898, "uuid": "11e2f5df-cfb5-4744-b91d-1afd9185563d", "value": "e99157bf7d6d15e483f6fa9dfd86d8a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b59028-b199-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648803473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803473, "uuid": "e6557757-8657-4b32-9b11-f137a718a5be", "comment": "Malware payload (Heodo)", "value": "70fe7370e0d3a012d3f3d000b5c931b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803473, "uuid": "873794c2-f12a-4f23-89d8-60ff340f20bc", "comment": "Malware payload (Heodo)", "value": "67d002fb1384095980f3e31545686a10fa9ea44f0c74f96972cffbe7b8aae719", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803473, "uuid": "344c3b20-b34f-4b4f-9937-c249090b5d25", "comment": "Malware payload (Heodo)", "value": "74b764998b676db231859b8cc76f984178d98afa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803473, "uuid": "057aa472-8ec7-41e9-b7e8-db8e827ce5d2", "comment": "Malware payload (Heodo)", "value": "b5346b78d94ff12ba6421e6cc26f7dcebb0fc43a0bf1b2898830407bc3ce2c16b71de4d834f212133ed6c069d8c8bd9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803473, "uuid": "9f584d8a-1c1f-495b-94aa-4dadaf5c5005", "value": "T15B94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803473, "uuid": "7acffce1-0f48-400b-9d7a-e9b64575c0b4", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803473, "uuid": "a60d5d07-78c5-4e22-9791-ddca5fcd7c78", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDGS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKyrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648803473, "uuid": "54dbb2b8-4947-44d3-a88e-14f8bf09a0c3", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648803473, "uuid": "bd9fdb4d-b8a1-4920-bdf1-957eaff85cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803473, "uuid": "1a7174a4-ec2e-41f4-904e-f438f6071e0a", "value": "70fe7370e0d3a012d3f3d000b5c931b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f365c02-b184-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648794129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794129, "uuid": "2b4eb5f0-00ff-41dc-95eb-059ebeb4d162", "comment": "Malware payload (Heodo)", "value": "d72f68f94e7f716ac3f1cf88007c82f3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794129, "uuid": "2fa3c3fd-0938-4854-adcb-4a3f8fd97f2b", "comment": "Malware payload (Heodo)", "value": "67d94396ab2c78b07f18073ec289eab8d5d926ff19ac9f590f055a51f597dc62", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794129, "uuid": "6aa932ea-155a-46a6-80d6-6fac2859dc6b", "comment": "Malware payload (Heodo)", "value": "b3ff01e21f1154e95e8bd2160b64c94ef04f1afe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794129, "uuid": "eb412943-9273-4ef7-9c6c-95812160827e", "comment": "Malware payload (Heodo)", "value": "894470dc7a507f5ec1851c3191dc62b4ef96c46b016d1424577aa1f9ab4a9a14041c919473d4d51a7f9029a67373223f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794129, "uuid": "0fa9e23c-2bd3-46af-b721-1950fb37cf50", "value": "T170D47C0EFFD1C1B2D36B123019D5C64823ADBF2CEAA1C5B777A8BE1D69326C14512B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794129, "uuid": "ae1bc382-4f69-4355-9755-2493ef7892b3", "value": "d63ab94f4bb6b5d2f0f6092bf07e00ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794129, "uuid": "e20ca32e-a526-4e45-ac68-d4e1bca90cbb", "value": "6144:/6ZMFXzqfoSHr/mvcQYbi2HN8C8BgifO7y7RcuVqrWLWN7Ypsi6Ih9vH0/oUHahE:/8MFX47ivcQMNsrD2KJjO69cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648794129, "uuid": "4c664fba-e6e0-4735-82cd-0bc8410b8831", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648794129, "uuid": "23e36179-6c7c-45f3-b395-a5a8e43c4f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794129, "uuid": "d4bd0dd5-f31a-48cd-86c5-de9fe5a3f85e", "value": "spring.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218cac3f-b1ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1648840115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840115, "uuid": "71f24d9c-4c77-4e00-9f5b-8c171206bbda", "comment": "Malware payload (N-W0rm)", "value": "ed555e4d30ad74a18fa05c1c182e157d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840115, "uuid": "1d3491fa-b2a1-49db-a893-7a8b2c9039ee", "comment": "Malware payload (N-W0rm)", "value": "680d3d516b0ef08572b192250d25ed8b15b56e0395014256ee9714969f95517a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840115, "uuid": "9b555ec4-6be6-4e35-8c3d-fa98f2ae1cad", "comment": "Malware payload (N-W0rm)", "value": "9fb1bb35178ecdebc177931f842eed25ea8915a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840115, "uuid": "ed7b78f1-0eb6-44d1-998f-0c8e81ce7cfb", "comment": "Malware payload (N-W0rm)", "value": "cb6e448aba300834be3fd73618f44206e89a29548918c68f421f09249591cb6fdd8039ffd0e6033f8b992362d0b4aa28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840115, "uuid": "5825e615-1c4e-4a19-ae2b-bfe368ce4956", "value": "T11674BE04B790C035F5B726F0497AD2A8B93E7AA06B3495CB62D916EE5735AF4EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840115, "uuid": "dfd5f4a8-3244-4dd1-a63c-055d068a1633", "value": "964afedca9f0b9cedb5d8473487bafd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840115, "uuid": "70e9033c-ebac-4667-a242-bc382d43648e", "value": "6144:9M4YR24Sh5FkuWDP9tTXvZQV2j0cuiuecX+bojZ6wc7n/3Dc0hOoDl1TO:9MT4/h5FkTDVNx+WOjYx/z1hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840115, "uuid": "ac5ea2e4-17d4-418b-958c-17754c5d7e36", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840115, "uuid": "133d642b-61ad-45b8-a186-5832b7306537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840115, "uuid": "a4c51502-efc5-4115-9d49-dbff1d73b329", "value": "ed555e4d30ad74a18fa05c1c182e157d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854846dc-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819667, "uuid": "7d05be33-875d-4469-bdb6-d19ddcde7ab6", "comment": "Malware payload (Loki)", "value": "4e1bbbd94b499c7686c41b79520ac62b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819667, "uuid": "0f201b23-0374-4cee-b97e-aa06de19832b", "comment": "Malware payload (Loki)", "value": "681db67ac9faff3c67891d75a0466c12a27784fd284265eb1a01c3b1d7b735fd", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819667, "uuid": "3d08f73e-fc77-4b47-86ff-ef695f3e5efe", "comment": "Malware payload (Loki)", "value": "5f027a786d8e891e374d6a51f8bc8989c7a6de22", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819667, "uuid": "3fce8c8b-e811-42be-9fd8-5d5996cceaf8", "comment": "Malware payload (Loki)", "value": "bb9d5d00f7de783810dec16fb6a5207a50b169aeea922576ec10c421e5ff41d9bef1579031521ccc3dfbf5d6440268d9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819667, "uuid": "bb26f577-03e9-474d-be51-2140c006bbee", "value": "T15A1402453321D840EB2072BEAF27E5381DA7CEFA5598AA78098177BC40F1B065FE5B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819667, "uuid": "bbcd2c43-cc27-48b1-b27d-eeaea58de48c", "value": "3072:MIAa/E3wljYNWS8/ICMLpJy03y7/NhUJGW+IT4gxdjQ9ujjiLitasJH0lj/J:7/E3IjYNayLegiVeGWPPHqmiLHNlj/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819667, "uuid": "22742654-27aa-48e3-a0b7-0de917447c53", "value": 191992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819667, "uuid": "d0ea0a81-b38f-40c2-b9b6-b47ca2e79f04", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819667, "uuid": "8f53b1ea-ff53-4281-85de-8745de66ed79", "value": "PO20-000333.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7510289a-b197-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802460, "uuid": "424cdabf-45f6-4c65-af52-6bd4f709bd14", "comment": "Malware payload (Heodo)", "value": "c15c737a0a3e7ea70a0361f3890d217e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802460, "uuid": "7340910d-1f26-47db-87d4-efd880389a7a", "comment": "Malware payload (Heodo)", "value": "68e120a46a4b69bdcd289938ae22caeb59a74125275926d767f76821467ef441", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802460, "uuid": "2fef11d7-9d85-4249-b2f2-4ebac709c40f", "comment": "Malware payload (Heodo)", "value": "71408332584cf2d9bd25bdbe675dabd7198162e3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802460, "uuid": "99725cf8-cd42-4458-8401-e99f53965f47", "comment": "Malware payload (Heodo)", "value": "42dd6e5d63a703d5ca5bf01f4618336ca3b189c186abf411dcc111e2b6fbe15d2f50928324c105039b5bd2a9a1adc52f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802460, "uuid": "8dc1722c-3c92-4d2a-bcb7-7c7a3d5432a3", "value": "T1BDE2B06AB3B1B496F2335C38854CC8F3561AAF829049B95A703D776FEA541BF01CF428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802460, "uuid": "c9f97913-0c40-4e49-9383-e07cafadfa8b", "value": "384:xupPr/nHYzzaivuTc4OVdgzq7apRI6ZIwDyWS4UyRMCYMVM7btUMLW7joHqgmJyL:Uqt2/OXWT+43SaMdbLWAy+IS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802460, "uuid": "2d07f1d9-55f6-48bb-806b-90c0efc83b75", "value": 32392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802460, "uuid": "1fad122c-af98-4609-887c-86f017c82863", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802460, "uuid": "fce180cd-28a3-4aa4-9427-e116d5f16b20", "value": "file_0104.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954b6c55-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648835156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835156, "uuid": "8b016479-6715-45fe-ba9f-9e39b08aa92a", "comment": "Malware payload (Heodo)", "value": "f5d66dc252327a66425427d22a009b75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835156, "uuid": "f7e2d8c2-ca21-4e8f-94b9-126abcda8ec0", "comment": "Malware payload (Heodo)", "value": "6a6dac28c6342ac11945fff9277d9d516ebcc7287c9eaa9af57a85c09f0190d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835156, "uuid": "36e1a4af-0450-4346-9cee-03d00da3e7f7", "comment": "Malware payload (Heodo)", "value": "289c22a262272ee446a4f0b0ca694aa5ae36d4c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835156, "uuid": "93317bb8-57f9-46c6-a2cd-288570b4748e", "comment": "Malware payload (Heodo)", "value": "10c46a52b4a9b1ea946f7be538bbff67fe309ccc8e7e784746e2696e72abe0b634e9581b8a7d8981832f0941335f1738", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835156, "uuid": "e3988e6a-2ec8-48eb-85f0-9e5fe1b8d986", "value": "T19F94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835156, "uuid": "d98f1b8f-e711-492e-a6f5-89029ee10634", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835156, "uuid": "4a012648-14ff-413e-98d8-aafed9e79b2f", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDXS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKvrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835156, "uuid": "e9f366df-7b3f-43b7-ae90-05d922f9d661", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835156, "uuid": "55e83805-cdb2-4384-8248-f9a69b57d6ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835156, "uuid": "0b81c2eb-ae7b-4e19-846a-265c825fe576", "value": "f5d66dc252327a66425427d22a009b75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42152509-b1a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648807099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807099, "uuid": "2259438a-d485-44fa-8bc5-9a295bb0b684", "comment": "Malware payload (Heodo)", "value": "6e3aef01d55c4b7e023707a733ca9dea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807099, "uuid": "6e4a8fb8-989a-4334-9e54-54bfb20db29c", "comment": "Malware payload (Heodo)", "value": "6c19418419ac7346986dd646ed51575293d154256b5ee3843da451981513432b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807099, "uuid": "6218b569-afdb-4e28-9884-15356975dce5", "comment": "Malware payload (Heodo)", "value": "942730b6c015abfe2486fa4ced9f2a1d46b79334", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807099, "uuid": "89d27ecb-2522-4dc9-b589-9d77e937955f", "comment": "Malware payload (Heodo)", "value": "d93062b366e03b0831a92b2935b6e3770684d4989b77edb49bf90ee568620cc8d71945517e5f1bebd1e96ee84568bcc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807099, "uuid": "636d0570-8819-4251-8c4c-662c5b5c03b8", "value": "T1E694BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807099, "uuid": "77a9c58a-9343-4f29-8208-0e761d1ebf3a", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807099, "uuid": "a0d9b4fd-b6a3-4948-8839-b4534bd69acb", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDtS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKxrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648807099, "uuid": "90309e51-fcce-4113-908f-36bcba427267", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648807099, "uuid": "448902c3-de3b-436c-b3f8-54512e97da39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807099, "uuid": "e064e491-31be-4ce7-86d4-9a3aff0c7bac", "value": "6e3aef01d55c4b7e023707a733ca9dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d4b5e9-b1e7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648836901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648836901, "uuid": "d1fec68f-e569-4a44-9b1b-d6b7e320b4f3", "comment": "Malware payload (Heodo)", "value": "67d4bc3bf1822774aa6fd48f208e4d52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648836901, "uuid": "e8aa3dc2-6a63-4d1e-9e43-0344eeea463d", "comment": "Malware payload (Heodo)", "value": "6cd8f40466354527afee64a8fb2d63ba74cc22ad141df92b1b2022c34f815863", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648836901, "uuid": "f89ef0d1-edf7-4d4f-bcaf-0d8634104510", "comment": "Malware payload (Heodo)", "value": "96507d92aa4873f9bced75846fe22eaa25177391", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648836901, "uuid": "23ca4566-e4d3-4c0c-b406-8dccd6014e91", "comment": "Malware payload (Heodo)", "value": "ca6ce206ac9ff6bf93e0ad5404a5c9600c2482d1116eec01c97086dc226e8e8a77b0d934b35a1a6e434b1c280031561a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648836901, "uuid": "96809150-de94-4272-821f-a24003165560", "value": "T18494BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648836901, "uuid": "9bb31441-0408-4120-b117-905f3fae7980", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648836901, "uuid": "354d3874-eea6-4909-8beb-1401a7544da6", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDyS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKGrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648836901, "uuid": "f6e9e1be-f81d-4b89-921c-06cf9d74d98a", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648836901, "uuid": "7cb69dbd-ff54-4aef-9419-7a47f3a78f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648836901, "uuid": "6f2f619e-a94f-4bb7-99fd-89f79a9e8747", "value": "67d4bc3bf1822774aa6fd48f208e4d52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e771505e-b19e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648805658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805658, "uuid": "b7961c93-d218-4414-808a-64098c63e998", "comment": "Malware payload (Heodo)", "value": "c69d1cc5cdb64fd4dce6c57311d784d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805658, "uuid": "c139a026-4b03-47c3-9baa-21d7a16efe8d", "comment": "Malware payload (Heodo)", "value": "6d10a8651c2893ed1943920d71d0449e19afcbb73a0ac0259f0ffed5c97c2db4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805658, "uuid": "aaf5e1d3-2d3d-43d1-aeec-f83d233bd466", "comment": "Malware payload (Heodo)", "value": "f4423ead0404441fbb7de42c9f733c1a6cffae27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805658, "uuid": "c900d772-d241-4fd6-8bd9-1a545f744b0a", "comment": "Malware payload (Heodo)", "value": "6a0250d25b6bcb81268e08eaea42254071af73e5de34efc1e617274ae1cad8ed6331b0b9060365438a1e3d1f50ffa167", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805658, "uuid": "54aea9bc-6e62-44df-95fd-200cd1b2fe98", "value": "T1FF94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805658, "uuid": "b990b0e3-ddf7-4e91-ab68-b73aa04c9366", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805658, "uuid": "297a6b2b-4786-49a4-8d0f-a60a8b34664a", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDkS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKcrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648805658, "uuid": "74dfc956-b206-4cee-a73c-a9d71dec99ba", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648805658, "uuid": "ff0238d4-f2fd-4c8f-a0e6-2e810d9cd0df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805658, "uuid": "69ed5bfd-d260-4702-bce7-d2f2633ac529", "value": "c69d1cc5cdb64fd4dce6c57311d784d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d66b6a-b187-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648795457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795457, "uuid": "36d19cca-0843-4f2c-8cdc-66247cc82ae7", "comment": "Malware payload (Loki)", "value": "dc7de178307bdbb6545e4376321fdcae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795457, "uuid": "594b1412-abd6-4467-acad-084f39ba40f7", "comment": "Malware payload (Loki)", "value": "6d485c67e307d4ffd8aba6c40a90cbd4b79ba2c35d4d08e6067d3eed4aaa551f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795457, "uuid": "39f9f332-a18b-400d-9582-4604e7cfed53", "comment": "Malware payload (Loki)", "value": "8f2d214c42d7a76c116b18967c362e02bc41282c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795457, "uuid": "c20e1b74-af9f-4c02-bd63-67b54c7d0eb2", "comment": "Malware payload (Loki)", "value": "477398401f7ced571250637706c742bc18a84758a9a663ad8c96b93e54256f746b5d9f6123dee7047ae528fe6761d4ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795457, "uuid": "12b36a0c-d709-4622-b8c3-e7dd3ddbfbbc", "value": "T15D34126953E1CAB7C0924B358CB69E6B2FE506122414131F13B09F947EB2B925E0E3F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795457, "uuid": "a63a12ba-5e93-4a68-b811-057c44aa4187", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795457, "uuid": "f022ff15-f87b-4a78-983d-e088ff86ddb2", "value": "6144:HNeZmR/h/lp5RsWPN1voNYdY5qazSKHxSNaoA1BScEOoA+xRB:HNlJh/lrmsroQYNrxSNjAzScMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648795457, "uuid": "be7325e4-4025-4b39-9d05-b011c96a3853", "value": 240261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648795457, "uuid": "99a6139e-76d4-4f6c-bd50-e94c52868614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795457, "uuid": "ecec64eb-74bd-480c-8863-4391e1f038b5", "value": "YLOADER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca27611-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648835195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835195, "uuid": "4c6ac987-c8f4-4824-988b-6efe24d9acfe", "comment": "Malware payload (Heodo)", "value": "95e6292971a5c5c8b3471fcffc7b1bd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835195, "uuid": "d6334ca9-11e1-4d86-9e98-d57d823e18cb", "comment": "Malware payload (Heodo)", "value": "6fbded23502e3ccde20a8ad4c95c4c6cec4870e37d0d15b9523eb9d2aa0ca44f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835195, "uuid": "a6548501-bc01-4421-9e79-d36001ca805a", "comment": "Malware payload (Heodo)", "value": "440dbff308f543537c23976fefa1597c2fc0c1c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835195, "uuid": "2860b12a-e704-431f-b538-2a6b2bb6249f", "comment": "Malware payload (Heodo)", "value": "721208eb0b370486d31c8b7223ee1df00cab615cf27532dd90cc8b6855e2ba2c8dcae5924837f596ccf91f131a1689f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835195, "uuid": "0fb02789-1265-4af3-9a96-b1ba6f93477b", "value": "T1A194BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835195, "uuid": "35831f71-2702-49a3-b79c-d3a92d1574a1", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835195, "uuid": "a8d34008-7ed7-48e1-bcae-cf88592598bc", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDYS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKgrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835195, "uuid": "2aafdefb-6c10-4b30-9026-498352780292", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835195, "uuid": "b60f37f1-af82-4576-a023-9aa4cc559288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835195, "uuid": "5bb82a68-35e9-42f9-8751-0c0df2cd33e1", "value": "95e6292971a5c5c8b3471fcffc7b1bd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fe9e31-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819455, "uuid": "dc619e03-0c8c-44fd-8f0b-ad718a2c12c2", "comment": "Malware payload", "value": "fd97fdb20a2238cfd5589bc05e14a80a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819455, "uuid": "7d56820f-e694-46b8-b67b-c9e2d0fa833c", "comment": "Malware payload", "value": "70bee3fa2bf61c13b1e94ab33d6ac070ef107085c10abb28ccb92e5b6449deee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819455, "uuid": "51e315f9-3c3d-488d-a0b8-73ec74653704", "comment": "Malware payload", "value": "8f2904556c18ec2ee11d839af287e40d1eb30a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819455, "uuid": "ac643e48-d96b-47d9-8cea-b140eab62e24", "comment": "Malware payload", "value": "e3898a72b662a0e9a24c5ef549840f0d38c423ac3e12713c040fdec919773c61fabad956b1b5c9af40c7c9afdff42d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819455, "uuid": "3446ca31-7685-4210-98bc-1afe93091952", "value": "T13D351220BA90C031F4B326F499BA57A8AA3E7A716B3091CF22D517ED5A757D5DC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819455, "uuid": "7a768163-74d8-4a35-a403-d4473bcc68e8", "value": "0ae6434a5f502e4848fb7a3df766bf78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819455, "uuid": "8c24d5ef-a99d-4065-8c39-c377bad246b3", "value": "24576:JIFEyZ4RLmi7d2iDxyREReIAlGro/gdRtsi8/PUACBowV53kNWS:JlyU9gSRtAvoDtsi8nUAKnVRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819455, "uuid": "1ee4aa3e-cd4a-41b4-bde7-73018084ce41", "value": 1122304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819455, "uuid": "f09a9833-65ac-45d6-8828-975346a78882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819455, "uuid": "4474ff67-1898-4ecb-bb74-8abc5cf58b88", "value": "fd97fdb20a2238cfd5589bc05e14a80a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f9773c-b14f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648771702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771702, "uuid": "052ee957-a5c9-4a20-9412-fa2771f2d365", "comment": "Malware payload (Heodo)", "value": "5c093101b50cbe0dae677f16c09597f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771702, "uuid": "ee3915fb-0306-4d55-a53a-f319db1a24b8", "comment": "Malware payload (Heodo)", "value": "70f52552f67fd8d5c63d5159e4ac3f13c42307db977d1617a07d114ecb096a30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771702, "uuid": "7ea2dafc-b7e6-4afa-8e03-3117793e3a63", "comment": "Malware payload (Heodo)", "value": "273deb1a92d0d41592f2ce2782a62536cce1e0e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771702, "uuid": "76f88808-bc71-4c86-b30f-b5e2708613a2", "comment": "Malware payload (Heodo)", "value": "4a1e54c210dfbeb085d132f22da67d7e976acdd940d3829e9a8f64f3e10ee23824dbff9a8c1df0876ee745e29fb567fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771702, "uuid": "cff47cc0-af4d-4789-b351-340f5801acac", "value": "T12FB4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771702, "uuid": "e61cd5ff-d53a-4967-850d-62ae4dda257a", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771702, "uuid": "33178014-80b0-41b3-aa6f-6c20b759135b", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQmJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzmDIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648771702, "uuid": "56d56d37-1608-416a-8fb8-a4f65dda51d0", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648771702, "uuid": "81fff61c-7d1e-44fa-b04c-cd2d244ea09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771702, "uuid": "bf5a50e2-c77e-4680-a6d8-679ba16aa2a6", "value": "5c093101b50cbe0dae677f16c09597f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b584bae-b18f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648798927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798927, "uuid": "9d162055-d094-4188-b10b-f06706e3651c", "comment": "Malware payload (AveMariaRAT)", "value": "477a6c4d40da66f42a55f93f554ea1a6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798927, "uuid": "79f99292-17ce-43bf-90b6-0d7fa07c9f71", "comment": "Malware payload (AveMariaRAT)", "value": "710092a3d3733568c12c36e742da685e70ac3aeb9a851974c6b07a3d5f1d74c7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798927, "uuid": "602e8c0e-de8e-437c-b6f5-639305aee52c", "comment": "Malware payload (AveMariaRAT)", "value": "f3e3671dd83d21bac01cd638ca41bf1c6a3f54a7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798927, "uuid": "5b08985e-ffb3-4164-978b-594d4cb8a00b", "comment": "Malware payload (AveMariaRAT)", "value": "13f4ef91d1d5bb521551aae12182a489029d1e9c712380da6beeee7433001f5401a165bc081411bdc01e3a5ef57cddaa", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798927, "uuid": "aa984ed1-64df-48f5-879f-4a734fa5bc0c", "value": "T10D15A062F6918933C0231A3BBD1FA6645436BE522E6475573FE43D4C1FBE68239292C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798927, "uuid": "4445a473-f090-4f04-a38e-70853c36bdc9", "value": "fdad361144afe229033565a59cbcac71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798927, "uuid": "f75ea8a3-713e-4f31-b217-b5e5d485a571", "value": "12288:cB+PnwfmejogYtFJpFulAJDtHTALKsd/mSf2pSgj3R+li9B8h2+pnwcBz:tweOYtFJPulAJDxWKUmSf2x9wSVEwcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648798927, "uuid": "72f4420d-287a-471a-ae5b-3d2731514737", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648798927, "uuid": "1ce524d5-b66b-4a0a-b53d-f1fa364c8747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798927, "uuid": "0a142dbd-cd86-46f4-8e57-d78158abb067", "value": "NOMA SP. z o.o._order_scan_4500066107.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdc0e5a-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648820114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820114, "uuid": "98146000-bfb5-4bec-a405-0690c346f439", "comment": "Malware payload (AgentTesla)", "value": "8a41051685f9b138aac8403959945ad8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820114, "uuid": "1a568b42-5eb7-424a-bf9a-7845ecc5308c", "comment": "Malware payload (AgentTesla)", "value": "715c05fa765322155caccdea95130f37a1a53589a26d476fe6331a97dbd24769", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820114, "uuid": "cdaae037-9af6-443e-b792-19e44eb39f19", "comment": "Malware payload (AgentTesla)", "value": "830527e90a1402802516a6780e5fd6969ca99f77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820114, "uuid": "59ff2a93-64a2-428d-821a-7784f59a8fec", "comment": "Malware payload (AgentTesla)", "value": "a29c0834689891f2bc071da205352237c6eedb6d09c235054faaa6ecfa630b716679f25a8596fc4c7dc0abd42f707475", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820114, "uuid": "6904fa1a-b7a0-4b41-b8af-2c071f9b1911", "value": "T1F115F15A3250759FC96BCD339A941C60AA30B86B270FD707A05726DDA90EACBCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820114, "uuid": "7822d2bd-9d67-44b7-b182-57da5b118496", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820114, "uuid": "94472b62-ff44-466c-90d5-eb97dc260655", "value": "24576:oluB5RbsMAzcoGChIb4CeWuLduUe6daMq:+8RbjFoNIbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820114, "uuid": "99e446e0-61e8-426b-8ca2-16e9a7dd0af6", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820114, "uuid": "05e1aa2a-8670-4b34-bd8e-99c8a5626c59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820114, "uuid": "795c24a2-bdec-465c-ac53-4b7480f7d624", "value": "DHL_Receipt10106272873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efb3191-b177-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackGuard)", "timestamp": 1648788706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788706, "uuid": "409c7e94-d99b-4494-84bf-7be687d90ec4", "comment": "Malware payload (BlackGuard)", "value": "bcb90ad9d64c26c3fc5d259a5fe57f15", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788706, "uuid": "f7357125-385b-4564-b4c9-4fe22d89fa41", "comment": "Malware payload (BlackGuard)", "value": "71edf6e4460d3eaf5f385610004cfd68d1a08b753d3991c6a64ca61beb4c673a", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788706, "uuid": "0cfb23b0-c917-4abc-a894-f34db1b13cc3", "comment": "Malware payload (BlackGuard)", "value": "b1d565021362259003da96566b46cf42566f1808", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788706, "uuid": "c5b6806d-d353-4007-abb5-93eb470a79b4", "comment": "Malware payload (BlackGuard)", "value": "7530e2a0885c83abdce257e0302fe6195d753e71441e57c82db3a5c4353d24e26eae1d58e550c19c9bda306d8832a2ae", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788706, "uuid": "fad3dc9d-d595-4c90-9de3-8ce239d09567", "value": "T14C752391BD4CDE37DABBA3B98461D7310A239EAE3A03C716A1D53C5BBD7A3500C06257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788706, "uuid": "dcaef562-0439-4b0d-9460-58a0cb25ce40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788706, "uuid": "94f66d25-7f90-4756-9672-f5e4817a0ca8", "value": "49152:PbNQ3b50szI5ONNabhEuYtBUU6FYg/wf89kAl:jNQK0IQjabhspgE89pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648788706, "uuid": "eda016cd-cc81-4165-b51d-6564878a8f6c", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648788706, "uuid": "1eecf0b7-c605-411c-a4f1-e4fa4de7a136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788706, "uuid": "81bbd363-a891-4d84-9bd3-a0e8a1dd79fa", "value": "71edf6e4460d3eaf5f385610004cfd68d1a08b753d3991c6a64ca61beb4c673a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e06f6e-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819858, "uuid": "ca529c62-161b-4c32-bb3b-fa427bbb7774", "comment": "Malware payload", "value": "0edd887531ffa35a14d011abb0cbd14b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819858, "uuid": "426cbd0c-d410-4f8b-8b44-36bc75b34039", "comment": "Malware payload", "value": "73ce552e4779dd51e87c7db93a57287d79370c6d65df566d4e85b58e3cfeca9a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819858, "uuid": "665f9cf9-552b-4f08-893b-2f50f9d148ba", "comment": "Malware payload", "value": "f202d93ec9aee1c292611d51e255f25aff137a97", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819858, "uuid": "87f3359d-a8e1-48f1-b50a-e426b5838b18", "comment": "Malware payload", "value": "66a2eb79501fb91f12219ad6c2c3ccd3493038db1141cacb5f8fce2cb57a4d23b39fcb7027ee8d2bb7d040e130a1432c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819858, "uuid": "c6873cd1-1fc0-4144-b94a-dda9acb90d53", "value": "T1ED464A27B644B63DC4AF0A3A5537A6189D3F677265229C574BF40888CF36880773FA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819858, "uuid": "4344b7a4-9105-46f8-8ba6-58d47c2dcbc7", "value": "98304:O65m2J7K5bRbzV/D1Agtar3IuuSCaGYOA:OWJ7KZRfV/D1AwqOSCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819858, "uuid": "b24d6946-7c9d-459a-a5d5-29539c1f7d89", "value": 5556224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819858, "uuid": "79f54414-d572-4d6f-a938-32393c9d98da", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819858, "uuid": "37bae1d1-b198-4591-a823-bdf1a7cdb54c", "value": "_4__wpbr.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db16ec26-b1f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648840856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840856, "uuid": "379252ab-7a42-4281-b7e9-945d3ff934da", "comment": "Malware payload (Heodo)", "value": "f8ce93557ffc95ca061566c85dbb1f9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840856, "uuid": "2a54d480-ec35-4acf-ae69-ef434069ff51", "comment": "Malware payload (Heodo)", "value": "7532a2ad18a0ba68ec6e90791cc3eaf7d72a77fdeb3a8c6b99628b7b960bb9ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840856, "uuid": "0fa34d44-5631-41ae-aa1e-55549cc61693", "comment": "Malware payload (Heodo)", "value": "2415d2892851fedcd3ddef3231e01541941e5cec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840856, "uuid": "ed36625a-ed91-443c-9edd-12ec8e430c8d", "comment": "Malware payload (Heodo)", "value": "6e70fd8a7008608ada9d1de55e0d4c409c42e898a251d70fcc5d758c17b234e5ecab7887add24b5c5a4a71f5e6c68fa8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840856, "uuid": "43d7fa27-a6d1-4844-807f-f5b300316b35", "value": "T160F4AE1231A3C075DEAF11744A566FA9A6F9FA146B708DD3A770CB3CC9309C68B36217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840856, "uuid": "482032c1-9570-4f94-a1e9-b077f44a3b4e", "value": "078cf8e17700d87242408b8588acd2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840856, "uuid": "af7ef303-5eed-4715-a013-64a1f1f44004", "value": "12288:y7pLgbqIjZbwqHUM6AytrYj2azO8BOg1s3F2r/:y7ssqexYtzbO53F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840856, "uuid": "bd8671e3-d007-4674-bd86-68143877f383", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840856, "uuid": "ff3247f9-ea03-480f-8fdf-da9d63fa800d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840856, "uuid": "efa48085-a3e2-40af-9cb7-240e5be23686", "value": "f8ce93557ffc95ca061566c85dbb1f9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc56bcfe-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819357, "uuid": "3afa5fc8-9206-42ea-9407-f5d0c1ec07d5", "comment": "Malware payload (SnakeKeylogger)", "value": "0f8d39418c8b558d6b8b1bc4208c6a1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819357, "uuid": "481afc75-78f9-416a-b745-297e8d747b5f", "comment": "Malware payload (SnakeKeylogger)", "value": "7581aebd19ad66ba4d0c161657950ebac525aa25e4ca24bf08242812a0da3d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819357, "uuid": "04960f47-8e9d-4e6a-abde-f4139e74c51f", "comment": "Malware payload (SnakeKeylogger)", "value": "041aa82e84aa1de66af44006bfe1bbfb0a1eff2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819357, "uuid": "34068f04-aea7-4b2e-8f6d-7c98e6a47b08", "comment": "Malware payload (SnakeKeylogger)", "value": "c54882669955685be4ebdcd33aab53128ce1d7c507a147538f16b7c24c46f4911583b2d8d47cc016a7a2c4b5b8b02e02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819357, "uuid": "ababaa42-2651-4f4f-8352-49b2b10c2c4f", "value": "T1FFC3281D3BF88804EAFF8A7315715121C7B6F852056ACE1E1AD1F5592E3DA808E26FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819357, "uuid": "cbb05875-29b8-4524-a0b1-7215e3cbb43f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819357, "uuid": "84fb6cb9-6dd1-4b39-8cb2-d9b64cb84a3f", "value": "1536:Ja4ZERmnV9aSOW8YOk9TBbW0LnOOOLb/6fJT9piOWBZjn0Kcl:Ja4Zxn8Y19TBbxLnOZLbCpHwBZjnbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819357, "uuid": "83ef1f54-11f4-4c14-90e5-953d7e77d223", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819357, "uuid": "cf9d8b10-d0e2-47cf-a851-3e2004192dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819357, "uuid": "64d10a81-264f-4a33-a75d-3cebc39ad8d2", "value": "0f8d39418c8b558d6b8b1bc4208c6a1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d65cd14-b1a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648806635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806635, "uuid": "27ed7569-8ae6-4600-9228-7a9c89965af1", "comment": "Malware payload (AgentTesla)", "value": "2510b49f893787cd38a9721d45722313", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806635, "uuid": "4cb02172-3048-4dd3-bb77-c3f8d7978a58", "comment": "Malware payload (AgentTesla)", "value": "77429d7f0166bf98c0d4023a42a95bd3bfd45a9dca38aab4b3a05e29a18a3871", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806635, "uuid": "2c5d8fee-4026-4a0f-a956-b673fa20dac3", "comment": "Malware payload (AgentTesla)", "value": "b34bfefddd2ae9fe01ceff41f80e2a4d12333dca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806635, "uuid": "59520669-6c32-4c29-abd0-e3375b64054f", "comment": "Malware payload (AgentTesla)", "value": "d3d97214a8b1a76786566f2729cc986bd980663575633fa5e45afb48ec236e9d3731b80fb009ed2cef61d899fdca5ad3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806635, "uuid": "dcb69feb-5f54-4a4d-9e2c-918a71776193", "value": "T124C423D82EA1B26599F35C2B8F461BA337CEF79D19073DD0B958F1763A891619B02CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806635, "uuid": "469b3122-2962-4f10-91c9-88c038d79aa5", "value": "12288:mXkuFs87cGqWD1MccXc7uT8nfBHZHgWm7ZMr9VA+x8FuG0dX6hHl7qdQ8qX+:mvs84G7D1McWPGfBHgOxrqUEHl7qdDM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806635, "uuid": "a41b9883-f316-4614-b268-827344706cc1", "value": 573430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806635, "uuid": "22c2ed95-47e4-43d7-bb8d-53efc7f1a1e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806635, "uuid": "d552906e-d1e8-45f1-b659-7bd82fad93dc", "value": "PO # 7800017872.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29b0154-b1c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648823286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823286, "uuid": "692f5882-8bbf-4e33-b71c-64ab28bbba99", "comment": "Malware payload (AgentTesla)", "value": "2fbc9d7bb85c74f2cd3839132b10e4e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823286, "uuid": "934f2453-cdd2-46ed-96fc-d96e696ea9b7", "comment": "Malware payload (AgentTesla)", "value": "7817d24ac9fa9ebe89664fd87eaf065f6e71a977bfe14154924c98a596ae6e74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823286, "uuid": "1d070537-2613-4386-9d4b-cdb1ead24606", "comment": "Malware payload (AgentTesla)", "value": "aa4bc13061b5ba42d57c1da070d28e0cc8771128", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823286, "uuid": "d215dfa5-1966-40e8-b980-8f4ab6e7f488", "comment": "Malware payload (AgentTesla)", "value": "6b535816ee6cd9eef5bef0635b8f6beaace81f3ec14e67ccfc8d725cc6ae6dcad20f3ee518d78c968a2c847a9f90026f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823286, "uuid": "0b087746-edb1-4816-84ec-ad13654bb3e8", "value": "T115D4022DBBA5CE13C6A457F6C0E3451013B6A3869633DB8E2CC913D98F563931E89787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823286, "uuid": "1b51d34b-c62f-4c93-b471-03a991f1985e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823286, "uuid": "c16fa692-97b8-40c2-81f5-0f396e69eb46", "value": "12288:gsTS/LtHkRW7kFCPrmf7C7I2L1/l9UjeTrOOh3QuWdhHVSgPG:hS/L+8VPqDo3L1/l9UjeTrdLW7HVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823286, "uuid": "551b8b1b-b77b-41de-a757-94c7b692e037", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823286, "uuid": "e5b3f1a1-8c6f-4464-9816-226511bdb68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823286, "uuid": "7a2f6906-26ce-443e-bc02-5f862412cd4d", "value": "2fbc9d7bb85c74f2cd3839132b10e4e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4aab366-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648835208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835208, "uuid": "08ed46e0-915c-4bdc-91c6-4d989dbf5f90", "comment": "Malware payload (Heodo)", "value": "2dbe7a1457bd257cb9c0707a3075b8ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835208, "uuid": "21b9de02-3baa-4f20-8482-fb57ee1cc183", "comment": "Malware payload (Heodo)", "value": "7842265c7fa8e6c0028648bca8cf67cee8759d09dc31efe2ddec5a7135b15214", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835208, "uuid": "830e18be-c638-4349-b573-a4cd38073064", "comment": "Malware payload (Heodo)", "value": "588c9658925cd2c576c82f8023c3e38a9ba9337e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835208, "uuid": "dcd30521-8855-4b6b-998a-20202eaa374c", "comment": "Malware payload (Heodo)", "value": "e3418eef11ac5312c44c210873b649ea34064d2fb4b880b3c88e88b87c1f8879542543d5c2bdc8d5330016ce373481d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835208, "uuid": "0cbb41ee-13a4-46b6-9c8c-dda310b894f2", "value": "T11194BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835208, "uuid": "0f1441ef-fd01-4b69-8078-b7eb8c1a0e6f", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835208, "uuid": "7c3e1179-a583-48ec-af99-991a7af740d8", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDdS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKxrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835208, "uuid": "6d4cbe72-dcc2-4fec-b49e-af72fa811c8e", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835208, "uuid": "70ca5549-59a4-474d-bea4-cad5932d3a4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835208, "uuid": "958ffe08-aeb4-467f-8c65-6f5e5952d08a", "value": "2dbe7a1457bd257cb9c0707a3075b8ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1650080e-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1648819481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819481, "uuid": "80a63065-9970-4b3c-a60a-483150287065", "comment": "Malware payload (Amadey)", "value": "f34ad3cb33b7e41126e45906e4ddf6f4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819481, "uuid": "1d999f59-6290-44ee-9e2a-1677acecebdf", "comment": "Malware payload (Amadey)", "value": "787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819481, "uuid": "63349c4f-99b0-4c1f-a329-21111ba8c05d", "comment": "Malware payload (Amadey)", "value": "a86d709c56ee2f5b42b16a99a6c6ee6b5edfb5f3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819481, "uuid": "e2fd145b-a2da-44bc-9d0d-da7220e9b854", "comment": "Malware payload (Amadey)", "value": "f69a0cd4d7e92b7813cc21c32940f920ae9eb619228c15e8c750dee786eb6bdfd90f301765e53ffeb2428192d240dba8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819481, "uuid": "a237bacf-90c3-4479-bd09-7b04d9c04504", "value": "T16C448D10B7A0D035F1B767F489B99368793EBAA15F3491CB62D516EE0635AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819481, "uuid": "70b852b0-b26a-472c-b7dd-fc5d3c5bf9f5", "value": "0ae6434a5f502e4848fb7a3df766bf78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819481, "uuid": "c1353345-0df5-41c6-b232-3722a44f0994", "value": "6144:5H6xzp5CPCopO7N9QpXcvLdBjSQjMRvVa:5H675C5pO7PQopB2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819481, "uuid": "d401c38d-3dee-4c00-9c19-34298d67909f", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819481, "uuid": "60bb2fd7-6146-4b62-8c83-7f2a43cfc6f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819481, "uuid": "1487b366-ca0d-4bb0-8176-6ef8f6073c83", "value": "f34ad3cb33b7e41126e45906e4ddf6f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634c047a-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648819610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819610, "uuid": "578a1e06-374c-40f0-8371-25144da142a0", "comment": "Malware payload (AgentTesla)", "value": "5b69a1b4ff4f52da3a111a21c5d6f509", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819610, "uuid": "268c97a5-0d2f-4446-bd83-6c1e345cc8de", "comment": "Malware payload (AgentTesla)", "value": "7a0850bd585a53a59fac7f6f1c05f4c2cdc796302ec776fe51ec076a20fc6b79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819610, "uuid": "5b8572ed-1508-482a-9179-4c0e0681b934", "comment": "Malware payload (AgentTesla)", "value": "6fa031fcf2f0891acd77ec99e12712307378857e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819610, "uuid": "e7c7b14c-0b6d-46a5-9529-e3ffc0da5948", "comment": "Malware payload (AgentTesla)", "value": "29685368c0e7f2cad4508158227fe61a1317d4336d2a885089ccbcb53e59cf8c70b5c2e002dc85a5da0c31e9a9ae6c46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819610, "uuid": "97aadba8-de55-4a95-b1ab-2e63884231d3", "value": "T15F1412047FFC2A01F56CB9F8AA715619AA7DFCC7A8ADD9A14074B7CEB0721F210095B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819610, "uuid": "1ecaabf3-6c70-4bf6-a210-2a67dc6c71e4", "value": "3072:U0uE/kcqU14dK23CbY08HW+HqHSVsrDLDnrW5Vv0VHtl:FR/WU1Sv3CM12CqyKH/8p0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819610, "uuid": "820d934e-d9b7-4abd-b2e9-e3bbae77d91d", "value": 191736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819610, "uuid": "b93d576e-e5c9-4f19-82f8-bf1adf08e80e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819610, "uuid": "b0b32939-76b9-4721-b245-84e95156979a", "value": "New PO-8372929.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f8d015-b1df-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648833380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833380, "uuid": "a32ff3b6-f69e-4182-8658-69d11bc94933", "comment": "Malware payload", "value": "53f25f98742c5114eec23c6487af624c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mantas", "colour": "#FB8807", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833380, "uuid": "ef0068a5-a3db-4b54-bcd8-f98ff100fd09", "comment": "Malware payload", "value": "7b5dec6a48ee2114c3056f4ccb6935f3e7418ef0b0bc4a58931f2c80fc94d705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mantas", "colour": "#FB8807", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833380, "uuid": "9fbd675c-69f1-4bef-94fe-1ef9523356b1", "comment": "Malware payload", "value": "671af46401450d6ed9c0904402391640a1bddcc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mantas", "colour": "#FB8807", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833380, "uuid": "767dd2bf-ac15-4141-9c4e-b36f4f2ad51e", "comment": "Malware payload", "value": "e31ae6f77c82d5eba9a965a74c1e7ca877f812017f18bcb2f5749b56215d6e0300130b717127a64a3932d82462c1e364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mantas", "colour": "#FB8807", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833380, "uuid": "8dbef1f0-9530-46bf-9dfd-29d3a843a6f6", "value": "T16803015FF0411391D05B85332526CC11C67A063C23E1AB28AD679DC63CBF2FB6AA7C89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833380, "uuid": "126ef009-120a-408a-af65-d5fc4df8d9ae", "value": "7d10ef598e03b70a0524d3e86be9dcad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833380, "uuid": "e349f35c-fe1b-42ad-88b2-7e62032cdd5a", "value": "768:rz4RBkfbi/FG9Of8Ejex0a6zALVlXt32KtYFPYA3HxAnIIGSEsu:4Ciw9a8EG05zMt3jKYA3xAYns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648833380, "uuid": "7f001ef0-1861-45c6-86ae-f452fdc56102", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648833380, "uuid": "a4c66d09-90ed-4501-b0f1-7556ffc52f96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833380, "uuid": "9f20047e-f595-4f9a-8d96-186ab078866d", "value": "P2P-Worm.Win32.Mantas.a-7b5dec6a48ee2114c3056f4ccb6935f3e7418ef0b0bc4a58931f2c80fc94d705.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7b7bb3-b1a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648810205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810205, "uuid": "9aae31d2-cd11-4982-8485-b499bd0be0e3", "comment": "Malware payload (Mirai)", "value": "369d91ef06c04bc5d750e7b9f17da9f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810205, "uuid": "f1e0f89c-9130-499b-858d-6c62866e2041", "comment": "Malware payload (Mirai)", "value": "7b80ec16ca9a278a3d1b9a1d7d3abfb42758b7226ebe6e37933deb4ce39cce2f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810205, "uuid": "e36cd83e-95ff-467e-9b92-074d539e33f8", "comment": "Malware payload (Mirai)", "value": "248040b9b8d69cdef8d64d32c09e44f086b9e00b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810205, "uuid": "604c5d22-a14b-4bbb-a290-7d4c2797f933", "comment": "Malware payload (Mirai)", "value": "1395b78277ba981744c447dcdcae2af3685fc887d9f41c960c3a674f566c97e2f4c5affc892fe77a4cb98b9ad66f2118", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810205, "uuid": "aa472e7a-5596-4379-8bb5-c9025668ce64", "value": "T1754301454A9B35F7F2705E739E71C085726A1B34CA279081BF06CBFE1ACA4D2069EDD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810205, "uuid": "8694557c-8eb7-49c1-8d77-eaded33222b4", "value": "1536:AcukfmqKv4yTsqgUG4Jp4wU7+cl39IM3/l:VmqJ+sDUbp4wQ+cYON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648810205, "uuid": "5596c854-b946-4c25-ae61-3f5fbf5610b6", "value": 59752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648810205, "uuid": "26dfac15-cd8f-4efd-943e-54ed4f892483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810205, "uuid": "da0b629a-f233-4fcd-be15-33aa4b16460c", "value": "xmogum.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094aa4e1-b1ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648840075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840075, "uuid": "8e8e4a9a-9cbe-4fdd-8d56-649bb2fb2d31", "comment": "Malware payload (Heodo)", "value": "17cd1b662aa45ede908a2b9061a3c4b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840075, "uuid": "1aba8f05-32dd-458b-9923-ea604e720f1f", "comment": "Malware payload (Heodo)", "value": "7bd3ab19f5a5a8034933b2fc0f105370dd59b82bca96e4660eb4cd3551d88987", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840075, "uuid": "5a3ca590-ed10-47ee-b6a7-0ffc70f147bf", "comment": "Malware payload (Heodo)", "value": "6fd2f9632d56b0632257780491ffe2d04051fc5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840075, "uuid": "d30d5bf4-e0e8-4a47-ae91-e687c5307555", "comment": "Malware payload (Heodo)", "value": "abdab4d8a9ed9560d9d6920aa9cb54b05b07eeab9421c921cfff95f4632166a437fd72f378c4a06c1c6cd4165f77761d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840075, "uuid": "402490d5-4bfc-4bdb-bf5c-53c8da2c6ba0", "value": "T14594BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840075, "uuid": "faefe64f-29d5-4e8b-9821-c58043015cf9", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840075, "uuid": "8c0cf969-aae1-41d9-8957-c761f6deda73", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD2S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKirsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840075, "uuid": "1004d26f-1f8c-4b63-9495-6fabf5d3080b", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840075, "uuid": "33f0f32e-339f-4c91-9389-29cac84a5dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840075, "uuid": "6e2887de-f335-4469-80f6-e36946484d6b", "value": "17cd1b662aa45ede908a2b9061a3c4b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c99d031-b1e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648834175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834175, "uuid": "8cb934b8-f98c-4a12-948f-713ba1a59916", "comment": "Malware payload (Heodo)", "value": "1b23c6bae25203d17e6a90eaa4a758df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834175, "uuid": "8436f574-0862-4452-8565-db159daf511e", "comment": "Malware payload (Heodo)", "value": "7c0e33a5e4e00b3be8e703474e9e9088de96d66e6cc2d85d0fbc83ab1ad79da6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834175, "uuid": "6621c690-1379-4685-975b-57db8d219ad4", "comment": "Malware payload (Heodo)", "value": "66e208a6aca6ba2e412be45370e2e957d2b7b688", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834175, "uuid": "99f21cc1-968c-4a7c-a013-c0a8f50c616d", "comment": "Malware payload (Heodo)", "value": "76e04f0f6581aa9863088609557848e0b93518590878a976fa99840a12e0db84fc56921ff6a3bf97644cc77552edaef7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834175, "uuid": "e1f70392-0245-4fa3-ad77-a4b5deb34fd0", "value": "T132059E0675E18477E2BF01310E66777E67FEEA504F205AFB23909A8D4971AC24E3631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834175, "uuid": "c367335d-038c-4182-a666-1be21bc97ab3", "value": "2d2fa1ca6236044d56cef7b752fe5a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834175, "uuid": "0bcce0d0-d589-4054-9269-9a5959c76b48", "value": "12288:OBOHvWMwoyDdgp4W5dhdu1sRcwA8b3UHv8qDznxN6t:OX/RgaW5dhk8oHvbzn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648834175, "uuid": "0db8bcda-e005-4a53-8f76-18efa3856dd4", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648834175, "uuid": "7b233242-e683-468f-b7f6-f47e7d8bd656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834175, "uuid": "8f445763-91d7-4e96-a643-4257a4485edd", "value": "1b23c6bae25203d17e6a90eaa4a758df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205f7092-b196-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648801888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801888, "uuid": "344cd9a0-f7e4-42a0-b1fa-ae9587f7e975", "comment": "Malware payload (Formbook)", "value": "ec0857c5de44ed1abc78ac9c0b30a049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801888, "uuid": "476a2671-51ea-413e-91af-d8fd945a04e4", "comment": "Malware payload (Formbook)", "value": "7c2293123941debd43ef19cf3a09a103905f5ef69294b2ec61361fa7a8c88ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801888, "uuid": "f0dca291-611f-4f4a-9df5-a467339738f0", "comment": "Malware payload (Formbook)", "value": "2c26689786dae203e00e68758123307a6f5fb708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801888, "uuid": "c2179af8-10e1-4982-8cb6-d347de7f30f6", "comment": "Malware payload (Formbook)", "value": "218b2b1aab88f9be99b92bc3c7d039984406b60ce6a80645b6a7b0eb19284e16f5e827bd876412754c5a8982d5f7ff0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801888, "uuid": "07d536a3-f5cf-4958-ab12-1dfafaf53f33", "value": "T13A34120272A5C57BD1E303330E3B4AE65BEE540635E04A6F53540EAA7D32ED1ED2E792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801888, "uuid": "a02932f9-2ad3-47e3-baa3-03527fc6a806", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801888, "uuid": "62c6adc8-fe74-4508-ad0a-5102fa7114ac", "value": "6144:HNeZm4Bi2NzfHvBrhdevNFy3FRplinz+BChIGxqwF061d:HNl4BiIJh3Foz+BCiAu8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648801888, "uuid": "fc112402-cc86-4cf0-90bf-c0c3c0ab88b2", "value": 246486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648801888, "uuid": "a30a1964-17d7-4ecf-8741-3ed64958aecb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801888, "uuid": "faa39729-12dd-473e-b5b3-2a0cdc09c455", "value": "MARCH SOA$22,00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd9e8b4-b1ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648840108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840108, "uuid": "196724ff-3769-4fd4-a6af-d8249308030d", "comment": "Malware payload (Heodo)", "value": "8f310bf68014f4698514af8d527e2055", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840108, "uuid": "09121c3f-f401-4b2d-a930-6b21d1689dc7", "comment": "Malware payload (Heodo)", "value": "7dc26a72283a72e8237abda2701358a6d4b4dab1a2d6738bd3b2403a6228031e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840108, "uuid": "94292de8-c033-4475-8c34-3f86451551f3", "comment": "Malware payload (Heodo)", "value": "048e059a4e28cde7c6a1701932938c4c6140bdfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840108, "uuid": "dd4eeba6-7a38-417d-aced-880d7d79ab44", "comment": "Malware payload (Heodo)", "value": "38fed3eff424ca00ce85de7321563bac2e86c644ae46f2f33bd452a0a41892a3635c7c25cedccd508d718943ef00742a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840108, "uuid": "b9133429-8a0b-4797-b5f7-e814c69674bc", "value": "T11E94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840108, "uuid": "75b2feb2-9ff4-456e-896c-a854a42339ee", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840108, "uuid": "9cdc91af-f2c3-4bf0-abef-fa19eca7bb5a", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDoS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKArsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840108, "uuid": "f9c4e5e3-7c4b-4089-8316-94fee405c0f7", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840108, "uuid": "9b32ca1b-58c6-4fa5-854e-61aaafa0a6e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840108, "uuid": "98b7dc43-3472-49a4-afe5-08e784d022f1", "value": "8f310bf68014f4698514af8d527e2055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2195fc-b1e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648834150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834150, "uuid": "ed3da859-b037-47c3-8475-7d59f62d0e04", "comment": "Malware payload (Mirai)", "value": "7d244e7bf48d6631b588cecae87e759d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834150, "uuid": "7befacb3-7040-4178-a076-e45bc860ddec", "comment": "Malware payload (Mirai)", "value": "7e3572c745355bec830e08a9c0283331a1ac5e172dffd06cba5ab3dca776ef96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834150, "uuid": "9d75782d-d3b2-4382-9d8b-a209ed2d6609", "comment": "Malware payload (Mirai)", "value": "cc06cfd75c530e5259e1efb579ddd36fb8f44a54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834150, "uuid": "caa0442b-4f59-4bb1-b304-8be6b345952e", "comment": "Malware payload (Mirai)", "value": "541038789c727b3f0aca5b13561e78e9edffdedb4693ed5c6260446e8ca56de2df80d21a4798cdf3170233643d57a041", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834150, "uuid": "201680e2-954f-4ac7-a68b-a33f19faac62", "value": "T1EF733981F98B81F1C8078838609BF77FDE31E5A54171AB5DEFA95B32D923202620779D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834150, "uuid": "127b1ef7-0b8a-4b59-91d8-a702871c13e2", "value": "1536:hSOLooIDD2U5pTvN2NYr3nX3CW/AAQj/jYGs3ecvlK24:Uyo7DCU5d3r3nzI3j/jYGsOcdKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648834150, "uuid": "9e874f99-51d4-42fa-8244-acf34d2268f2", "value": 74900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648834150, "uuid": "2821afaa-f1fb-4414-827d-c5532d160077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834150, "uuid": "e0ac08b0-d3c0-4497-8357-0f88324e5e46", "value": "7d244e7bf48d6631b588cecae87e759d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63725e41-b189-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648796417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796417, "uuid": "c22f93d2-1666-43ee-8be2-9d393cd22f8e", "comment": "Malware payload (NanoCore)", "value": "c704e6e7e33edfa9f8deb76748a6bd8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796417, "uuid": "6d567aa1-ec53-4d7a-a447-b8ee3f42ced0", "comment": "Malware payload (NanoCore)", "value": "7ec2ef21dfcf5a4d0f89e96cb79d56276a57311e80d95b7200ba66925c7efa05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796417, "uuid": "64653fca-432c-4f20-9c1c-93f0e45a0dc6", "comment": "Malware payload (NanoCore)", "value": "c16c0e34025cfb99f0a353366230460eca48643b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796417, "uuid": "ac28e1b9-e403-4818-8652-e9d8a76c63be", "comment": "Malware payload (NanoCore)", "value": "5c2fa070ac08ec48190440aeb6a5f4272f377aabd0362e39e9c3af97a096c8e77b43f36a0a4c78f63befd74ba48ce67b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796417, "uuid": "02b57c74-053e-4954-8d64-54ad55c3cdc6", "value": "T171E4220175784137EEBA97F994F14208A77CE6667740C78DBCD221ED19DA3C60B823AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796417, "uuid": "f13ee3b2-8ee0-4663-aa98-652675b6a10b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796417, "uuid": "76ca6049-4c2d-488d-8a60-bfdc6077ad24", "value": "12288:KkTK8TGao5M0P/3nb8psRRyXm0P4WnS5uIbz3BmJRmsSHcTp4SVuk499JIkC:5K8TXoJ3nb4TW0tS5uuz3FsV4AQJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648796417, "uuid": "b18ff162-e281-4995-a1ba-557b3c5a06c9", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648796417, "uuid": "403e9d38-a682-445e-8d67-aaceb710e761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796417, "uuid": "d7fd0d95-a43e-4eb3-a93c-fc1bd1401979", "value": "QRO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05063c18-b193-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648800554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800554, "uuid": "89da032d-3c3c-43e5-be26-6d94910a8c61", "comment": "Malware payload (Formbook)", "value": "b5dfb60f376cf8c645a02a1e73ad7baa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800554, "uuid": "bc2843c3-a04f-4ccd-b622-589d75f25e76", "comment": "Malware payload (Formbook)", "value": "7f158db888d61f73d7ac828b40d956d0c28c83da5a2b64b5ec7dd6c249444a02", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800554, "uuid": "89e07f55-041a-413e-ab7f-113b970e3329", "comment": "Malware payload (Formbook)", "value": "ddb6a0e8cee041696c01d0c016ece2402a73ae78", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800554, "uuid": "86e2e705-4242-49dd-a967-8077064dcc8d", "comment": "Malware payload (Formbook)", "value": "64780b35b0599c54c0169c8ef7d27554829d358e025be8c4cb0875c332c08cd91c186474e1770affaac6e655538f3522", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800554, "uuid": "2ac666b3-e184-4340-a355-c0c0c2b5a067", "value": "T1011402CC3FA841B9C6DE3979546DA1284DAC8DDC90612C3737E9364502FF98A48369F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800554, "uuid": "10e22457-ea5a-43be-8d16-521d87781980", "value": "3072:5w39HOuYpYngY3XYtiD1uytrmD1apJEFQ46PT4Kh1Qw8StsHXMewRY11LR86Aqyh:2HOsngY371uDDMvE6NrlQVS+HXM4lR8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648800554, "uuid": "24ef54cd-ea78-4f75-afa5-e78b0184a17f", "value": 191880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648800554, "uuid": "950a6c56-4202-4888-a71c-c39cc99324cc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800554, "uuid": "0afef79f-7f6b-4120-ac49-41357ce9a0e8", "value": "PO#2022-0874.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3de732-b177-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackGuard)", "timestamp": 1648788780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788780, "uuid": "8abc1b26-21af-42df-8c31-c24d2b2338b2", "comment": "Malware payload (BlackGuard)", "value": "29978475551e7ca94eac65ad06afb6cc", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788780, "uuid": "890905f3-0d53-4733-a0d4-3b113a47f253", "comment": "Malware payload (BlackGuard)", "value": "7f2542ed2768a8bd5f6054eaf3c5f75cb4f77c0c8e887e58b613cb43d9dd9c13", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788780, "uuid": "200112be-f98a-4d3c-a749-e7f467fa90a4", "comment": "Malware payload (BlackGuard)", "value": "581eb855be9da7d25a000737cedc0b9f7aacee03", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788780, "uuid": "b657c097-0801-47f0-9588-a9836ec0fab7", "comment": "Malware payload (BlackGuard)", "value": "97aafd8a53b68786ae84ef8bde5fe004fc4f8194a61aaa20f050a07df8f56f83231be0fbc2a063fd0b1b4fe5fa3dd618", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788780, "uuid": "091f0b0e-31a1-459b-bd4e-a291ea4762e2", "value": "T1D875233C6E861915D67F8EB3E8E070984BEDAFC36850C286158131DA5D71B85EA83E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788780, "uuid": "a1fe1779-d0d6-4c83-b534-159e9130a941", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788780, "uuid": "d60b0490-817c-4743-a779-560ebe3c26e3", "value": "24576:/NXaV9x4IUgs36BUI2So5+jnzFEmM+JJ1XO32Zj3YsDClQhvo0:/0T+Sk6BU7HIFE7+JJ1M2J3Y2phvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648788780, "uuid": "8b87b759-173a-4b77-87e9-f23374854c14", "value": 1686016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648788780, "uuid": "6361561c-2393-416e-a56d-75c5365410bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788780, "uuid": "fa4b489c-43f8-4fa1-a7d9-4b7175ad8a1d", "value": "7f2542ed2768a8bd5f6054eaf3c5f75cb4f77c0c8e887e58b613cb43d9dd9c13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc94acd6-b1a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648808647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808647, "uuid": "a788774e-f714-444d-bf6f-cdd3f6e08984", "comment": "Malware payload (Heodo)", "value": "1db00e58dd8fe1a390b87967a770e96f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808647, "uuid": "cdf0f3bb-baec-47e1-acd2-8402785e1a3a", "comment": "Malware payload (Heodo)", "value": "7f4921210c97d5e02136ecb51955158849f6f26561e1f9c41c3f7fd35e6717a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808647, "uuid": "84b617cf-170b-4d15-9d90-e2048bd87ef6", "comment": "Malware payload (Heodo)", "value": "81856f21bda3889bcac867ecced057186b398afe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808647, "uuid": "1669fa76-4eb3-4912-aec0-880734e9eebb", "comment": "Malware payload (Heodo)", "value": "899540f5bbb095cbeca33873df9ba436267b6e9ff3bd158cbdc7812dd1f601b52bdcee5081ae27f784a0316750f5675d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808647, "uuid": "cd74b31a-9a6c-4ded-8200-8339b81096b5", "value": "T14494BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808647, "uuid": "fc67789e-e42b-499d-af6c-4984d3838d3f", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808647, "uuid": "287693d5-25a1-4f64-aba5-06abdf0c1219", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDFS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKJrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648808647, "uuid": "54b962d4-c792-4399-8fd1-8b944f5a8b4e", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648808647, "uuid": "6d0e6bd3-d8bd-4414-b958-f4dd849b49b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808647, "uuid": "27868c03-5c34-4dc3-bc19-0af62f1e0630", "value": "1db00e58dd8fe1a390b87967a770e96f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076242e4-b19b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648803994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803994, "uuid": "40fb4d89-ffac-435f-96f7-a331a77f874c", "comment": "Malware payload (AveMariaRAT)", "value": "402acc085e31266118f8c32be2018d69", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803994, "uuid": "e3f793fb-0e98-4962-b1a8-6344e10e0106", "comment": "Malware payload (AveMariaRAT)", "value": "7f7100d9f3b590edf049235f41916b96888018af41a78f4fddf3d0ab0b05c0b3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803994, "uuid": "c4bd4915-f29b-4c42-b71f-f607019fe336", "comment": "Malware payload (AveMariaRAT)", "value": "12a3b9294c9e70fafadc79806386695c83af2fe5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803994, "uuid": "42f71f81-0f91-477d-b69b-1dbc6016245a", "comment": "Malware payload (AveMariaRAT)", "value": "77896b9e374c174cee82f14fbb78d3595641148a6dab1e2012967cc061dbf7e41034211aefbd041183d05b41dbe8004b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803994, "uuid": "f527f52d-08d3-473e-9dbe-4f3a3173e42b", "value": "T13675232322A84B15C6BD47B6442251852737BE2F3522EF2C3BDC748E47B378566A23D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803994, "uuid": "26616fb0-137a-495e-8b07-ba4ba0c0781d", "value": "24576:X3e++FDx40edo8h45AT22Z32EPbje9pDO/Q02:X39+Fu0eKqdTtRnK3DIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648803994, "uuid": "71b9acf1-9cac-4255-b310-dc2c5234c59d", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648803994, "uuid": "8821ecef-9127-495a-8c08-3691a8bb9aaf", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803994, "uuid": "5ed86983-55cf-451a-bcc1-931dbd70303f", "value": "Doc_DELIVERY_89099388889904038838727_img.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d1cd0d-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819368, "uuid": "5c929a1f-5424-4a65-b8a3-eb1247c8cf20", "comment": "Malware payload (SnakeKeylogger)", "value": "c7da2a4322387ee17b38c58f91ea3b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819368, "uuid": "cc9467f9-4633-45f1-86d6-b09b1065d111", "comment": "Malware payload (SnakeKeylogger)", "value": "7fb2552e90c099f748e7c3a2ba045570ddc81d921b4df26bd47cb956baadd22a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819368, "uuid": "b2b06cfa-7cd0-44e0-b187-d41d727c104e", "comment": "Malware payload (SnakeKeylogger)", "value": "9b6b1750ac81514a4e204eae186c23643268629c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819368, "uuid": "bae8c768-ed0f-4f91-ab94-ca696a990f03", "comment": "Malware payload (SnakeKeylogger)", "value": "ade0fca8dbf816397c2520f5287468892a3367b66c8df97d42e2fbe91af29468487af7a1b510fbfb9284244cc9a57d6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819368, "uuid": "09fdd178-3155-49f6-a61c-f0e75d567b1f", "value": "T18925122477EA5922DBFE4F76E8B14400A7767A275537E30D20C9A2FC06B33428B52797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819368, "uuid": "4f065182-902f-42fd-916c-e28cfc79912f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819368, "uuid": "aa5a53fe-d642-478c-ad5b-807f4ea8f5a9", "value": "24576:VAPQv2qkyck8cTTBZ3lkc0afXxsdNTrlgCmZd:9v2qkIpirafmlrlXmZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819368, "uuid": "4d71d25a-4a18-4681-96dc-2be31125b17f", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819368, "uuid": "aa5758da-1422-4d78-a744-90beb1a3b35e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819368, "uuid": "5c6330d3-71fb-426f-a0ae-ca3ca48fe6be", "value": "c7da2a4322387ee17b38c58f91ea3b2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5889f24-b1d7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648830056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648830056, "uuid": "9f593aad-820e-4250-965a-0c798f875297", "comment": "Malware payload (Heodo)", "value": "0670deb3c6097102072ea465df7b2b39", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648830056, "uuid": "b13380f3-d8ef-4bb5-bd1d-c9974752da66", "comment": "Malware payload (Heodo)", "value": "7fd563c97747fbba533245d165b69057df5432c7e39b0104e51f197e6726d902", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648830056, "uuid": "6881dd01-37d4-4d09-8c52-88a3cee4cef2", "comment": "Malware payload (Heodo)", "value": "dd24ef573d027b9cec683753e9bd1c94e35be7fe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648830056, "uuid": "671d2f80-c3ea-4c46-8482-ba3d4239ea98", "comment": "Malware payload (Heodo)", "value": "c7e6d5efcbc6a5a16ee62f16baf4bbad092e2d654571c6c9d019029c8aa33e293d1559e4414391b21e46185063f05483", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648830056, "uuid": "c5d317a9-4933-4641-9ddb-96ef828f4dfa", "value": "T1DB059E0675E18477E2BF01310E66777E67FEEA504F205AFB23909A8D4971AC24E3631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648830056, "uuid": "6f92d6f0-4987-479e-8d7c-f5e89964f14b", "value": "2d2fa1ca6236044d56cef7b752fe5a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648830056, "uuid": "6e5a796f-d7bd-40b6-a5d0-bc8a8c664742", "value": "12288:OBOHvWMwoyDdgp4W5dhdu1sRcww8b3UHv8qDznxN6t:OX/RgaW5dhE8oHvbzn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648830056, "uuid": "f547e4f6-7901-4ef8-9dee-6ade840fd861", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648830056, "uuid": "0ad1ebe3-5862-4ac0-80b8-f0c59e4e86ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648830056, "uuid": "dbd57343-7d4f-4114-8a27-646e0b1e633b", "value": "xewn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85613041-b163-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648780153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780153, "uuid": "5cb513b5-2379-4ea3-abbe-b08d9e793baa", "comment": "Malware payload (Heodo)", "value": "6c032fe46a25c528b7c39b5c890920c3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780153, "uuid": "e0bcd5c6-b6f4-4d89-9917-7f74755240ec", "comment": "Malware payload (Heodo)", "value": "8090d0b6d046091604553a331f669273c32d27943faae06a33b6ffda57479daf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780153, "uuid": "bf06f798-cfb7-4a16-824f-e86f49e46818", "comment": "Malware payload (Heodo)", "value": "2c26533b9905ccc9fdd09e7b682e5411efe9dc28", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780153, "uuid": "88ae8c59-b5a7-4f73-b9d4-dc87a3368df8", "comment": "Malware payload (Heodo)", "value": "edbc079ffe2898bc546df82cb1d993c0fadf15a9f533ec93b5f1745e2da2cb8fbdbe930344f4390600838609321b8791", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648780153, "uuid": "93362904-63ec-44ad-852f-53f661e47dff", "value": "T17B23CF5FE5AA6D57C2A6DF3C7F448CB8A70D268E958235D90894AF0E3F046631E4F02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648780153, "uuid": "21133626-5e21-4e89-ba7a-d5a32ab4bd15", "value": "768:cmBlntZhEI2YmxNskmoKjBvK3HqK88F/G6YzATUfJnXYS6oRM:dBlntTEvDLmXi3JvG6YzATOJnXYSXRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648780153, "uuid": "30c490f6-1553-4faa-85dd-ecda84a91be2", "value": 47738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648780153, "uuid": "4ccf40da-0123-40d3-82bc-fa04c9f5d697", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648780153, "uuid": "a20e4fd1-12ad-4bd4-8e85-c2a07e986be2", "value": "SecuriteInfo.com.Trojan.Vita.6.1191.13486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a60fad9-b17b-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1648790282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790282, "uuid": "0477e2f1-7bc7-4e5a-93d9-4a7b6b8a8f92", "comment": "Malware payload (CobaltStrike)", "value": "72a3cdb1dc8c00c99f4ca34ccffaae8d", "object_relation": "md5", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790282, "uuid": "02d3f90d-5f6e-45ee-b394-ec1c0bb80c0c", "comment": "Malware payload (CobaltStrike)", "value": "85ff1972c25b726e0080b8c63ddebee47e38eb0c8a4f24f7a177abc19739a3c2", "object_relation": "sha256", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790282, "uuid": "c6fa3eca-5523-431e-964b-7d183115353b", "comment": "Malware payload (CobaltStrike)", "value": "dce980264822d1abbc4acde30484cc706a5425ae", "object_relation": "sha1", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790282, "uuid": "25626e79-a643-4f44-8ff2-0b85a7de6c2d", "comment": "Malware payload (CobaltStrike)", "value": "4ebfbf0b9074a81c5193b8f42d3b4de34bbbcb8fd460e6ecd978acc83a1bb3797f92bec1c495cf170881f4dafd283101", "object_relation": "sha3-384", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790282, "uuid": "32eda661-7f02-465a-98f1-e5fae4d0074b", "value": "T130F5388AA6BDD1B6EEFEF53891523156BF653499832442C37E00457D0A2FBE4983E730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790282, "uuid": "384fbcbb-7710-4517-a642-f9599b82249b", "value": "3828535f4c801837d93a2f2e5b9a6e00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790282, "uuid": "8cfc9846-7c5e-4606-9414-a13e943e39a6", "value": "49152:LgWQapGeFBGXwY5Xs16VrG7W0EURTvTcZPpQV:M9aQebGXwY5c16NG7RDRvT1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648790282, "uuid": "882c5b99-8776-41e9-be0c-0c5cc7246f20", "value": 3427328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648790282, "uuid": "af8ad7db-2e10-4bda-983e-2d303b083a24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790282, "uuid": "00b2fe28-602b-46ad-a7cb-9ae228ce1731", "value": "85ff1972c25b726e0080b8c63ddebee47e38eb0c8a4f24f7a177abc19739a3c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c035da0-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648799895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799895, "uuid": "70091445-c3bd-4b4e-b40f-ae4f6dd14d07", "comment": "Malware payload (Heodo)", "value": "ab7a1fd04f55ce05ac25cc815d6d9dc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799895, "uuid": "72fe4976-421c-47d8-95dd-8d53c1b9e2ed", "comment": "Malware payload (Heodo)", "value": "862d60ce76aef39349543946bac63d368ec3bcc3c6e3dfe0eeaa9af76e7e2d8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799895, "uuid": "9d64fe17-3212-426d-8c1a-7f2f21a932fb", "comment": "Malware payload (Heodo)", "value": "1e4445a2bf66f402a5da592c1627ebae5eb8a5db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799895, "uuid": "92f4bd38-ecd9-4aff-a8a0-dd65c383a8ff", "comment": "Malware payload (Heodo)", "value": "b965f8cf5727e0868eb8a0a189cab8346b26c287f758765083f322b0ca445e7af6ebc9bccb2878b8ab01d925e256ade6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799895, "uuid": "70b95d46-c8df-4539-aab8-5fc970cd0037", "value": "T17FB4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799895, "uuid": "32300a5b-ae87-43e3-9bfc-bfd14fd92875", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799895, "uuid": "dae1b14a-6017-4475-a49d-b516bbffc151", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQTJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWztDIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648799895, "uuid": "f98c0328-4a78-4f66-97a2-2d5e247e2eec", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648799895, "uuid": "3d533d96-3016-49fb-a097-ceddc6e7dd05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799895, "uuid": "fe5692d9-8eca-4015-88f1-cee495d77ff0", "value": "ab7a1fd04f55ce05ac25cc815d6d9dc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303b0125-b1ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648812223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812223, "uuid": "81f5fec2-019e-4f46-ba0e-abccbedd36fb", "comment": "Malware payload (SnakeKeylogger)", "value": "db925087568e63bfdcfd80ed808aac78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812223, "uuid": "4463626a-d7fe-4bb6-8633-95b52bee848b", "comment": "Malware payload (SnakeKeylogger)", "value": "86d7414ef5025b1c93cb955cadc4ca6e6d8382023dd0659680633e53c577921e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812223, "uuid": "106c4466-c0fb-44d2-a224-918d7feb428a", "comment": "Malware payload (SnakeKeylogger)", "value": "ef5e323ec63b4d8a4a880fc19ed312574d351f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812223, "uuid": "901a551a-196a-455c-b1c2-aa7000c697f9", "comment": "Malware payload (SnakeKeylogger)", "value": "f7240364535fd0b601077c8d77140d6bfa0ee27293900004adf27b094cacbb156474cd5d2002d4723d1b16122d79cc35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812223, "uuid": "0c683df5-cba3-4311-8465-dca22c33ac8a", "value": "T1EB73DFC0ABD0C1A1D5694274D7B7CBF043229F28E42A8F1F50D4BD2F7E61687AE93625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812223, "uuid": "58dafdd8-44b8-45f9-b79d-ca5ba6113bb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812223, "uuid": "34da659c-c623-4325-9661-720df2893360", "value": "1536:O3yA3bnwXlvAPBGLX6cMxkWFUzaR5IyS2eNXeOalH:O93bwXy5GLX6cELQaIVv0tH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648812223, "uuid": "b9774089-c911-4bcd-86da-8376a3485c88", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648812223, "uuid": "044cae8e-442a-4f95-9f44-eb8fc928558f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812223, "uuid": "9f78b338-d4fe-4702-8d51-05729f6d6321", "value": "Ordine di acquisto PO-JTT-00001018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02dab6f5-b198-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648802698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802698, "uuid": "116950c9-de97-44bc-b6e4-0138ee803150", "comment": "Malware payload (AgentTesla)", "value": "904603ea3e8ff4ee2543146e4266a969", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802698, "uuid": "ad9a72c2-f000-474d-a523-d907821ac0ac", "comment": "Malware payload (AgentTesla)", "value": "86e155a6fd3b0254ac642988a138fed1c4a42813ca4bb57ddd3935a80f18828c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802698, "uuid": "dc0d1a3a-7fc2-4201-9261-01a6990ec9db", "comment": "Malware payload (AgentTesla)", "value": "545dc8265a7f0c342b2eb839ea2b22e039382f17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802698, "uuid": "4c7b8288-b212-4404-8288-5c3ba666e28a", "comment": "Malware payload (AgentTesla)", "value": "522c7c754edc61194c175adbafd5edfe1a58c83324e2d847407d80a80b982f1fe9bceaf208e735e4181ea8dc54945ef8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802698, "uuid": "06f56ea4-4838-4276-9e70-7c3d0a7ee520", "value": "T1FBC4121439F8CF21DDBEA7F948A25120637DB711A165C2497EE730FA2AD33A1069137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802698, "uuid": "b4d9eef5-ed4c-46cf-b938-5673e1510925", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802698, "uuid": "68216e1d-09d0-4e76-8f36-6f3e9d812731", "value": "12288:04JvcN2UlAngE+UOCXWQNrXKzjdlGe9YcRXzYkpNpt:+NplAngE+UOCGKrXmyqXzNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802698, "uuid": "266ff620-08c4-4192-b71c-8147a17068d8", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802698, "uuid": "3cab5ff9-a232-4a0f-aa4f-da16d50d24a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802698, "uuid": "d1b0f058-e278-4d83-b973-86974c93f3ff", "value": "Vessel Notice_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a99962-b1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648837738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837738, "uuid": "735fb4b9-553e-4489-b853-f1d730045347", "comment": "Malware payload (Heodo)", "value": "570e0c993210e4861ec86aa9b4d88725", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837738, "uuid": "a0ad3b11-fe13-490b-8d70-47badf2ec4a3", "comment": "Malware payload (Heodo)", "value": "88397fd50720c8163cbf99b69275736b731cced5e159cadd7f564a352e77fa0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837738, "uuid": "45945b59-14c7-4fa3-a021-a47a5eed07ee", "comment": "Malware payload (Heodo)", "value": "cda34d78370604e603c396e25c0b78dd70b069c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837738, "uuid": "21ee2253-2800-4fe8-9461-1cb2207d2037", "comment": "Malware payload (Heodo)", "value": "28cb01290b400aa9983c86a919bfed51df2cdf461722b65a470acabdde66592a20d489cf6ca99af395003e0419b7520d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837738, "uuid": "d44417bc-0719-4fab-aabb-5b1d9396ae77", "value": "T1FE94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837738, "uuid": "b552289a-1baa-43e0-8168-300769468ced", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837738, "uuid": "ec4693ea-c39a-4b77-8c56-ad15fb2b463c", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDLS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKTrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648837738, "uuid": "4972e8d1-0b80-4403-90c2-4b7fc7de9f0c", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648837738, "uuid": "da844a3b-ecaa-4c9e-8869-0cf5554ff27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837738, "uuid": "35dd534d-898e-4e4a-ad30-bb04e8a5e2d8", "value": "570e0c993210e4861ec86aa9b4d88725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f94c49-b1c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648823297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823297, "uuid": "64b75e4e-06fe-4990-8fb2-b57fe91e8f59", "comment": "Malware payload (RemcosRAT)", "value": "c700825c6b725e9fc0708da7de0aad2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823297, "uuid": "61cd379e-25a8-469b-a455-80649cf2b9b8", "comment": "Malware payload (RemcosRAT)", "value": "888459235942199e1cbe86db506800b9f4c43c7f6c44a659ed2de269ce0644a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823297, "uuid": "ca218027-9685-4086-a301-90f6a64d8246", "comment": "Malware payload (RemcosRAT)", "value": "0cf2f1126f39e704f8302cf59eb7941360f3e374", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823297, "uuid": "dffa7432-d570-4237-8e9e-9b5b6ebefc3e", "comment": "Malware payload (RemcosRAT)", "value": "af2e23e1821954099a57900902db984349eb3600f82c5076b90db38ad24fb9148a49b6b09e326c2da4f61e132035b8da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823297, "uuid": "4a8cf054-c6c7-4b37-a5c1-3750e09b9f12", "value": "T1CC73A1A1BE84F629C12A2C32DB12DAF5C127BD27C9719A537CC87F5F7933642841172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823297, "uuid": "bc3243b7-7bc3-48e3-a97b-d6de3d7b9faa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823297, "uuid": "c3342e80-b594-4563-83ee-31c1dbe9d7ba", "value": "1536:PG0bOQU+iopiA+bHq0R4Co0s7yj7c0q1e:u0bqYzCo8/c0q1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823297, "uuid": "f1d704a1-a642-46a0-bd62-44c8747d8264", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823297, "uuid": "6fdf38b7-9976-4757-a6de-062a59d41b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823297, "uuid": "88cb28a5-ce4b-44bd-a400-41982aaf6203", "value": "c700825c6b725e9fc0708da7de0aad2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9425c41f-b187-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648795640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795640, "uuid": "18aeac94-6579-4c1c-8919-8a7f796d24f9", "comment": "Malware payload (AgentTesla)", "value": "5993ddac6d8ee49817764e93beb7df03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795640, "uuid": "af0ba859-f78d-43b8-8985-0a8e5924b7e3", "comment": "Malware payload (AgentTesla)", "value": "891ca8b03e3efb46e8a1000834fa025bc1007336cc8b22e7d5da5a4d719cc1d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795640, "uuid": "2be7ea77-5a96-4d31-aced-f51809266186", "comment": "Malware payload (AgentTesla)", "value": "4392ddc10c1dabdc40dda18c566ee935f1b67de7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795640, "uuid": "21a876f6-3267-4135-b4bb-11ba60a90d42", "comment": "Malware payload (AgentTesla)", "value": "1a684d4f2f96dfa5ac2536e4770b90a71435afbdc06e8cf98fdc790263f1e80c9551c2d691a216061415c24a08ef6b45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795640, "uuid": "e5d3f41c-e607-4d93-99d4-e1727233660b", "value": "T18505230333F98E06C1FD1B75116056892B36BD272026D60C6AD836DE69BB7C2A5D37CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795640, "uuid": "731304c0-fd74-49ec-a4ed-436bcd5a4ef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795640, "uuid": "dce9c38f-a927-4314-a408-03f6836fafba", "value": "24576:j90fRlr9NaIAFvnsGUr9S766Z9BN4T/5/GD:jIx9ATvsGU5S766VNeUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648795640, "uuid": "c76a6cdd-b8ec-4654-b585-268e7909d88d", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648795640, "uuid": "441fedbf-1b9e-430b-836a-318f38d6c39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795640, "uuid": "4de7a85f-2d41-4226-b87b-05b9d62cbc37", "value": "Aviso de llegada PLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf09853-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819626, "uuid": "198d743f-6e03-4e7d-abef-7c38b4c34fcd", "comment": "Malware payload", "value": "249f3011468bd247d50b284cc0ca4b5e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819626, "uuid": "0ae7cec4-7e95-47c8-b33d-9c9abfeb3681", "comment": "Malware payload", "value": "8a3027217d6218c3291e5eed4b8453840740ecf6b1aa01539d221a68221ba57b", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819626, "uuid": "bed630aa-b449-4e04-95af-5f39e47e45be", "comment": "Malware payload", "value": "ef610135644a0324df98586db0dffd962a147cce", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819626, "uuid": "25a588e4-6654-4f85-9287-eda6e2391c66", "comment": "Malware payload", "value": "20a9217d9c27e864ef081ff4b2a06ca4bae90dea485abc825c8c2f79d25b57d638c3cb43655c77403b6c5ddcd2ff4196", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819626, "uuid": "0960a6d8-e277-4224-b3f8-64275135df51", "value": "T10F1402CE7FD267F1F039A2B45B44A159190BFF81A32D6323A3B539A8CC39A57141DA0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819626, "uuid": "0dfc4f5a-4bc4-4d38-bf4e-119902a056e1", "value": "3072:EIONjlY6O0TvyxXQP1AN+0TvafNc7S47U9l64f9s4s9vKF2tANTIrMuK5Lr5jjf0:9mjlY6OmvyxXQP1AN+0Tv4c7FQ9llf9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819626, "uuid": "4c4c4177-44f0-495e-abe1-1eeb1c928514", "value": 192408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819626, "uuid": "87c51c0e-708d-4f46-ba17-34202e13223c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819626, "uuid": "683916d2-85ea-4a19-b3fa-0aa65dbcc640", "value": "Oferta PRP_Slovakia sro.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec675ae-b1b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648813885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813885, "uuid": "c5c2140e-5717-44e1-a2c2-17cc817a74e9", "comment": "Malware payload (Heodo)", "value": "f6f7b350790b6502a62899f677f9063a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813885, "uuid": "6e5022de-9872-4850-a643-53a7a5855fee", "comment": "Malware payload (Heodo)", "value": "8ab926bcb1486ffe74ead60a42d176816f06d103576662bec0876b3dea641016", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813885, "uuid": "706a8ae7-dbd9-4fb5-ad80-5dc58059747b", "comment": "Malware payload (Heodo)", "value": "7ac12d3baee383e240cb9c3166b19c8498261834", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813885, "uuid": "11e43f88-d6de-4d73-b737-3810560fce75", "comment": "Malware payload (Heodo)", "value": "4dc413d505d16493f86350b3e29b5d81592dc3b54c5facb15de512eb46ffe120ed3211c1116b0d8ca96599b9b32f6b8a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813885, "uuid": "84b99e3d-9ace-44cd-bfe8-e48fa0c027b9", "value": "T110E2B06AB3B1B496F2335C38854CC8F3561AAF829049B95A703D776FEA541BF01CF428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813885, "uuid": "b1f92fd4-a782-4559-9257-42f75996dfa7", "value": "384:NupPr/nHYzzaivuTc4OVdgzq7apRI6ZIwDyWS4UyRMCYMVM7btUMLW7joHqgmJyL:Qqt2/OXWT+43SaMdbLWAy+IS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648813885, "uuid": "9740b89d-4c67-4765-bc94-3076a10da362", "value": 32392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648813885, "uuid": "df0e9992-9771-4a87-81ed-522da3cb176e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813885, "uuid": "1fcef02a-49fe-43b6-9f68-2bd613959cb4", "value": "958561381.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc9fd1b-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648819899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819899, "uuid": "3868d928-713e-482b-92d1-6230840a3ca4", "comment": "Malware payload (RemcosRAT)", "value": "b9238080d78f6a17aaf8086b62387350", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819899, "uuid": "0b051252-7d8f-4c53-be9e-cbb6a9cbd809", "comment": "Malware payload (RemcosRAT)", "value": "8d2d2ff3d47ee9531662caed0e2a3516fcbcf6d4999615dc8a80e69c909cabeb", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819899, "uuid": "2f944ed7-bb1e-4409-8a94-c2cb740e1f96", "comment": "Malware payload (RemcosRAT)", "value": "8fad72077388256989d6d6e3733cfa77868cb668", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819899, "uuid": "8fd4789f-6099-45c9-b518-f13a6a82a5bd", "comment": "Malware payload (RemcosRAT)", "value": "200a17b94e4b4615830ab5529598cd8e90bfa35c46f828ec70c88d057d8c79276c69e7808dfe63e03acf5d871903735d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819899, "uuid": "89ef1b75-3205-497d-a211-036773279805", "value": "T1EC0430D5E686297B5DF702A2AC0F495EBE2360A2221116217F4DE4CC232165FD7F6B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819899, "uuid": "de2f807c-acf5-437c-8308-3e1cb490fa6f", "value": "3072:UnFkJughJ103pvjOTXhJ103pvjOTXhJ103pvdhJ103pvjOTXhJH:UPghJMjOTXhJMjOTXhJMdhJMjOTXhJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819899, "uuid": "6124129b-78f8-45b6-880b-731ad2b841b4", "value": 187813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819899, "uuid": "e42910e0-f537-47a0-a7d1-001aa30a4057", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819899, "uuid": "fafef2bb-78cb-41da-8103-058ab24d756b", "value": "Curriculum Vitae.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4892a384-b1e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648834168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834168, "uuid": "5ec91f97-2d4b-4a2e-96c1-39b2c948ff2f", "comment": "Malware payload (Heodo)", "value": "18669c01f42c4205ace185a7ae65c76a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834168, "uuid": "05735d61-a8cc-47f9-b93d-80880179fdd6", "comment": "Malware payload (Heodo)", "value": "8e377c24c906ec195e6161817169f24a069c9cd21af7c52afcc0c987026f8b05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834168, "uuid": "ad48dd67-5452-4a43-a435-629b9951b1a2", "comment": "Malware payload (Heodo)", "value": "2f15bbf57c8991fd83876e325b8507eaf2bbdbec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834168, "uuid": "f9c56b7f-1e88-42c1-bf4b-f8008722c58d", "comment": "Malware payload (Heodo)", "value": "2a1811bd928fab5b2cc9eff62a3e3b3994c833f1bd618bcaef743307052c94ab4dfe18ea03ec4362d14b32c698ba0e24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834168, "uuid": "1150776a-c1cb-4db5-905c-17dd947bbc52", "value": "T167059E0675E18477E2BF01310E66777E67FEEA504F205AFB23909A8D4971AC24E3631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834168, "uuid": "827a4ff6-5add-4f45-8327-a00d61b963fd", "value": "2d2fa1ca6236044d56cef7b752fe5a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834168, "uuid": "a58b3e38-5b0b-414c-bceb-69478ef7d410", "value": "12288:OBOHvWMwoyDdgp4W5dhdu1sRcwz8b3UHv8qDznxN6t:OX/RgaW5dh/8oHvbzn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648834168, "uuid": "16c01340-53fe-44ac-a7c2-ac6647702a26", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648834168, "uuid": "a8c453ea-803b-4c7e-9893-f2da54e6a313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834168, "uuid": "02485f1d-60f8-4953-b9db-faa859a7f6ec", "value": "18669c01f42c4205ace185a7ae65c76a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f2e07f-b172-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648786407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786407, "uuid": "e1f7ebe6-393e-49d7-a0d1-aef1ff0ed648", "comment": "Malware payload (Heodo)", "value": "ebc28c1103ca334d31812b99e36e5c44", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786407, "uuid": "c3b90ff3-7121-4046-b18b-83ac596ea54e", "comment": "Malware payload (Heodo)", "value": "8f18344b57dce7256dca7f7aaa28da000a7195bff2747dd12a89cac763f49aef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786407, "uuid": "9f9657f6-1aa8-4e99-acb4-72430852ec09", "comment": "Malware payload (Heodo)", "value": "218fc75be9a3499cf8e867fe172161e3154e0397", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786407, "uuid": "4eebb756-b2fa-4e7b-a24a-7b7ba1b9dc0a", "comment": "Malware payload (Heodo)", "value": "4e9f2cf4c87553b1bcb9f7c8582e3deefb259ebe00f68d27d5cf671ac7e44a45e415c940fd2873aaff4002f8457306ee", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648786407, "uuid": "404a3982-7cd1-4323-a960-c6da6d57e79c", "value": "T16DE2AF5DB3A5F0A4F6226C38499CC8F34A1DEE814046B926747CA75FEA942BB11CF478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648786407, "uuid": "bdba7010-8102-4eb3-b469-2b110ab53e87", "value": "384:9uRfHYzzaivCm84njX3Ou7HWNI6ZuVEEWS4UyRMCYMVM7btUMLW7joHqgmPhXlU8:ftXnjnOkkY43SaMdbLWAYvUxK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648786407, "uuid": "64be25dd-7102-40f3-af8a-378160e197b3", "value": 33441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648786407, "uuid": "f943d32d-aa0e-4745-94a0-a805c7a4f639", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648786407, "uuid": "4f9945f0-0815-4452-86e7-a5fb56c6b75d", "value": "senza titolo 85236304.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9d7efa-b17b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648790289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790289, "uuid": "4ac705ff-af94-483d-b086-589c62cff59c", "comment": "Malware payload (RedLineStealer)", "value": "cecb55755dc8f95ddde224073a8e86f0", "object_relation": "md5", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790289, "uuid": "49480aff-b01b-4564-b1d7-b3a4d3c7a4ad", "comment": "Malware payload (RedLineStealer)", "value": "8f6cef87e8f0943e3f76dc10a38f52e9d0ace8c2716c8117a2bacaa24a7b3edf", "object_relation": "sha256", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790289, "uuid": "a7f170a1-d796-4fd3-98b8-769c4e674d02", "comment": "Malware payload (RedLineStealer)", "value": "fe3255967fe9cc8a46d71da633f93f8794d7e3af", "object_relation": "sha1", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790289, "uuid": "48da43fc-a56c-40ab-8992-2253be9532a0", "comment": "Malware payload (RedLineStealer)", "value": "91f6cf9bce9ff19ff744e2378ba862aff520b6a5855cf062e4c0d45faa4e621bd494fac3636a5a8a5ac0005dc9906ea0", "object_relation": "sha3-384", "Tag": [ { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790289, "uuid": "12b59493-2baf-4b57-a0ba-b63aeccff1b1", "value": "T125458C89721072DFC857CE36C9641C24EAA1BD7A831BD207A01731EDAABE597DF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790289, "uuid": "dd900da9-80e7-42b9-9b20-9c6b522a735d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790289, "uuid": "4492ceb3-515b-4dfb-8ddd-f41d47d0409b", "value": "24576:9dRxTILBzAE0MChTJu0s4SWOkKsZNdaKNnDRDfYpeOoLWIkN:9zxTIVAE0MChTc0NS5+NaQ9DlJSIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648790289, "uuid": "3af5aa4e-b752-495f-b491-4d386dffd27c", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648790289, "uuid": "f4de12df-f9fe-453e-bff8-17e86ed71962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790289, "uuid": "81d6bb5d-146d-4189-ab09-20a594be220c", "value": "8f6cef87e8f0943e3f76dc10a38f52e9d0ace8c2716c8117a2bacaa24a7b3edf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbfd5a2-b1a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648808591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808591, "uuid": "0452b7b0-1c35-4ec2-94ce-a6e6520ce66a", "comment": "Malware payload (Heodo)", "value": "afd0dba7f8d045ede77e5906519fbf20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808591, "uuid": "04b6f8d2-4334-4d4b-8434-eb37bc061d2c", "comment": "Malware payload (Heodo)", "value": "8f999cda676f9247f318b738fb9d6c23905f45d5b1461af98e0ce135b4e25987", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808591, "uuid": "67cc2a14-ea4b-4039-ac2f-15a6d305f780", "comment": "Malware payload (Heodo)", "value": "cbadb1807be8853726acafc0833e73f53377b6e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808591, "uuid": "408255bd-5d53-4de9-8137-f3418a841149", "comment": "Malware payload (Heodo)", "value": "c8b946649494d8897cb1be839296506cef7c36b98f0fb0ab86f838b1fe2c8ef7f101cd88adfb7bf9d3ac079d1ecd054f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808591, "uuid": "a16683b7-9482-4a63-90df-5b9bba5f730e", "value": "T18394BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808591, "uuid": "4f299cc4-c457-4f6f-b013-04f9599dd52e", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808591, "uuid": "c564ccdd-ec15-4b69-b4cb-9dedaa97c303", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDES4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKMrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648808591, "uuid": "a8319cde-2771-43bf-817e-23a325f4120a", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648808591, "uuid": "07216b3c-f6c2-4040-9b61-cbb48ddecaaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808591, "uuid": "7a9954a9-a474-4b10-927e-8d8b42a18331", "value": "afd0dba7f8d045ede77e5906519fbf20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396a6e33-b1fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (1ms0rryMiner)", "timestamp": 1648845739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845739, "uuid": "7e1152dd-ad50-4aab-8525-37b962b45c75", "comment": "Malware payload (1ms0rryMiner)", "value": "aa4bbee94ce22afceefce68d1e7fb5ec", "object_relation": "md5", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845739, "uuid": "ddaaeef9-2697-4e1c-ac48-3771160ee9d8", "comment": "Malware payload (1ms0rryMiner)", "value": "90cbca7778f5ffde17b882b86f55292903ddb9868b65fa7f3e5debe0fcf89b2e", "object_relation": "sha256", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845739, "uuid": "e7e7f859-b193-411f-8c16-8973c5d85c20", "comment": "Malware payload (1ms0rryMiner)", "value": "f0ca352bd188b594880074043dc357cad85897dc", "object_relation": "sha1", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845739, "uuid": "797f468e-b191-4c12-bc2a-44859ca9bfd6", "comment": "Malware payload (1ms0rryMiner)", "value": "7f2eccfbffcb07a1bfc6a00b8fd4f1dc0729fe620aae7b8f2cdde9c0f0a72e669bdfa2be7f39a1382c95c9f8fc918cba", "object_relation": "sha3-384", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845739, "uuid": "822e810d-3e62-4d68-9e61-0805dd0fdd8e", "value": "T12BD5338DDD3A32F0F9329E37EAAC8545BA93F9031539DD9578811C07AA585FEDA810C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845739, "uuid": "247d0311-d41c-4784-89a4-eb2672df8486", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845739, "uuid": "d86487b5-7021-43c4-907f-e14cbe847996", "value": "49152:SUC2IwhZcjvRM7bbAlgHqZ2dLpXcISktn6bPpPKLMK1wma3EYRS5nQzAx7iiNWPO:SEhKvDaHqEfsIS3PpP4VYRenQzs7ylY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648845739, "uuid": "e0624d0b-6a2c-4268-85db-eea99b2393ba", "value": 2881024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648845739, "uuid": "40dee874-be9d-44b6-af8c-cbfe085dcc9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845739, "uuid": "7fcf9280-e261-497e-9a2c-38cc91441143", "value": "aa4bbee94ce22afceefce68d1e7fb5ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a37f1d5-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819675, "uuid": "43ebb9fa-7ffc-4d3c-8164-9f766ab036a7", "comment": "Malware payload (Loki)", "value": "34948dec3a0495c0418634c0f5a24e03", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819675, "uuid": "e2e89ee6-6e65-4584-b7c5-fc5d6c7eeb95", "comment": "Malware payload (Loki)", "value": "929f76b55041ff1156840e19b9f619d26d3137710d00f8f82d641c56c8759edb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819675, "uuid": "ae46192a-d235-4867-b80d-28a128053307", "comment": "Malware payload (Loki)", "value": "55d9a98a6ad691007c76ae6add28d4d04abff785", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819675, "uuid": "f5ce32a6-3d86-4e23-8538-63b6f25a3a80", "comment": "Malware payload (Loki)", "value": "f20bd210d20c5d7155a6851e1f0208fa843bbe741c30a567d11ba34ccd14fc9d09ff78025eeaf495f80e67f68737ad42", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819675, "uuid": "1cea2caa-aaff-4046-a713-1cf39abd05a1", "value": "T13A1402103DA89ABEE659B678CD367EC775B6DEFC1935A47260143308E0B49AB3E10371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819675, "uuid": "c5686d30-4f84-4c3c-8a6d-b8dc1087ae76", "value": "3072:juNCotMP2tOJLK9LHO+AJG2kPHUTkyvh5GGKAJwHDMkcpnbJwdyNCag8WBchS:CCiEZCLHOb02kf/wbGG5/bnNff7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819675, "uuid": "fa7fa243-a11e-45ff-bd4c-7bb4bbfd3e31", "value": 192296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819675, "uuid": "c876caba-5aed-40a1-a558-bd888c0f8271", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819675, "uuid": "46cd347a-9f13-488f-973b-4495aec9fab0", "value": "Revised Shipping documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b1c64e-b14f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648771722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771722, "uuid": "591ac40b-265c-4466-b652-332961dc2b22", "comment": "Malware payload (Heodo)", "value": "8a5e4934b5fc134a9568dd9093c14d72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771722, "uuid": "d1d97008-7291-4595-88b1-62863aac1602", "comment": "Malware payload (Heodo)", "value": "93278f8566601df7d99ea237434efd18c331977138298f3cadb331fadded2cf7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771722, "uuid": "b2c1d36a-8c34-4f7d-ace5-aad1623018bd", "comment": "Malware payload (Heodo)", "value": "b8371ecbaa50d9f6b664758c3ccd0e54102d9f06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771722, "uuid": "3ad747ec-c8ca-4d89-b2d5-ce61492653a7", "comment": "Malware payload (Heodo)", "value": "ea1088a7005473305b2787427e4fe51977b4387209dbdaa81fce5521ab472e8491350ab28f176584f795bfc4f0c5da6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771722, "uuid": "3acaf1d0-d310-4f79-8dd2-2f2aee9ddb74", "value": "T10CB4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771722, "uuid": "bcbdee7e-746f-4809-a6f8-0116b1a8a259", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771722, "uuid": "3e3a7184-008f-476e-b062-3c60282b9708", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQTJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzZDIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648771722, "uuid": "865d2022-f7e3-43b7-adb9-4844ff567822", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648771722, "uuid": "314fb61e-5ee1-4504-ae3a-5139685ea3e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771722, "uuid": "c20c9cbb-fed6-4cfb-8840-51d17f65a14a", "value": "8a5e4934b5fc134a9568dd9093c14d72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27dc2f60-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648819081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819081, "uuid": "8a8edd34-7986-4411-81ed-33f2a464e838", "comment": "Malware payload (Formbook)", "value": "22b8f8e6ff4f56dbfed9987511cd6332", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819081, "uuid": "6856d4c1-af9c-4ffb-90f8-d75c6e85d29c", "comment": "Malware payload (Formbook)", "value": "936ba69a1651142a6cae81b4ec80cb136f50c8d4546a7bbed17d9f73c1585081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819081, "uuid": "2a705cc7-25b9-4c1e-bc77-0d86d60ff155", "comment": "Malware payload (Formbook)", "value": "e082f9b8bcd10a5a0635a84bf99964d655874800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819081, "uuid": "cadb599a-d499-47f3-9a90-61b20c98106d", "comment": "Malware payload (Formbook)", "value": "75a26ac806f8ced9167794827245d0ead4d24c4b0a1e1f209793cd573f2293d1ed64a8e67a1945d932ba2b2443a4e4bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819081, "uuid": "6daeb21b-0c1c-4de6-b9f6-b4da651b9ec1", "value": "T10FC4011DB6B9CE52C4A916F185C742200379D78B71B3E7896DC813C68E437D36D4A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819081, "uuid": "59ea35c3-c74e-4b98-be76-f53a874589ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819081, "uuid": "df27f286-41f3-436e-add4-ac2aa3554570", "value": "6144:y4xZToukfoRKi9FoRTsNjdQQ4GqSUBEdAeSKijqTmzQZUvs7bjpz9fa+44m8zQQG:d0SKWFKWVqIAeS1jqi0R1z9VsoQxqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819081, "uuid": "ce167314-ecf6-41ff-9407-4bc71eb9c1df", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819081, "uuid": "bb410449-0a5f-4189-afe6-cd3356fd459d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819081, "uuid": "dd2af6be-2d92-4daf-bcf5-f6ece215c9f4", "value": "Shipment Details - Couva 760P - SO 10169195.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d4c49c-b1b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648816282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648816282, "uuid": "a0cc3711-6311-48d7-936a-23459b09f7fc", "comment": "Malware payload (DCRat)", "value": "01c0e7d80cc0b8653e089874ef70e481", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648816282, "uuid": "b9f896c5-1e60-4ee3-8749-7cb131644ae7", "comment": "Malware payload (DCRat)", "value": "93f0118676726e03265dbbb181099a692b6ca66fa5742debac86654f9be02dae", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648816282, "uuid": "19ed6563-cf49-4c02-a638-a95b22254346", "comment": "Malware payload (DCRat)", "value": "4a251a51df0b128466d957468347ea4fb6310254", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648816282, "uuid": "5b31626b-2e00-426b-9980-08a8bcabebeb", "comment": "Malware payload (DCRat)", "value": "2886dea7da30673659e56149afd405c00909e08c52a57ac70c406f79afa9a5178e511fd390aa283778d8576d18155e87", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648816282, "uuid": "0ad6e292-e413-4415-9138-ebb706d85388", "value": "T1C075AD127A44CE06D06A5B37D9DF801847ACBD422A3ADB1E7E8A339D26517B75C0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648816282, "uuid": "3e21ec6b-9bf6-49ab-aa7c-88ca18641018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648816282, "uuid": "001990bd-b711-4a5f-bb92-60e7ab8353e8", "value": "24576:0g7n7JhzrplE7MFaT083LJL64OGz+vWjAu+hHxXAdyMyLKY8mMOce5qdWbQh4+c:R5FL8bGGzuuyQEMyLb8mMOce5ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648816282, "uuid": "3a87d2b1-8340-46af-a362-b8abe7f918b2", "value": 1598464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648816282, "uuid": "e406e043-4e6a-412b-9f0d-004183fb3f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648816282, "uuid": "9b96f9d9-4553-4e6e-9367-100e007f4d92", "value": "01c0e7d80cc0b8653e089874ef70e481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e13cf4c-b1b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648813884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813884, "uuid": "7636183e-919d-484b-b115-5353684eded5", "comment": "Malware payload (Heodo)", "value": "75e3ebe6bcfed321573904e4206cdb53", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813884, "uuid": "09740a9e-3a82-47df-aa51-04b524551783", "comment": "Malware payload (Heodo)", "value": "951941b7fc257806fa493b4ae3d4c16d240916d808a436f59cab82129a7832d3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813884, "uuid": "5c2d3706-3952-41cf-b580-62555fbda928", "comment": "Malware payload (Heodo)", "value": "7092813497566a5ab908b2279432f2ee7589037d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648813884, "uuid": "ecc71584-6f4b-474f-a50b-b9a94b428857", "comment": "Malware payload (Heodo)", "value": "34ab3fca433e5da5d20c3d8ea2c3ac2d8c9359cbcf11f17f661cf78c76f131bdf0ae6681dcdd44895d2c9732cdd246c7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813884, "uuid": "e5d5cf29-97dc-4de8-b437-1131d8d9a16f", "value": "T18133E886B659D569FA158B314CEB87D66322EC205F5F17833229F336BFFD8A00A47106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813884, "uuid": "c8735c9b-0f55-4104-9a3e-f6b8db2ef3e1", "value": "1536:8RKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+E43SaU3hzD:KKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648813884, "uuid": "9665a82c-eae7-4663-82e4-607d55ee29b9", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648813884, "uuid": "378e487b-1a6a-4a3d-b214-3935a8aee584", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648813884, "uuid": "0e20223b-6975-4f62-868b-e708456e0485", "value": "20595 422145363849.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801392f6-b1c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648823953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823953, "uuid": "7e4fac00-492d-424e-827f-31ec82f2c65b", "comment": "Malware payload (RedLineStealer)", "value": "8bf37da991437c5e024b4c342b0d687e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823953, "uuid": "b9d1da16-a321-4908-a9b5-e8af189a4850", "comment": "Malware payload (RedLineStealer)", "value": "957f1fe678da9b87111beb0ee535f17afbd288d76b0214f4fa8322c3fa27d878", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823953, "uuid": "7717caa1-e966-418f-9188-6ff17e7bb96c", "comment": "Malware payload (RedLineStealer)", "value": "5c21d54aa545dc28880fdb266aea7021405a7b1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823953, "uuid": "c066ff0a-e215-43cf-92b3-21f0516ee0ea", "comment": "Malware payload (RedLineStealer)", "value": "15c066ef6a984c3a5925f9352b16ce2538d21f250c7c650ad9240cab30d4e9e60e7e985f074e2f53f32e8602e3bdb427", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823953, "uuid": "a5a577b7-ea4e-4bd6-9daa-678f0deb12e7", "value": "T12FE422779B55CC6BE8690A321F93FE205A2ADF953C150F1B6E22B84D8DB537D3C001A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823953, "uuid": "93c221ef-fb84-4b2c-9349-e7a005e637c6", "value": "169e59e39d2e3a4161f73e954c50c5d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823953, "uuid": "194dace8-2b8d-4e37-a0a6-d9096dca85d4", "value": "12288:ArBK3Q1jZZBilZD3zsRf1bSTEhX54kAhQ9JNbbBxdhVGOT+3WEhirBHdeuYayYuX:QBx1VZEiRf1RhXZAuzbBLHbrRM0MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823953, "uuid": "e0981ccc-c991-4e7b-bf78-39d47f3ce1d4", "value": 698384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823953, "uuid": "ff9fec3c-6663-43a0-afcf-b1ff893a0f57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823953, "uuid": "09e1b9bc-3401-4cda-8055-6017a56882ac", "value": "8bf37da991437c5e024b4c342b0d687e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4f0f54-b1ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648839624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839624, "uuid": "fbd7e508-951b-40f7-a070-a4c4b36e5830", "comment": "Malware payload (Heodo)", "value": "f9b64b4faf4d7563809c55665120426a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839624, "uuid": "8ed856a9-c2b3-4e94-8f92-a0854b5c69f1", "comment": "Malware payload (Heodo)", "value": "963002f0b72426ae5eb3db9ebef095c6525a3143d336f665aea47e05fa22b5e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839624, "uuid": "73bb281a-e88c-4926-b1ca-7291ee8ed0dd", "comment": "Malware payload (Heodo)", "value": "a54f1d8f7c60418a637b4c9e01f8b1fc0ed1b435", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839624, "uuid": "74d0ada4-bbfe-4b68-a274-ebf287960015", "comment": "Malware payload (Heodo)", "value": "107ac1d3a0b9b81b895295337d649b3b4d281287a23b2a784c16fa53d6a2233add0ba3213bbefb0b2a7d2c3dbd4e9e2d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839624, "uuid": "d1415f80-ce22-4b37-8b07-fba5e62ff3a4", "value": "T10D94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839624, "uuid": "38fe06f2-e5c6-4541-8e4d-89f0c3db6fcb", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839624, "uuid": "4eaeb146-a38a-45e2-bede-49b000188b2b", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDvS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK/rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648839624, "uuid": "245e9e0b-6b01-4727-aea6-2237a98f42bf", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648839624, "uuid": "4e638db0-7c05-44a4-b009-2f28c2d8c9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839624, "uuid": "9058c81c-ba44-4c9d-8b7c-5e956089c1c5", "value": "xcah1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a694dc71-b19b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648804261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804261, "uuid": "aa82d271-e2b7-48d5-bdfe-4a6f67045769", "comment": "Malware payload (Heodo)", "value": "2752e35390844f06c22d0ce210144a37", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804261, "uuid": "132d4ca2-a250-4235-8b49-26a33996e83b", "comment": "Malware payload (Heodo)", "value": "973ba287f7dfc43d784e86150b9770f7b0b2b76a2f8297e0403797a7cc976888", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804261, "uuid": "9d588ee7-f2b6-4900-b906-9351bcaaa19e", "comment": "Malware payload (Heodo)", "value": "914b7147252baef3cc1e94cf0a15d7ff51f2dab3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804261, "uuid": "13adc1e5-aeb5-4acf-9a8b-0bb261d47b22", "comment": "Malware payload (Heodo)", "value": "34d37a5a9c3edc99195ee06a19277a2043eeb0171bc2da131b8f7112c058f21087d5a9d6703bd38d8847ce6a009d0431", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804261, "uuid": "3b52356e-9754-4e7c-9178-1d032fb67312", "value": "T11794BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804261, "uuid": "6e303171-30b1-4e1d-b487-db67881b7800", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804261, "uuid": "2c1a1c0b-fc7c-4df8-83df-00ae9fabedd9", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDXS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKXrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648804261, "uuid": "bed3b6b3-23b7-4903-95f7-c3bcbf9001db", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648804261, "uuid": "4fefebf9-bd37-4171-9839-8b83530994ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804261, "uuid": "82383095-e6f8-4287-80fa-d97f6d0c2365", "value": "MVF1GWKhC146ycRAXp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6716a9-b190-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648799575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799575, "uuid": "0cdfea70-236b-4198-99d2-f6c41aba1bdb", "comment": "Malware payload (SnakeKeylogger)", "value": "817c9caf13c2774a578bd5798fbda6f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799575, "uuid": "56a1a912-aef7-4005-b03b-9b9a2356fc3d", "comment": "Malware payload (SnakeKeylogger)", "value": "978b09687f74edd08fab63a866e5a6efffe657653e593d0c53f6b3243588ae95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799575, "uuid": "066725d2-cf23-4745-bcce-b65f82dee2d6", "comment": "Malware payload (SnakeKeylogger)", "value": "fb027dcc8194c4b5e6b00d9a8bee014030064123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799575, "uuid": "eade0c22-f467-426b-a3f3-d92c75f8080a", "comment": "Malware payload (SnakeKeylogger)", "value": "af2e661c6e81ac955d45e2778fc48c523b980a15d9391620d6971dc8cac368c1e1c60e0fa94a818307e5cf487de24f95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799575, "uuid": "6b4d440c-5958-421b-8891-cd86734613b8", "value": "T1EB94DFBBC7F9AF2FD59E12781410C46E3EE1DC83B554E815FF4B29A68A6B3A60150703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799575, "uuid": "883598be-6450-4a77-8b49-c7aa2c72c792", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799575, "uuid": "5f0c68b6-46cb-4370-a806-8de089627d7e", "value": "6144:Oc6P05+qsNoV1Q4aAxk/koGft6mRkDRtfP9kYzKfvw/AKVObawUQ:z2CSEo8oGFbWD7fVkjfRKVOuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648799575, "uuid": "97b3e2e3-7ba4-48c2-aab9-af8549ce4e7d", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648799575, "uuid": "57b263cd-b824-4805-b9ba-1598083ba6ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799575, "uuid": "b4db96a3-e8a0-4f37-8e88-f5954ddefe27", "value": "STATEMENT #65446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be8d86c-b1c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648824000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824000, "uuid": "76b8f2f2-d497-4356-959f-a68d38358034", "comment": "Malware payload (RedLineStealer)", "value": "4f9119c67f24d0a2b214db019aafade2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824000, "uuid": "132d7ec0-9793-4e2b-a51d-17e0fdf9723d", "comment": "Malware payload (RedLineStealer)", "value": "978b0c32e4c5b86af8105a45a539b77c3fd30cddf53946ee6037690dc6f715ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824000, "uuid": "ee381a03-3041-4536-a462-f3243054489a", "comment": "Malware payload (RedLineStealer)", "value": "5599049de174188f8772efe6e39625a108646d9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648824000, "uuid": "d29e7cf6-0751-4fee-afe9-1674e40512d2", "comment": "Malware payload (RedLineStealer)", "value": "85849eaa04514bd387c49dfa5c6ee9ebcac3d4d475ddeefda627ca0ef10870c1df0caaa18084755cfa0dd7f4a78c98b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824000, "uuid": "868997ff-45f2-429b-9922-0618a66fa70e", "value": "T19FE423A6FB55D42BC40E2A76A553F45A2BBAFE126A214B071F61F81DCE313813CC781D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824000, "uuid": "b40ad321-0c3a-4e01-be2a-2586c7c6d5b7", "value": "a007107f22bc0ed186791cc35f469484", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824000, "uuid": "98132378-3949-49ee-a2b7-47c7bfa7c0c0", "value": "12288:OrBKP5pPz0YaKv/LAzV2WiOEo956U3E0ElOMBzg1iiOwPKLEbRdYOvSMFjd7RX31:+BYzyyjAzQWIo95F0pfBzg1NOpE9dYO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648824000, "uuid": "8953b7c9-959b-4044-ae10-98ae2110d23c", "value": 698000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648824000, "uuid": "1ad295d0-7743-468f-ab8d-eae81560ffbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648824000, "uuid": "e5e9d284-a27f-4cbd-99b3-6f2a7c2e29e0", "value": "4f9119c67f24d0a2b214db019aafade2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2cd6c1-b198-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802905, "uuid": "b4bc0eed-45a8-4364-a4d2-01b444a7cf18", "comment": "Malware payload (Heodo)", "value": "684afaf74071b7570806d461955ef89e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802905, "uuid": "8a2186e8-e75e-42d7-a50c-61954d3b099d", "comment": "Malware payload (Heodo)", "value": "9806784c3128440830e881440f090913a9821c533f9b210868277af2f7bfec6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802905, "uuid": "a6684ece-637b-414a-be65-05f5f9cc4a34", "comment": "Malware payload (Heodo)", "value": "d6d96eefe84a2ad86c98cea830d0031d4147b211", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802905, "uuid": "08c6d7d9-31ac-41d2-b315-a0d5d14938af", "comment": "Malware payload (Heodo)", "value": "369d2f4577c7898bc5c8df200a491cdaa7606dd25ccf92e629fbb6f10c7963864cbb3b1782eb8744ff125f68ea08175f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802905, "uuid": "b181a5ff-3cf9-4d40-9106-1cd51a68863d", "value": "T1A7B4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802905, "uuid": "0539cbb2-b4bd-4b2b-a8bd-ccc306c24279", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802905, "uuid": "87c44ac1-f191-4ee8-8934-84ce9ed1cc36", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQ3JuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzBDIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802905, "uuid": "3e32fb2b-1fd4-40de-93ab-28a55aa2c3a7", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802905, "uuid": "cc361048-72b0-4228-90f3-d33e43f7b5f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802905, "uuid": "d6e62819-92cf-4efb-bde5-e848e11cec59", "value": "684afaf74071b7570806d461955ef89e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8487a78-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648800103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800103, "uuid": "e06da0fa-c405-4d61-b83e-923da0c4d251", "comment": "Malware payload (Stop)", "value": "dcd6910e363b5459f15987aa7d794555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800103, "uuid": "0a2d8816-d09b-408f-9b44-eb3a4ee583be", "comment": "Malware payload (Stop)", "value": "98dc8c7a341d23a417b681dcef70c286b55b7548de153ce7e43041e3129513b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800103, "uuid": "a30c15f6-123a-41a3-9382-62deeaa1d503", "comment": "Malware payload (Stop)", "value": "a3803cc1433575082921134cd6309f2aeb6a83a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800103, "uuid": "cfad4d1d-65cd-4ab3-ac59-481bf58f3123", "comment": "Malware payload (Stop)", "value": "4a648013cb7e7189eb3eddda814f6b0f490815744470e6bba003204072ddbfc9f57ebdcad2655a00fa156a7c3c886b54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800103, "uuid": "d449e1f3-b8b9-40e9-8012-23bec7a31623", "value": "T1400512F0325CC8B1D45B267094558AA1173ABC72E560984F32786A3E2F73FDC9AF164E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800103, "uuid": "2b3f8b18-45e6-4d1d-a276-d3d6dc42f4ef", "value": "3639259efd599d699775c282eb58d000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800103, "uuid": "477eeeb4-f6c1-40cf-947f-f812186e82d4", "value": "24576:vNPPXxUuXJcL9QRO04VXIJ6V6ib1ylH8unw:vVPxUu5cY/76UH8uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648800103, "uuid": "643fa6c8-c720-46cb-bcce-c2a9a5024c0e", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648800103, "uuid": "877913af-2d38-4268-bb63-03dcbddccf19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800103, "uuid": "6d7a332b-2f2d-40bb-ad8d-b01ec01e10e8", "value": "98dc8c7a341d23a417b681dcef70c286b55b7548de153ce7e43041e3129513b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac22085-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648835272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835272, "uuid": "a0f9d975-c8b0-4616-bb8b-fe6c3ed2a5af", "comment": "Malware payload (Heodo)", "value": "06b4511777c9f66ba12bbded0bf26f11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835272, "uuid": "38ace295-ee93-47f1-8e7f-2af9fa69aaeb", "comment": "Malware payload (Heodo)", "value": "9a18cee99d4c0ea53cbecdc0374a2d3ecd7da0634559fea0522258e766d635ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835272, "uuid": "e80cc9c5-60b2-44ad-968b-428cef173092", "comment": "Malware payload (Heodo)", "value": "2c113827d71251ec12cd249890d93129a06b3092", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835272, "uuid": "6084a96a-f846-49c9-9cd6-f22f8655e505", "comment": "Malware payload (Heodo)", "value": "7106a1378ffbef8944301236ffb761907af4c19dce1c5f9958f4362a1bf47f1ae6ba3dbf0d2c9d30ad8b402cf593d46e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835272, "uuid": "facd62cd-a958-4cb2-aa26-69762b58d381", "value": "T13394BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835272, "uuid": "a1410c88-a2bb-4031-8fac-518da8746086", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835272, "uuid": "7bb9d64d-43f7-4b4f-86d3-730c6355b1ab", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD3S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKvrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835272, "uuid": "f80fe1a5-748e-4520-adf2-84c50b1c8646", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835272, "uuid": "4ecd3c51-1dfc-4de7-bba8-7f9f7f0985cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835272, "uuid": "de88ed1d-f190-41d6-88d6-cd509f727d13", "value": "06b4511777c9f66ba12bbded0bf26f11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edebcb16-b1c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648823278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823278, "uuid": "bbcba75b-2c10-4ab2-a3ac-23b9d923d536", "comment": "Malware payload (Loki)", "value": "31abc77d7c8402e457fd94ea0f43f82f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823278, "uuid": "5e9dd02f-ac05-4b29-8455-65758f51ee1c", "comment": "Malware payload (Loki)", "value": "9abe3315fb8ffdaf1128f984194add626d0da9b68a0bfdd0d9dc7419634a5555", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823278, "uuid": "293b2d75-4889-4148-9147-ca1bbe4fc613", "comment": "Malware payload (Loki)", "value": "835ffee0037659eb82dc2c1aba147aa80ae7db98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823278, "uuid": "f0ed91f3-b71a-47de-9537-351113c8b4da", "comment": "Malware payload (Loki)", "value": "e81e5fb3b561d60aed1e628049abec1523a2d913b5913ff167a06b0de0a3dfd1c289ad926804dc002cb7643e3a6ca94f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823278, "uuid": "f3d984b6-60e5-4432-a73c-c8c786da07c0", "value": "T1AE3412190EA4C537C99316368B7E1BBB9AFF8F1365F1434B13106A2D7E2B190EA0D709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823278, "uuid": "5d748b6e-98ef-40b2-bb8f-b68950d5f1c5", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823278, "uuid": "2505f22c-76c1-4624-bef4-d0de52746e2c", "value": "6144:HNeZmXnyeyB8jbIFSI5aGLGL1Vrc2sfbysWaJ:HNliajbK5asSw2sjlWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823278, "uuid": "114f39f3-0948-441e-b3ce-7a7ede102012", "value": 238515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823278, "uuid": "32dffebd-523c-4a59-8766-c0c832e73ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823278, "uuid": "15df253e-600a-472e-ad6a-de04b3ab6aa3", "value": "31abc77d7c8402e457fd94ea0f43f82f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0c7688-b19b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648804245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804245, "uuid": "16de686e-5754-48cc-9536-e43b6ae7c786", "comment": "Malware payload (Heodo)", "value": "cd972993bff67a00910cbb826ba28cfc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804245, "uuid": "13339afb-9214-4303-8be8-bf6044799edf", "comment": "Malware payload (Heodo)", "value": "9b50853bf832d5df449a33bbe3ef5a04250326be3ed8fca7b188420dae6fe4dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804245, "uuid": "b0501ae2-ad79-48ad-9e92-16fd86326f43", "comment": "Malware payload (Heodo)", "value": "f6f236a319096f36bc5b40ea1d9bd3a327556d6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804245, "uuid": "ebb1ab73-2353-4199-be80-79fe93a59342", "comment": "Malware payload (Heodo)", "value": "110adad3b684b6b1d7bc4059a1f6921d9ecf19d092b3cb1f1e39ae4664879c6b572bc7fc9f988e6ce781f8691dc18c0b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804245, "uuid": "0e764e03-ee1b-4d71-879d-5e5c0684bf05", "value": "T16F94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804245, "uuid": "08f756e8-0092-4968-9e76-a16a0e016cd9", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804245, "uuid": "17351434-7da7-40cb-9bf1-5234fa775927", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDWS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKCrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648804245, "uuid": "2ab8872a-6188-49df-862e-2d36e403a46e", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648804245, "uuid": "fa74b073-ce95-46b1-9bac-19d35ad8dc7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804245, "uuid": "3c922435-ce55-4588-afc7-db25bb77525f", "value": "TPu2xyLBVEWpx47fS.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4733036a-b186-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1648795081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795081, "uuid": "3da6c8ed-fe57-4423-8b6f-2a1f6b8db0dd", "comment": "Malware payload (Nitol)", "value": "9dd767e5903a81a36c454e2021510755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795081, "uuid": "02e4cc03-3dc6-4d01-a385-387473cd875e", "comment": "Malware payload (Nitol)", "value": "9bf9708db2702d1dff5fa6054fd452a41a78d0833ac70ec80e4d59abf22de133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795081, "uuid": "88c400aa-2ffe-4431-883b-e3ba39af26a8", "comment": "Malware payload (Nitol)", "value": "1d212b4cb08fe5398f61dd65be9fe57e491659ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795081, "uuid": "6bf9469f-d038-4264-8029-dd41687cac07", "comment": "Malware payload (Nitol)", "value": "d5adec72e85f4edea35f334e4754b1bb6f6fc7484aa13104561d65fe9291eece1b0c5a1c344f724864fe745184e638b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795081, "uuid": "993f2f2c-0669-48bc-9a34-c95b0caa52a8", "value": "T1FA949D05A7E3C030F0AB62F4497693B81C29BDB45B7094CFA2E667DA17A46E76C30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795081, "uuid": "d3af1d01-7e8f-42d7-ba7e-16ce331cef58", "value": "cf698c08142c955b41e3defb9b8ad7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795081, "uuid": "4d1623b2-a14a-47b4-9191-6776ba737994", "value": "6144:FMJ0eUrqA4A6L/BGpGbIJ7TsQla1N0YntMQyQsz86BXl:+J0eOqA4ACGp6T31jnBOz86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648795081, "uuid": "2d0fa031-c255-48b3-9323-3bab77c64a09", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648795081, "uuid": "439cd9f2-5059-4c68-ae63-654bb9a1ae72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795081, "uuid": "5457ffbb-4e83-4e54-82fe-ee3eb437a12f", "value": "keto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495361b3-b1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1648826438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826438, "uuid": "9db5059a-0472-478d-9a7b-8d1a9daa7717", "comment": "Malware payload (BitRAT)", "value": "5ca1ae707dfb250a35f3448057b06edf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826438, "uuid": "aaf65d7c-bce0-4ba2-a6ff-38cb7c1660f5", "comment": "Malware payload (BitRAT)", "value": "9da3b66a2cfc42a13a57ffe74113070a5e9243ca143de869db04596292ef2f0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826438, "uuid": "2e796742-cec2-48cd-8b4b-bb52632df68c", "comment": "Malware payload (BitRAT)", "value": "0e617d05bd6ee52f149be68acc154c8235965882", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826438, "uuid": "0b90953c-1d0f-4cab-9079-791bb99fb5ee", "comment": "Malware payload (BitRAT)", "value": "765503187e1951515adf2f3f00546bbb4f782abb1fbd31136e52bbdaf211515b40096aa40a33e59ea1fea5d2fb95c32d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826438, "uuid": "00a1370d-6aa6-43b1-a133-475330c23015", "value": "T1C5F5C05D22864849FDC1D3B9D8BB5BA92761967148EE0343B3F5253CE86F37E2E50B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826438, "uuid": "e3504e63-6bc7-43ad-9fc7-3b31cf31a7d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826438, "uuid": "a8f89110-9015-4860-9fa0-366a5d7b999f", "value": "49152:pO97ROqKk/KZaOsEr8AbcbMiJhxFmtr6eMz7tkoRhDTA7u/ArJl29o69EieMX:s2bZrVgAX4sr6eWfAFvwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648826438, "uuid": "5d7e8b6d-b2cd-434c-883b-c8851be72c14", "value": 3580928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648826438, "uuid": "29cfe94b-0c20-4d92-a804-00b9e908cdcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826438, "uuid": "cb543473-0422-4585-a24a-4488029d6d81", "value": "5ca1ae707dfb250a35f3448057b06edf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726c7db5-b198-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802885, "uuid": "dee4de04-7f24-4d79-879b-a4fcc2ee1789", "comment": "Malware payload (Heodo)", "value": "4f1a510b5b5fa255a4fbd82aa4d87b26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802885, "uuid": "04c85c2e-3f3f-42ac-9524-39df9dc2b20a", "comment": "Malware payload (Heodo)", "value": "9e871029189f7aad4619a21e2dba078a42a4283ff3cd667f493fde9a4b444bec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802885, "uuid": "28fdf42f-435c-426c-928c-1bb75c8b533a", "comment": "Malware payload (Heodo)", "value": "066dee3766379725548f9f659cfbcd6688a37760", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802885, "uuid": "18665a19-9635-4567-916c-99d784a27793", "comment": "Malware payload (Heodo)", "value": "130e8b3879f80f13e7bbf31981cba10475450a4f8a2c49e3134289a2582bbbe777b0bfae2c7527ef9cf0ed251fe260af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802885, "uuid": "b9a11e94-913f-4cdc-ab44-9de16c2992b1", "value": "T18194BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802885, "uuid": "bccc8c73-6ec2-41eb-9931-4837645eff33", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802885, "uuid": "6852b7cb-4691-46dd-b6f9-4833fa3c1d22", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD3S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK3rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802885, "uuid": "9f52cd3e-2a26-4ac5-a4a5-d432b4c9b24c", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802885, "uuid": "dcba27ed-b94f-438e-b374-5323ef608cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802885, "uuid": "91e438a6-3704-414c-a3a3-d491b5844bf7", "value": "4f1a510b5b5fa255a4fbd82aa4d87b26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8749245c-b1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648820529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820529, "uuid": "ca591a05-abc0-4158-b3d7-48a669195e89", "comment": "Malware payload (Formbook)", "value": "e0213cf3bd4ca9cfd094272ed98c37a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820529, "uuid": "567b8f65-731e-4691-8dfb-fb99e9f7304b", "comment": "Malware payload (Formbook)", "value": "9e94ea964630e088c92a9caf37bbf4e9716e9490142e58f3ba84042b02461021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820529, "uuid": "7c7c7beb-73d1-44a0-930b-a596225388b4", "comment": "Malware payload (Formbook)", "value": "704402640a854c50d4a787155d4eba19829106c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820529, "uuid": "372faf3b-46f7-4a18-bcc3-79c666489635", "comment": "Malware payload (Formbook)", "value": "ebfec02ab1a45c720357239ba30db4f9e788eaac4a8d8ea97c823d4fb8e608365b2cfd1f2ad4e5f4f7271e0610fa2034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820529, "uuid": "028a5b7e-3082-489d-91cb-121a92547263", "value": "T1FBC47CAEF2F07ADFC85BC07289581C68BE5078A7631B8503E11715AADA5D9D7CF103A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820529, "uuid": "dceee3ff-824f-4548-a5ef-485cac705425", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820529, "uuid": "8cd54fd9-6c5e-4d8f-b40c-f27e142081c2", "value": "12288:YhAgAIs25v5+Yzr9KtMsIUFVhwsAsK4POYiUmjclhVkOHdSMV/8pS:Y15lzr9F3UjKZsK49+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820529, "uuid": "ca6daafb-2e5e-42a7-a424-13b6f6bc2769", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820529, "uuid": "e27516c8-a526-4be4-bb44-6d6ff9c044a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820529, "uuid": "050064fc-f662-40f1-b9c1-4fe7b6d13c5a", "value": "Pump Parts & Stainless Steel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e607781-b1a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648810206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810206, "uuid": "f8e93743-28b7-4d2e-ac0b-2deeed1fcf0c", "comment": "Malware payload (Mirai)", "value": "8da0a37113b93d8ba3191376b2d727fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810206, "uuid": "e9dfed03-b933-49a7-9ef7-0279dea36ebd", "comment": "Malware payload (Mirai)", "value": "a07a0e549b488447c1ecc713da707da50fc711a83d5e4b70a0f349def39ab31b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810206, "uuid": "583c6879-e312-48d3-ba24-e0f5ff5eb7bb", "comment": "Malware payload (Mirai)", "value": "8f31c9baa75ae53fc9b60718f0bf7fb2a9fddf63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810206, "uuid": "f05483b3-eb8c-48cc-abb4-0b9064665bcc", "comment": "Malware payload (Mirai)", "value": "e659c0cfd6a6e793c4a52c3fec947944997177dafd3c9f559e4d7efa8652fde0331dc32c35c679ecebdf832a78b91177", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810206, "uuid": "0f3d4d00-7019-42ce-b648-120c5a2b2b67", "value": "T19AF2F1B02AC5D1E48EE2247FD55A40033E4B0EF5FDAA7AF355102578F8B30458BB8697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810206, "uuid": "2569b424-1020-4d90-8e6f-c5a1d6d0369f", "value": "768:BuE8yWZ8S17oLz3k9TUtk+IXbxqXnzSSThh1ulUzJx3U8:Bp8ys17oLA9TUtAbxUSSTzclw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648810206, "uuid": "73506cb6-7ab4-4a34-b059-8d9a4aa505a6", "value": 35116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648810206, "uuid": "3e7a0bc1-2e25-48be-848a-fe1aa76a942a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810206, "uuid": "ce367784-96d4-44ad-9795-8e0ef6d7d2e7", "value": "xmogum.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a43920-b1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648823320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823320, "uuid": "9435079c-b950-4c7b-8fbf-e7216c43909f", "comment": "Malware payload (Loki)", "value": "348f3fa85be26eaf45471ac2b6f28f5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823320, "uuid": "bc03ade6-6b19-4802-ad61-36070b4de33f", "comment": "Malware payload (Loki)", "value": "a08a8aaa67f65ebe4ad2b3af52de80f9bdb4d05f7114e2d323af5f40386e984a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823320, "uuid": "43dcd678-f5a3-4ffa-9d5a-701aab98030a", "comment": "Malware payload (Loki)", "value": "1154263e760ef93a81c9eb8013de170e8cbd4ae7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823320, "uuid": "4b633a07-f71a-4472-984d-74af710c89c9", "comment": "Malware payload (Loki)", "value": "0dba2e7f695801944d95b997fcdafca44ed49c6ec3904c24b192934581361a39334724468984a3a060e1dba33b8fdcc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823320, "uuid": "d3e33fb3-3ff7-4200-849e-93d189d22520", "value": "T19734125C6B90C077F4E267B20DBBDABAADF989272465021F53305F2D7E34682562F701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823320, "uuid": "b10a674c-59fe-40b7-997f-13415bdda7be", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823320, "uuid": "8e510a9e-d297-444e-bf71-015dc5f26e3e", "value": "3072:l1NjcVVnLpPunbYxApqbK4m0EgQjAprPcncLUutUV6rVrHPkdlzFw/DikcaXPb2f:HNeZmyApqHm0tUutRDCFeiMaGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823320, "uuid": "7ed999f3-b7b0-4ed9-95ba-843e09550e7b", "value": 239325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823320, "uuid": "af29b494-bcbe-4145-8cb5-b46dba3d270f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823320, "uuid": "18bbdcaf-990f-4e23-95af-764be71040f6", "value": "348f3fa85be26eaf45471ac2b6f28f5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa73b53b-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648800107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800107, "uuid": "e215ea7d-dfd8-4401-9950-61827c4b6dbd", "comment": "Malware payload (Stop)", "value": "6e5b2a19f3cd98e4d797b2185152606f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800107, "uuid": "2e868fab-0b43-458b-b3aa-08b56d7249a8", "comment": "Malware payload (Stop)", "value": "a08d308902b9494ee1a0d38e4c7cb5dc91e302efc8e869be3c2ec0394034fe06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800107, "uuid": "0aad19b0-3e41-4e60-84bd-33d29aeded2f", "comment": "Malware payload (Stop)", "value": "3bb494eee626b7c94bf3ab8ffcbb7c429fee5885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800107, "uuid": "8a3779e1-ad33-481c-aea3-2d270f890c7d", "comment": "Malware payload (Stop)", "value": "8564d0024241053976512aa9c76da82ce7f76417893e88e78e0b10f72d66f93fadb6d8d650e91d2a27b7a800dde2f572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800107, "uuid": "fcf138e5-9cf5-4a8d-afe2-4773067df915", "value": "T15BF40110BAA0D035F1B766F06A769268B93EBAF05B7091CB21D515EE5B35BD0DC3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800107, "uuid": "4a9a8782-f9fa-4034-8aec-5ee45ce1d10a", "value": "4b0932ad38c639ac88a395249c08ac7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800107, "uuid": "68685b93-2920-41ff-860d-c562441d1af3", "value": "12288:qHA1xzfcP4pipHhaMgaPThjeT8GkTxqJEZWi1c+fLzASk2q69520LzzxoUAhxi/1:qsHpeFfh+8G+xqaZpnASk2q63XzqUAhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648800107, "uuid": "afa3e7e3-2200-4bec-a353-8a8a98be0b6e", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648800107, "uuid": "807a71da-9c6f-417c-b54b-9e7898f0fb41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800107, "uuid": "09cb251c-f727-4100-a355-0269f718a0e3", "value": "a08d308902b9494ee1a0d38e4c7cb5dc91e302efc8e869be3c2ec0394034fe06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6970e3b-b199-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648803456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803456, "uuid": "73dddb5d-ade1-4411-be82-5746ee2cf252", "comment": "Malware payload (Heodo)", "value": "2f329ec40f370571407102419b506d89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803456, "uuid": "86d71eaf-04d1-4afe-9a58-de55909a3210", "comment": "Malware payload (Heodo)", "value": "a17416ca34ffe3482e69df4ac22c6b5018ded4a5f811ddcc96962da1af8951b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803456, "uuid": "aa1d598a-23b2-4e50-ac05-0725bc7c27b3", "comment": "Malware payload (Heodo)", "value": "ec93ff134a16fcf2986e41607817e998c5fb2328", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803456, "uuid": "0515122d-74aa-460a-849f-aa4bf478c3b9", "comment": "Malware payload (Heodo)", "value": "ac3ab5d0c001ed4217a6caf78d89af3d8b80d44adfda9ea8891efa93318c7750c477d911056356afda96771ad42050e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803456, "uuid": "b140170a-3cfd-45b3-97ec-ae3f53bb7d1b", "value": "T19394BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803456, "uuid": "ca7eacf0-d53b-4c6c-8cc4-8182111d5fa7", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803456, "uuid": "6f8ef90d-f02a-4f87-badd-f83e3129c9e2", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDLS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKrrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648803456, "uuid": "1faa7266-9f6a-4ea6-86e9-cf4e77702fc4", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648803456, "uuid": "f6a5f77c-1f8b-4465-a57e-1c6ebb9ab9da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803456, "uuid": "5a3c0caa-0b14-41ea-a923-d32f11af35c7", "value": "2f329ec40f370571407102419b506d89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d69ea5-b183-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648793811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793811, "uuid": "077e1e33-e722-4d86-979d-2b8e4bfb5070", "comment": "Malware payload (Loki)", "value": "9ba38d3c373eba54840db2cb3260e4a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793811, "uuid": "bf6d41c7-8987-4a66-866f-1b3f43d8240d", "comment": "Malware payload (Loki)", "value": "a34878e8969c926647a4e54cc4a5d717ba86395297a4105a8adcb238719de298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793811, "uuid": "c9fab36a-d0ee-4fce-a72c-4dae63a2b1ee", "comment": "Malware payload (Loki)", "value": "cfeacaec16470e63f3d7b9fc15cb300cfebce673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793811, "uuid": "eb29370e-4118-4c04-9830-769d2d453e6d", "comment": "Malware payload (Loki)", "value": "61913d1018728bb61eb7d231902a10ef2f3ddb0be6f2a46ae67ca170b2aa059ed52d2a3cf8c8c8bb68d4429c1e0e2b2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793811, "uuid": "174f83bd-5251-4b0f-9883-15c7f4574711", "value": "T18F3412693790C01FC4A20A329E39D7EB3FFB552201255F5F0BD4AE897F666C18A0E716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793811, "uuid": "39eba05a-37e5-44e0-ad39-e4b7c649eaa9", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793811, "uuid": "0b463d01-3004-4d2f-b804-b025d1561826", "value": "6144:HNeZmlVYK03IgkeIQnuR5ljwWrCaTEhtTR8xm0XwCWl7spfoH8r6:HNlCvI70c+8xmGwC+4p88r6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648793811, "uuid": "b787c09c-91af-4571-a4f4-332139e837b1", "value": 240651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648793811, "uuid": "54509696-5bd6-4da2-892f-9ded5433c9c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793811, "uuid": "5d5a7e20-1417-49ae-9993-f54acace58db", "value": "Order for April.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43a084c-b1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648822403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822403, "uuid": "7d52a796-3c1a-4052-8a14-f27861be1584", "comment": "Malware payload (AveMariaRAT)", "value": "327614bb4aab155ae47187974661f33b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822403, "uuid": "097fcd5c-c3e7-4156-b6af-aa062014f44f", "comment": "Malware payload (AveMariaRAT)", "value": "a3957ed9378635044a9d4bc83444ef96968a7502ffda6b3b055aba6dd60163d6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822403, "uuid": "886de854-7d1a-4ad3-8486-f7db2919e4ca", "comment": "Malware payload (AveMariaRAT)", "value": "5dc759bcfc0519b93e22d2c648143af9dcf45e4f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822403, "uuid": "5d127ddc-afa4-48f5-b24d-95f0fc18c865", "comment": "Malware payload (AveMariaRAT)", "value": "041a9287bd1831c751020f89a8c3e2046261d3744890d02da6e5915c88360cb89d1fa03f3790168c24ccb0af77428580", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822403, "uuid": "0ac98453-2476-48a6-90c2-c5d2a151e4b8", "value": "T139513B34DBA2122ED2B74A37DCEA6607952D3C43EB6D9F9F0142438550A1216A1F7F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822403, "uuid": "6701f667-ec26-4e0b-b928-fab5405e3df3", "value": "48:8v5aw6MISknyk/knbtNRnCz0RVEQ9AItB:8v5nFtlaaAMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648822403, "uuid": "337f9ef0-2076-432c-a370-c8ec55f8b15a", "value": 2676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648822403, "uuid": "603cc79d-f855-4c88-a515-31d658205548", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822403, "uuid": "b64101db-d757-4ba2-bef5-558fea9027d3", "value": "SCt5879498.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d64b0f-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648819982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819982, "uuid": "ab381d70-e55a-4ea4-8ea1-d694898c7f36", "comment": "Malware payload (RemcosRAT)", "value": "37d32dddb87d661ad0c66ad2d417ffcb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819982, "uuid": "ee8e8373-989e-457a-801c-9b579bd6166f", "comment": "Malware payload (RemcosRAT)", "value": "a3d08a4bcf30bc1eb141643c55025dd2d03550262e21b04624baf368b18f653e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819982, "uuid": "525f43c5-e97e-4bd5-9009-8fb39a5139c5", "comment": "Malware payload (RemcosRAT)", "value": "cec0a9a01b4c98f34553dfd832801ee9b99bda75", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819982, "uuid": "2e392673-e8d2-482b-8139-b494f8952f18", "comment": "Malware payload (RemcosRAT)", "value": "d42bf1d16144fe44e8e583f1297f0b847ead1bc434799a2ab7160bf8e33346bebc0dc3645122a1aa7bda6332e8c6ecdc", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819982, "uuid": "51d1279f-3ab0-455c-b309-67180a6e0479", "value": "T1A151124EB58F765463325EB29C0B084DD5734787F67A01A03A19CADACE3626CE7C982C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819982, "uuid": "bc51de3e-665d-4ac3-a003-7f08982f6e92", "value": "48:9PTBTlqxfp6w9iftkxSSJ01rS80OyWVrDOe1EI10BdUN:9NZqxfwMMQJ01rS8fp1EI1JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819982, "uuid": "c6074ceb-a138-4927-8a88-e1561654ca67", "value": 2778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819982, "uuid": "341ac443-f8f5-4bfc-8ba7-e98e9c410c18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819982, "uuid": "985ee347-937a-4a8c-8468-596bbddece67", "value": "PONUDA P771.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15ad38c-b1a3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1648807742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807742, "uuid": "a26261fb-d047-4d02-baae-e92be9a3db18", "comment": "Malware payload (AZORult)", "value": "a25f556674ab5a3cbf291971450f43f2", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r20", "colour": "#C0872D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807742, "uuid": "9d960c5d-d2e6-405d-9f93-00211867736b", "comment": "Malware payload (AZORult)", "value": "a45050c77b4e39ac5aeea0252fb07b995c6160f8df2e7f726f51fbef7f0d6930", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r20", "colour": "#C0872D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807742, "uuid": "cb405855-b6a7-4741-abdf-e83dec5bf254", "comment": "Malware payload (AZORult)", "value": "c35c17b1557f5ece6985c101cc749c58686ad437", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r20", "colour": "#C0872D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807742, "uuid": "5864f393-7ac1-4b8d-8730-9d36e958c431", "comment": "Malware payload (AZORult)", "value": "74afeb5893bad14435278c3d8778b219c9b1d61a46dbb593015af186a21b39dc5668a7a89be147d2110030a5e441d015", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r20", "colour": "#C0872D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807742, "uuid": "ccb4c7ce-ae52-44e2-9d3e-ce3e874d0711", "value": "T1571533713E8C4EFA1A5742C3DE376A76FA8E4010903620DEFFD1951661D69AADE0339C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807742, "uuid": "b7a85d4f-84e3-42dd-80c7-f197b657c057", "value": "24576:QEIY4ncB3BGA3qcW1HZnbJQPT8kpfA3nAQ9ETi1D:QEw7Dcc5lkg4nRWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648807742, "uuid": "9b534032-7a07-4880-86fd-9bf22b36a4fb", "value": 953574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648807742, "uuid": "cd5f11df-951b-4c39-a54a-669bea546baf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807742, "uuid": "a1e30db5-7d55-44fe-b7d3-896592517068", "value": "PRODUCT INQUIRY 2022.r20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a197de8-b1f5-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648842787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648842787, "uuid": "93fdee13-74f5-4ae7-8cd9-9b57f011d29d", "comment": "Malware payload (RedLineStealer)", "value": "2f2dcdc011f951b4a4d45fa131e75f67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648842787, "uuid": "f560be87-79b8-41a0-b4fc-e2a978c5465f", "comment": "Malware payload (RedLineStealer)", "value": "a4c3cc1e3e1a88896655e80f601a84b226c0ce2e1d4d8f1cec3b1d400128b2a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648842787, "uuid": "6492dbd3-68da-4774-866a-0b77b2fb2f05", "comment": "Malware payload (RedLineStealer)", "value": "f5cccec1decb354fd1c3ab71be8cc52eef74631b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648842787, "uuid": "9285809b-483e-40d5-8465-84f75338c74e", "comment": "Malware payload (RedLineStealer)", "value": "499dfaea066089c50469f92834b0035dc653b6c092c8ccc827cab414415217acf62b100acc3da39e624665fde1574a10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648842787, "uuid": "73031316-3210-4765-8a0e-ecbc9a88c16c", "value": "T1B474BF10BB90C035F1B326F499B993A8B53E7AB0AB7451CB62D516EE5735AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648842787, "uuid": "a71c56d3-1c62-4893-971c-f318b2cae933", "value": "f22c415437cc9d7cf824990538373125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648842787, "uuid": "5301fd8a-ce1d-40de-a261-9122fa01a26f", "value": "6144:7YylB79UYnZ8D5AQTDfjvKFtX41JsrRoLbf1WCTHNwV+s2k+qYJCP5:7Yy7ZhnZ8NAE/iFtI1JsryxNTaV+sNGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648842787, "uuid": "16475ae2-d969-4913-9028-5cab776cb0bf", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648842787, "uuid": "122064a0-03b8-46d2-80f8-20f777daab5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648842787, "uuid": "ccec90a7-a76a-47ce-a27b-c1bad02487d4", "value": "2f2dcdc011f951b4a4d45fa131e75f67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e5a5b7-b1bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648818106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818106, "uuid": "8d795631-ca35-4810-8156-d390634d0edb", "comment": "Malware payload (Loki)", "value": "caeb634e8d251a4920206caeeaac3c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818106, "uuid": "8a910d8a-0fbd-4833-965d-da0797a91b7d", "comment": "Malware payload (Loki)", "value": "a4d51a3f59873bd7ccc504fb98c09e0bddc883e1d75dfa89a20550b5448f61f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818106, "uuid": "a545cd8a-85eb-40a9-a12f-5729f6b0b8b5", "comment": "Malware payload (Loki)", "value": "03f0b94fb8765be7a77d5d862a67eba03359dc01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818106, "uuid": "b1d368b3-0d35-4ec7-b10f-dff715a28bad", "comment": "Malware payload (Loki)", "value": "eba445181f55244cb0baa9de39b16d7019b005ee8a4b31484800edad88725b56e9e74fbd9b7b49db39bc7cf1e5cb165e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818106, "uuid": "8899a754-9ec3-467f-af1f-19bdaea7b53b", "value": "T1B23412511A94C843DC6116306E761B53A7FEEE2A14B9490F67248F6C3EB33F4DA0D3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818106, "uuid": "48ada0fe-79b8-4174-92c1-6bd678669a6f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818106, "uuid": "3ae18788-4b5c-4b2c-9a8f-37937f9cf3c0", "value": "6144:HNeZmL+utGWR8CDEGIn1Rj2PfQq9qT+Ya0q+SBEzju+sr:HNlL+u19bARkf9s+90q+MES+sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818106, "uuid": "2547f07f-3773-44c3-80ff-6df9a9c4e646", "value": 240314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818106, "uuid": "6248c1a0-e44d-444b-a261-2d545dd817f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818106, "uuid": "32f06f2e-93bb-4d18-b582-7a4592f38737", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503e0da6-b1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648822584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822584, "uuid": "9468cb37-ab69-4a56-b89f-21f8e832dc50", "comment": "Malware payload (Loki)", "value": "e1b14b08d8068fc36196139b110ac51c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822584, "uuid": "c2235881-b85a-4314-b51d-0717df016016", "comment": "Malware payload (Loki)", "value": "a4f55927475d426adc574e8e79fc931065f09e5d7edbf436157a2436cb716331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822584, "uuid": "872e9402-33f1-46a1-bed0-b4369bc1e7fa", "comment": "Malware payload (Loki)", "value": "f66f6c5adc38d17f8efa4dc1ff1efed3336d8dc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648822584, "uuid": "df77ed65-c9fb-40f7-8d39-befb8888a772", "comment": "Malware payload (Loki)", "value": "406ea11e50315344900435ceff3ccb5dd72e336a908ed4cc6524f31c33b6c1a1c53d4004e3605a49f2867874a3bbd17b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822584, "uuid": "1c049a59-959d-4a66-aa5a-affdfcf33393", "value": "T1C064BEF1739DC8B1D057363094258AB05B2BAC21D260558AF7796B2E2F73ACC86F135E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822584, "uuid": "b6ffa322-40ae-4dc1-b011-c6061c948f97", "value": "922156201fd93362d05e92765cb2408d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822584, "uuid": "a40e625c-e52c-4ea5-887b-d1248c41c25d", "value": "6144:y5jkPWoUB1hcyzkPnmBuzbgwuO0Q7ITsq4JBTkwVfR:y5jloUB1hcEkounnwQ7FJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648822584, "uuid": "8730dabe-0eb5-4e7d-be49-8427fec9907e", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648822584, "uuid": "d272d560-65b7-4202-a543-be5481005629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648822584, "uuid": "d8b6f7cc-a1f1-47fa-b103-f3f37fe6d556", "value": "e1b14b08d8068fc36196139b110ac51c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803f13ba-b180-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648792600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648792600, "uuid": "8cb23021-c469-4eba-83ff-298ff255c7b2", "comment": "Malware payload (RedLineStealer)", "value": "011f2b76b3dcb347377f73b2c94b80ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648792600, "uuid": "144f1050-a166-44e0-a281-6de46aaf9490", "comment": "Malware payload (RedLineStealer)", "value": "a5072c297cd80acffd9da5124dd8ff867da5abd6effc2dabea853fd93a8cccdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648792600, "uuid": "564bf7c0-dd07-4709-a6cc-9825923e9317", "comment": "Malware payload (RedLineStealer)", "value": "7fdb58e73995bc7852fd34ee2c56933c090282f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648792600, "uuid": "c454a15c-8914-492a-b80a-f4c7ede573b3", "comment": "Malware payload (RedLineStealer)", "value": "a3493e2423a8527f535a132154263b5bd85e78a020505e76e8bca0fbd94659013661d14652f9f1d8a23102e821b908a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648792600, "uuid": "8a3d5c5b-e18f-4cef-bd77-f964b9badb92", "value": "T1F6A63330799C23F3D1100C344D4C7B91653BE368E726469BA7C0DF866F6CAD8ACA9697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648792600, "uuid": "9c377ba4-f6ec-4501-9f2c-171ab798280a", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648792600, "uuid": "e036d98b-4cb7-45ff-b0f2-d6dda9af04ef", "value": "196608:x6ri6u89erur8IdFAnoJUU7iqbMtS/Oxho7/eQLMfHawZ8l3YmUh53totI9eX:xH6umeKrLda20S2xyLLM/agl3qbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648792600, "uuid": "3f41715f-5d57-4c52-b3f5-5268aba33d54", "value": 9965151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648792600, "uuid": "f9f1924a-7c4a-4271-9aa8-d822f7389121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648792600, "uuid": "5d8b43f7-78fb-4c82-9659-8c617ef0e539", "value": "011f2b76b3dcb347377f73b2c94b80ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da83d88-b1ae-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648812245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812245, "uuid": "22b74c48-5834-46f5-9f7e-6ba0f754bf25", "comment": "Malware payload", "value": "6f5adfefa387a58aea334ec05350dc98", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy Agent", "colour": "#8F58B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812245, "uuid": "a4233f2e-a981-4d2c-ae1c-7f3747c41e94", "comment": "Malware payload", "value": "a557751cd3f618ce1d12aec29e33328f2398d6f5695da55786f62c16dc689b0a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy Agent", "colour": "#8F58B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812245, "uuid": "937d8498-0d4d-4d1e-a8d1-07fb1096878b", "comment": "Malware payload", "value": "a5b8aa35e969abc783a00345ee5b7505fef8762b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy Agent", "colour": "#8F58B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812245, "uuid": "fb05e012-49ed-4b42-897e-9aadfa4df61b", "comment": "Malware payload", "value": "baa161d00ca0863ad7b73a43389bb894b7686e974e5f48334fdf34599acdac94892ef2fc0b7b79d8072f5d4a46ba8194", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy Agent", "colour": "#8F58B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812245, "uuid": "554a72ec-795c-4fbd-9a10-86bccc03698f", "value": "T10EC5F142F3D9AD2FCC73C0334BB61636554A8C5ADA46E3076564B36C6CBBAD44E81BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812245, "uuid": "799a59f2-17bd-44b4-a835-2c4b53ee8352", "value": "49152:d8ULMNzmWNmAKNcb69+TUkLOIbOC+bcESg1znEj0N4vRrktDu3IpLM/0:ddOmWNGNp+TUkLNOVrEj0eN0DuJ/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648812245, "uuid": "81dfbfb7-4cd7-4889-a137-c11fb8ac4d32", "value": 2575444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648812245, "uuid": "4ffad49b-a52e-4290-8e95-78ac7cfe73a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812245, "uuid": "b3575513-95df-48f2-81a7-3f0f91579489", "value": "condominioweb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db637604-b14f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648771708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771708, "uuid": "9f4dfd3a-b27c-4e3e-b395-043c57251b1f", "comment": "Malware payload (Heodo)", "value": "2347c3ffe95ff99ee35dc99ea83dce33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771708, "uuid": "9080c09f-e7eb-4e9d-980d-95b380c3d3c6", "comment": "Malware payload (Heodo)", "value": "a5da86750d6172d797804a1d86f4956ca6bdd505ad379c9cf1405c1c76f10a7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771708, "uuid": "f49f4147-d7c1-40c9-88e9-7c88d31d84ba", "comment": "Malware payload (Heodo)", "value": "2d89bfa8345b6324efcf102f7b49fcdd604eba69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648771708, "uuid": "04e496a4-7dcb-4830-9275-e626917da9c0", "comment": "Malware payload (Heodo)", "value": "f519975cdef32fbfb3630b777bb1de150b9f0431091465f9dd8ced6ea47d228d6cd9a384676d4f34ffebbe0f5b022e53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771708, "uuid": "81bc2a14-2a42-46da-abdb-8fde8caf4fa3", "value": "T19FB4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771708, "uuid": "6931dabb-ee99-439b-9384-797b6611dd83", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771708, "uuid": "67f5b179-021b-4d72-8375-bcf0bfcfc992", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQ4JuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWz0DIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648771708, "uuid": "44d46a77-789a-4a10-93fa-f32c9cd65ffc", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648771708, "uuid": "8c81fe5f-9d83-4f6c-91a1-108d1184af09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648771708, "uuid": "f5f1eec3-5e37-4488-b4e1-c1a6f5549bff", "value": "2347c3ffe95ff99ee35dc99ea83dce33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee09c7a4-b1a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648807387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807387, "uuid": "04eecff1-da4c-468a-863c-186db308d107", "comment": "Malware payload (AgentTesla)", "value": "57db8191549a6524ed1dcfdda1f25c89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807387, "uuid": "06e67af4-377c-4912-8d4b-c269de585c36", "comment": "Malware payload (AgentTesla)", "value": "a7a5db470ea20fedacb5cea25824519a3cb3af612a0f1168fb6aa98d02cff857", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807387, "uuid": "19ce3618-2eb0-46db-84ac-fd06411ecfa5", "comment": "Malware payload (AgentTesla)", "value": "39c14c0caf049bc33c3e53c7513cad5a223a877d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807387, "uuid": "66900894-f96d-4216-979b-580fb75e350e", "comment": "Malware payload (AgentTesla)", "value": "523d294e14ab9b95d3d7fdd410ae7e72cd6471f8a2aa97784b43c0ab601a949e6f0236c41f68a039b14dc54ac3ffa85d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807387, "uuid": "f9d16448-6099-44b8-a715-78420d32cc44", "value": "T1F9D4F11FB6E5CE02C77742B5D8EB211103799F4AA163CB892EC9B3840EF23925D4A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807387, "uuid": "9ef9f997-ca63-4fcc-831f-7252ab4d47e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807387, "uuid": "b7d56b6d-a649-4850-b3c3-ab93605d0499", "value": "12288:otoLlWKxRN5z2rdDP+FykCD0p0A4II2P2WjLSGu5:i212rdDGck7B44PbLSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648807387, "uuid": "230e4d58-121d-45c9-89b0-6aee5a2e0c68", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648807387, "uuid": "ea074746-be5e-45ca-ab95-837a3c0f1d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807387, "uuid": "fecc8681-d798-43b8-8e50-4126970461e8", "value": "PR 11442066__S10-346-17 PROJECT__S10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77443ab9-b1a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648806329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806329, "uuid": "f5c8d4ce-eba3-4703-845e-0746bd62532b", "comment": "Malware payload (Heodo)", "value": "17efe95d071c648f0847316bb156a144", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806329, "uuid": "b3090a8e-9642-4498-82fc-fb35b16ed327", "comment": "Malware payload (Heodo)", "value": "a8d5a23dcda8c300b25444d3a5d9a5494f935a13d9962cffef8c72cf194126da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806329, "uuid": "5f13d73b-830f-489a-998a-af2d92306adb", "comment": "Malware payload (Heodo)", "value": "308df279a29c106c5f6b521933aec0710d77105e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806329, "uuid": "7acf3fba-4588-4699-9758-6ce5384aaa49", "comment": "Malware payload (Heodo)", "value": "a479b49918e434b9b23a09b7249184fdd75eaab0a939c9822de391d7fbd072d0813fd2dbefc653d943d730d8786482a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806329, "uuid": "4f7095a5-d916-4433-9c89-a2dce74856f5", "value": "T1D694BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806329, "uuid": "b4a0fb8f-d854-44c5-9172-ad30e3bd42a7", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806329, "uuid": "8714b847-0a19-4798-b241-e7c62c18435c", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDJS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKdrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806329, "uuid": "f296c868-e7ff-4980-a388-01c00a017cef", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806329, "uuid": "3086f568-f080-4c0e-a322-a10af4de7f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806329, "uuid": "9e113c78-88db-4e9e-b9a8-adda0fbd0981", "value": "17efe95d071c648f0847316bb156a144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf707a3-b18f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648799254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799254, "uuid": "121379a7-b701-40fa-8bf5-3995e8bedeb4", "comment": "Malware payload (SnakeKeylogger)", "value": "530e902322371353bbe8f3f09e406a5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799254, "uuid": "886a6dd4-760a-4005-b975-4d6de03d3a65", "comment": "Malware payload (SnakeKeylogger)", "value": "aaddd37113ef73d08189a7aefe6ef306f6a0e8290f7ed62e96165ffb2b663855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799254, "uuid": "c06cf368-5e8e-408a-8e52-59728d0d9194", "comment": "Malware payload (SnakeKeylogger)", "value": "8ed56627e2e74a458da679ca488280f1a94e1ab3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799254, "uuid": "1d95af12-0967-48c9-af85-2796f50f7f17", "comment": "Malware payload (SnakeKeylogger)", "value": "0d490d6609b13db605dc1077ecc343d44193e5d84f1c1ad7f328e892c423aa1f6d2b87e6dfa38f01c2cd65c47dac9fc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799254, "uuid": "a25c4b16-5aef-43eb-b5d6-443161376dcc", "value": "T1FAA4121518B08A6ACD7F9BBD94E39114837CB61DBA93D3095FC120EC6DEB3E18642397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799254, "uuid": "9d6c8431-8ef7-4355-9952-b162859653aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799254, "uuid": "cbf6975f-5799-4f7e-ac9c-8352b6327f0d", "value": "12288:TtOGmUjH18zrRpLYmewWvlb6HTX/ldQXyy7:pOiH18zlpLwcrbQiy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648799254, "uuid": "e06c9e3a-7c8c-4340-8d99-34d3d7d43aba", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648799254, "uuid": "8aa1cb4f-858b-4728-ad33-3511dd526f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799254, "uuid": "3daeea9f-97bf-4d32-addf-bdac75e897cf", "value": "Quote JQ102474.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf00719-b1ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648811412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811412, "uuid": "0b663ec2-3c6d-4912-b2b2-0711fb9eb35c", "comment": "Malware payload (Heodo)", "value": "e53e16c9eb20a913b753d42da7773961", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811412, "uuid": "017cb063-34e4-433d-94f3-c8d2b23c0685", "comment": "Malware payload (Heodo)", "value": "ab392b7e41a700c8ada577b6e2004b58c91ffd566d782999da017cb87dbc43ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811412, "uuid": "c03db87e-3388-4de2-b8ad-a90b9e6c5bba", "comment": "Malware payload (Heodo)", "value": "c610c3725474ae71e53c5fda14c09be7c979e15c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811412, "uuid": "72c69cbd-8b5c-4b89-ad56-4f38a4b7a762", "comment": "Malware payload (Heodo)", "value": "cbf3461c8b51e7d32bf7143f03ad7720b1fa3c74bdc86eeca14f5b99287c8638763efa8306350b296f28b2b3ff243e77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811412, "uuid": "85f226aa-ca24-47a7-be48-81793a288900", "value": "T10494BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811412, "uuid": "f06e6a01-d7fa-4cbf-86bf-abed86017a86", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811412, "uuid": "e2686260-9c98-4835-986b-7021cc4a5a20", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDmS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKKrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648811412, "uuid": "ce1d243c-dc48-4c16-9d3a-795f0974e5be", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648811412, "uuid": "11e92857-8eb8-4047-b561-69a91f9bf6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811412, "uuid": "7b7770fe-45cd-4019-a8fb-953701ef8cba", "value": "e53e16c9eb20a913b753d42da7773961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63f167e-b1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648837842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837842, "uuid": "ad858b02-6799-4657-9f1d-7147f66f88fa", "comment": "Malware payload", "value": "76eb35ff99b9962a8a7775f201b432ab", "object_relation": "md5", "Tag": [ { "name": "000", "colour": "#E32263", "exportable": true, "hide_tag": false }, { "name": "Panel", "colour": "#BCF099", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837842, "uuid": "7b54f4dd-9434-4e21-b5da-e1ac7b2ae4da", "comment": "Malware payload", "value": "ac19b7f447357d84241e3067d7ad24a4056a7322b715e4c3f1518b56030c65ce", "object_relation": "sha256", "Tag": [ { "name": "000", "colour": "#E32263", "exportable": true, "hide_tag": false }, { "name": "Panel", "colour": "#BCF099", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837842, "uuid": "8ef80f24-fc93-4a12-af71-b3a745d6c9d9", "comment": "Malware payload", "value": "2c6172a92e005d747c895d345cab705f1b3b6298", "object_relation": "sha1", "Tag": [ { "name": "000", "colour": "#E32263", "exportable": true, "hide_tag": false }, { "name": "Panel", "colour": "#BCF099", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837842, "uuid": "bca57c50-6186-46a4-b69b-9c45011223e7", "comment": "Malware payload", "value": "c0d44345869b2ea5dc7b645d383f4badc39dcb9b452fad6ceb20e1ba95d18ba5ff7f1170707e76287ff7d0cfdad65217", "object_relation": "sha3-384", "Tag": [ { "name": "000", "colour": "#E32263", "exportable": true, "hide_tag": false }, { "name": "Panel", "colour": "#BCF099", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837842, "uuid": "fe8d09af-4e7b-4eb5-8832-493d01b9991b", "value": "T1D336332C09ED7D632DBDE44DB9A4F8409B0D058577CECCD49A893A9031890BF59DEBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837842, "uuid": "586118a7-3fd8-4325-b47f-74f4c06b318e", "value": "98304:a52LBb7wHyu/uC6hDMkRmezbt+g1YTTGzZPykHF+sxq/+E:a52Vb7Tuc2XYybIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648837842, "uuid": "8897074c-52b6-4989-ad51-6e1c1055fe7d", "value": 4946216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648837842, "uuid": "97c5374f-3a66-4bd7-871d-c353651909b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837842, "uuid": "5c70fa4b-a7c7-4212-90f4-84503b8d8207", "value": "000Stealer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a3ab01-b1c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648821493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821493, "uuid": "1abd7ada-ca17-4ce1-ab9a-caada524c5a1", "comment": "Malware payload (Formbook)", "value": "fa99d0118462d4d3adf8a820a145fac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821493, "uuid": "e5c0dcfc-57a9-4265-a3d4-7e4cbb82462a", "comment": "Malware payload (Formbook)", "value": "ac35cec2587a18dcd2be9da436cf76376c8b52de1b3637f1eee9490b227ba08a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821493, "uuid": "875e3c05-edf0-4970-b9fc-d8b83e43ca50", "comment": "Malware payload (Formbook)", "value": "bb6d0f846e7a8815feb09e48ce12c85a4a19f288", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648821493, "uuid": "b20aa1eb-418a-4434-b459-66437b96ef69", "comment": "Malware payload (Formbook)", "value": "dd928bc555a2ab31b5e5bcf3907e1136c4b7eebedb26ada83bb2ab9aeb27d4de39b29a25c42435cfaa756eb1387590b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821493, "uuid": "5458410b-a318-4a24-9c89-3f7f8a89fbc3", "value": "T1D0C4F12DB7E5EE13C4A45BF280D2011003B1A347A1B3D78A7DD913D98E623A71E8A7D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821493, "uuid": "6f352902-744f-4640-bd76-e9bb042c8b2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821493, "uuid": "d7e583bf-fac8-43d0-bd96-1d465ff0d26c", "value": "12288:FmTansLobqYholvgnJ3DLMKhmzrE7K/RQJ+vsbuqtEEkmcMh:kuWtKVfMKhSrz/Rv0qq6EkZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648821493, "uuid": "b3a4fe39-720f-4ace-b311-131b921d2d7b", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648821493, "uuid": "23c943b4-2b8b-4657-814d-0999ad93ccb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648821493, "uuid": "68328ddc-24ec-4ead-af74-02172fc4d140", "value": "NEW QUOTATION REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca011de-b1e0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648834014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834014, "uuid": "4b67404b-744f-4031-9f2d-3c186fb5f8c4", "comment": "Malware payload", "value": "1bfdf066b58cd22ca2213192bc5bf027", "object_relation": "md5", "Tag": [ { "name": "petikvx-archiver", "colour": "#B75F59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834014, "uuid": "9ae2ca29-9720-4c8f-96f1-a12e242a59a7", "comment": "Malware payload", "value": "ac45d16c69ea0c91b805075ba96a758bbeb1dc1880400113c015446e722c422c", "object_relation": "sha256", "Tag": [ { "name": "petikvx-archiver", "colour": "#B75F59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834014, "uuid": "63051472-6376-4300-adc9-d10fe3beb127", "comment": "Malware payload", "value": "0d283f2b17b4934a42d1e5fc72da81968bdeb4ad", "object_relation": "sha1", "Tag": [ { "name": "petikvx-archiver", "colour": "#B75F59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834014, "uuid": "dd323741-bf7f-4a24-ab81-a0722810c55a", "comment": "Malware payload", "value": "ad50c5270f82f1ee06eef67617566c2117ecc7e8ae05020b52d4580091a372f054682695e74114ed712dbfeaac068e53", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx-archiver", "colour": "#B75F59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834014, "uuid": "38d6f5d0-4d25-4346-93aa-fefa8c52560e", "value": "T18CF144C5FA0BFD304AB2372144098C4AEE5CC242E89359993ACE8C8FCFA35ACE5D55D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834014, "uuid": "5665cf0f-970e-46de-9f07-7e4812f1c153", "value": "192:Hx8JyCeEJPRTRv0EtH8ZByMEqKgzFQtzIe3WsONrjlbBk:Hxv/WPRVt8Zn2J0/sONrBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648834014, "uuid": "90029987-d5a7-4741-935d-65f2bf0de831", "value": 8127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648834014, "uuid": "7a13cfb9-408a-4fa0-8e6b-0cb2f4f7d435", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834014, "uuid": "4636ec00-6985-4790-95bd-e119300b81ec", "value": "Email-Worm.Win32.Dotor-ac45d16c69ea0c91b805075ba96a758bbeb1dc1880400113c015446e722c422c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5d7b4d-b217-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648857345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648857345, "uuid": "f0729f89-3630-4860-a8f8-592599b23001", "comment": "Malware payload (Mirai)", "value": "7fe770e39f06c69ff4d9ff3f5dabc53e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648857345, "uuid": "41141c79-9359-4ac3-9535-c3022076e654", "comment": "Malware payload (Mirai)", "value": "acf263fe809a7613661f24604dc5921796e76214ffb47bea229c0618bf00dd62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648857345, "uuid": "05519fc4-6906-4549-83a4-192292ccff80", "comment": "Malware payload (Mirai)", "value": "63d1b3b1ac934e38230f78e425e23ef749c0c420", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648857345, "uuid": "d79249f5-d211-4228-b909-bc8d9cac018e", "comment": "Malware payload (Mirai)", "value": "d41d133a26d43e47efc145fee7c8a39b82015d8395c9f7d28365fd97b0c455ab7c7caae2d39e19f130d02bcea8855144", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648857345, "uuid": "32c54725-0ef3-459a-bfc3-64a78779c879", "value": "T1E8536C25B97A2A27C0E4A57B11F78328F2F6634E25A4861D3D720E8EFF1464069572B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648857345, "uuid": "a90ec7d1-b46f-4457-a6c3-283b3e4ef9af", "value": "768:rJtoN7jo9cJDLuTl2C3g4SbViPIElLn92dN5yEVDsEB8p1kO+MTUyGi:rJtEjo9cJ/uJ5wLbViPPLnQdN572p1++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648857345, "uuid": "9e06ae79-8bad-419f-9297-9f60deb3af62", "value": 66568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648857345, "uuid": "afd55e99-5fa5-4eb9-996d-e5ea5355f906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648857345, "uuid": "c608da33-d44e-4d22-8243-0a6d8308d728", "value": "7fe770e39f06c69ff4d9ff3f5dabc53e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bcdb1f-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648800104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800104, "uuid": "494b95c7-fbd7-40e0-a6b5-aff5c292b364", "comment": "Malware payload (AgentTesla)", "value": "12ab56dbe65cd098ace52df21d916b29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800104, "uuid": "e6a63f34-4f79-4ead-beff-b31afbe6ab3f", "comment": "Malware payload (AgentTesla)", "value": "ade947f16cb3ead7a029dea03eca62bbe62e052500c8fd31a5043cadbe167570", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800104, "uuid": "86fe8f36-dc6d-469c-b3fa-c703cdd8823e", "comment": "Malware payload (AgentTesla)", "value": "18c630e34a66d3384343ae71e1329b1bfde47757", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800104, "uuid": "f062d115-2edd-4961-8504-c9b06b546959", "comment": "Malware payload (AgentTesla)", "value": "8ff7f2840a5405a447de62d77d06f32f9fb34232efca2a1f2f795ed3a022306d125b7600e7c50e4f2795622eb298da11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800104, "uuid": "5db77fdd-e83c-45de-8ecb-260496a9c247", "value": "T170C47BAEF2F03ADFC45BC07299581C68BE50B8B7631B8503E11715A9DA4E997CF143A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800104, "uuid": "ade04236-f4d7-4104-8f87-4fe8b74399d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800104, "uuid": "be2cdb85-0342-4803-940e-347f7b5f1ab3", "value": "12288:JVSm2vdZctHxMwwb5rxOY3IRElaUoi96fNCG1NJV0/G3/2wFHKRKgVdwSNzeTS:JVt/mwwbZx8Ea2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648800104, "uuid": "355f9cd8-1bd6-4014-8a76-a7a102c132eb", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648800104, "uuid": "171c5cc3-9ff1-4cf8-a282-bf681422ec68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800104, "uuid": "abd34f34-90c4-4541-8342-a1d7f651844b", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f623e30d-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648800099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800099, "uuid": "aa03bb59-d10c-4cc8-87de-7266a22c406c", "comment": "Malware payload (Stop)", "value": "9987c276f7bef9809b99bb2223c10420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800099, "uuid": "8f58cf9a-02f9-4e60-b924-d46a00ff9283", "comment": "Malware payload (Stop)", "value": "ae46809e1f04125ca54e9108794c6426d389617e0bd8133ce91aeee9ce9bb573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800099, "uuid": "cd9fa4d3-66fb-4bb9-b709-38c948fd7c13", "comment": "Malware payload (Stop)", "value": "e49ed6c41a22c85191d74b4d9eb20d4397ff53a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800099, "uuid": "fa049536-9b30-4d84-9590-d0e2fa684730", "comment": "Malware payload (Stop)", "value": "9e25246d17c214caac1bfae7d51bc8aa70ce638248a8c1ef35faca7a572db608f75d2272a7643ca2fdb3ee7f39cef207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800099, "uuid": "b8906196-5769-496e-970a-d256a8d4374e", "value": "T1220512F1675CCC79E0D72232D055C6A59239AE71F06345423B78262E3E72EDC89E839E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800099, "uuid": "f15eee22-c6e2-4fe8-a3b1-db445d750d93", "value": "3639259efd599d699775c282eb58d000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800099, "uuid": "50b7c24a-a53e-426b-a86e-8e043fa0e57b", "value": "12288:QQdVoUhfl0tcH4ksLGA7Hrd3StaIfEsrk9CwvyV5xdsJ/0IdPyFMunnwQ70:h9hflWcHTMGA3ZOsTdMUyFvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648800099, "uuid": "b7ca90e8-0189-4a2b-aeda-264001041e50", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648800099, "uuid": "eaf6b5bb-360a-440e-8e1e-c2100d5d778e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800099, "uuid": "219fda34-b2a9-4d54-b8f2-9cdd74e73c55", "value": "ae46809e1f04125ca54e9108794c6426d389617e0bd8133ce91aeee9ce9bb573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f008ddbd-b19e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648805673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805673, "uuid": "bd1258b2-b9ac-43e2-b5ef-80e90d0451d5", "comment": "Malware payload (Heodo)", "value": "15ea48a741fce5ae89b858be17e4acc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805673, "uuid": "541c6be1-e643-4234-8b5c-0c3a7d2b4817", "comment": "Malware payload (Heodo)", "value": "b016a4fdab6784c01deb5e4c7edbc4b330aae3491753c841835639bde42d32f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805673, "uuid": "45a20a04-37f7-4d49-ae19-14c4ea060ef6", "comment": "Malware payload (Heodo)", "value": "392bae196cb4cb6b7a700ca91b6e411f929aa588", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805673, "uuid": "b1387a93-99ec-4cdf-8bb1-2274a5326f44", "comment": "Malware payload (Heodo)", "value": "5e8c159676ee5ff3e017548aee5d7329b316bcb053cc43fa4f5ef98adc2364a8447e4e227dabe03ce63f16896b2f5cc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805673, "uuid": "116156b8-2403-41de-b1de-8b9f672b40e8", "value": "T1DB94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805673, "uuid": "823c54d5-6da0-4c5f-b619-b4d4a40e9d85", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805673, "uuid": "364e4075-6341-44f6-b9f4-a44a0c044de8", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDTS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKzrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648805673, "uuid": "e9b2dd37-9953-4447-b1ae-282f210ae896", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648805673, "uuid": "42ce53e8-41fe-42a9-aa94-21fb8d66a19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805673, "uuid": "58250ec8-40fb-4ee0-aac8-4c26b42266e9", "value": "15ea48a741fce5ae89b858be17e4acc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c45f51-b1d5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648829306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829306, "uuid": "8f595659-4019-42a7-bc56-ca5f378c5e58", "comment": "Malware payload (Heodo)", "value": "71649b6c867e418b6bcb9af4ae1ce2ab", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829306, "uuid": "956d3724-e033-4300-aa3d-416c57ed5684", "comment": "Malware payload (Heodo)", "value": "b05ff21e7a696091a19661b1e82447f30e2dc4e663b94b03b42cdc022e393e19", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829306, "uuid": "8de40ec7-c2ac-4743-8ff9-6f4618e59367", "comment": "Malware payload (Heodo)", "value": "81ccd1fec83d1e256d68ccb6920f231c1bacff94", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648829306, "uuid": "2648465f-cfa5-4c12-a03e-b9f6b709a606", "comment": "Malware payload (Heodo)", "value": "f0d91ebbd40a72156baed8311a657194903f7b09a4d746b4e69647dac2f8ca400ee3b71e24eead5526ed833531230791", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829306, "uuid": "5de493d2-b1c9-49e4-b77a-9ceca57356cd", "value": "T17023CF5FE5AA6D57C2A6DF3C7F448CB8A70D268E958235D90894AF0E3F046631E4F02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829306, "uuid": "92ab93d7-ad86-4816-b649-3154d65ff48b", "value": "768:cmBlntZhEI2YmxNskmoKjBvK3HqK88F/G6YzATUfJnXYS6oRM:dBlntTEvDLmXi3JvG6YzATOJnXYSXRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648829306, "uuid": "8229c8a4-5d63-497e-828f-45a165dccbbf", "value": 47738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648829306, "uuid": "46a16d26-26af-456f-ba73-bad722332469", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648829306, "uuid": "1dfa82bb-8a38-4254-acb6-65758ded9124", "value": "Invoice 04.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f23b62d-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819683, "uuid": "b45eb178-dff6-4cea-9412-21977e051320", "comment": "Malware payload (Loki)", "value": "2119279d50238be16abe61794a7a7a5b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819683, "uuid": "df1912ba-f990-428b-9946-c0d77807eef6", "comment": "Malware payload (Loki)", "value": "b0dac8fd4bfa033460522a3f09cf2b47954df9e5ec663709b5fe4e0fc5715e0a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819683, "uuid": "c626a872-8091-4da0-b819-2ebf4f7ce73f", "comment": "Malware payload (Loki)", "value": "c073096bfdbd35bffb60395fe3e9b7590b7c5a20", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819683, "uuid": "33c136e2-74cf-46f2-8620-624f7d65c7a0", "comment": "Malware payload (Loki)", "value": "1dca8eeb21a618bfdc5ad028ce9516cb934aeeffc8fdd58e267f42dbf97a43f1e2e7b257e6360e6c775ca7191f6bdff5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819683, "uuid": "e13790ce-d0b9-4647-a505-853b8771c435", "value": "T13E141260BEA9192CEBDE0772FD321650E118ECC91F3CC6DE5AE577209B3464221B4F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819683, "uuid": "bed9289a-67ee-4c60-8fc4-be65cad27708", "value": "3072:UM2slwLsU0ovmA9A2aOMiL9rIXDF67k58rDOTP8NyKrt2lbeHvUcObCA0GZc:fsV0o9HMYIukiXMGrt2lbeHvUNxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819683, "uuid": "655492b2-e8d8-443f-8c72-b8b5b8568c3b", "value": 192360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819683, "uuid": "51a6f82f-3ccd-441f-bbd9-e7c3725bbf9a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819683, "uuid": "b8016a36-dc05-4b51-93fb-3d0d78a4e649", "value": "OrderDetails.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c8ac0c-b188-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648796044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796044, "uuid": "4abc7561-98fc-4fb5-ae50-1f2d0cddde3b", "comment": "Malware payload (SnakeKeylogger)", "value": "96770eff0d8367192b41f9a342f4bb07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796044, "uuid": "b966d784-1ba7-42db-86ac-01c8707f5fc8", "comment": "Malware payload (SnakeKeylogger)", "value": "b13f250247cc567d96c5d8bb04fa7cf51dc461e03d74b4782a80e33c38455563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796044, "uuid": "a47f20f3-9fc5-46a4-9203-ae9dba9af82d", "comment": "Malware payload (SnakeKeylogger)", "value": "e1d96c875e4660260980c7cf58ae69b47aff52b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796044, "uuid": "fe7e0184-5919-4924-acaa-b2551e7118ca", "comment": "Malware payload (SnakeKeylogger)", "value": "6569384a5555b37a0bdf74857403ce674cb9497511b3b7bd7ffadd4c55b22b3efc04ba215f1a87b55fb6dfe7b40baae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796044, "uuid": "f3e664a2-352b-4c56-a49f-ab8f9839dfb9", "value": "T130B4F11A7BE6CD13C5B51AF6A1F7120003BAE3437673C78A2DC9128E4E533A65D89787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796044, "uuid": "8a5cc588-d13f-4bee-8dff-7f93c2681a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796044, "uuid": "e2bbc8fa-d394-4d47-bd19-9e686f70f9f6", "value": "6144:/5Z8OHQLwJ9P9ftYiuoimtEN0a/vE0LlJtm9ggqIFdsC/jJJtZkw/CtfiHpT+PDT:5/HVlYila/Dygg1sW9kwEkT+7lvArS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648796044, "uuid": "9e7dcbdb-8099-4fa2-958f-2b95e39254b8", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648796044, "uuid": "addc69d2-9a9a-49fb-8061-e3d9f04aa9f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796044, "uuid": "122d2c99-12cb-41b4-a856-fdce2ad25a39", "value": "PO_291765.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e1d27e-b1e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648834143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834143, "uuid": "70646180-588c-4eba-834e-386ad6d5e5e6", "comment": "Malware payload (Mirai)", "value": "100674f1e3ecfb6fa244de4ba7fd2ae2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834143, "uuid": "9f411e3a-1cef-4404-a0fe-cc07fba71771", "comment": "Malware payload (Mirai)", "value": "b142dd898aee796467e787edcc3f00f184b9905e75ab555ddda55c3a5729ccee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834143, "uuid": "dd2f3b64-b9f5-42a6-bd2d-a4faf50886c3", "comment": "Malware payload (Mirai)", "value": "1b3d9dfa0d063d1acf3f46c7e51beea312b2d860", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834143, "uuid": "093cbeef-b87b-462d-bbe1-d0e667e36479", "comment": "Malware payload (Mirai)", "value": "e2f98a126a2856d6bcfb941aa953d9537bde2e73e56d5885e06bd5e1af973010106e36b8a1ed5b46fc2f0a06e8450656", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834143, "uuid": "1469e676-775a-4cc9-b276-ac592a7095f9", "value": "T137930845B8906B21D5C216B7FE5E068E33135BE8E2CE73139D245B3477CB96B0E26D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834143, "uuid": "ba81b210-00cf-4418-98c8-fc5ff7312d2a", "value": "1536:Zgnjjx8C8tVyX7owf3+PwI5gpXLRar0UQmMvbigWFNCe6zQ55YcXKq:8t8bDwf3vIapbRacJWFNCe6zQnPXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648834143, "uuid": "12e4e1a1-4dfc-48a1-af5d-b40c37f9a3e8", "value": 95612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648834143, "uuid": "9b6b7226-8c16-4f2f-abf3-e08cf227b906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834143, "uuid": "8667db6a-8beb-4191-97ce-55cf38dbfbcd", "value": "100674f1e3ecfb6fa244de4ba7fd2ae2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0d653a-b169-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648782800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648782800, "uuid": "09dd0999-f9c3-4102-9d36-242157cf79e9", "comment": "Malware payload (Heodo)", "value": "a95c1c6d9e0ea9941c430e6143e27f4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648782800, "uuid": "30fc7cd7-1c12-426a-b17c-535511f084e9", "comment": "Malware payload (Heodo)", "value": "b2218679bbcd4d81b021cf61df66d28dfa7d529c8033df606a82799e7cb0af97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648782800, "uuid": "98a73905-0688-4e5b-91ef-ec8d3c5fe264", "comment": "Malware payload (Heodo)", "value": "c0a7dce6a5a52421fbda2e2dbdbf881439436cea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648782800, "uuid": "ea8b5ce1-3192-4d24-8fec-be338a0d4ff0", "comment": "Malware payload (Heodo)", "value": "69f60bcc41d153395d2a2d6d75c581ca787284a09088de12c86b90511139322eb3a30396e30863d1ca85d05d7110a7d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648782800, "uuid": "25772141-3b10-4ccb-9d46-317c18c150bc", "value": "T121059E0675E18477E2BF01310E66777E67FEEA504F205AFB23909A8D4971AC24E3631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648782800, "uuid": "664ef331-c4a5-4031-8be8-19134e23f4fb", "value": "2d2fa1ca6236044d56cef7b752fe5a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648782800, "uuid": "f95ce5c1-71f8-4f31-bb8c-9c0a50bceeae", "value": "12288:OBOHvWMwoyDdgp4W5dhdu1sRcwX8b3UHv8qDznxN6t:OX/RgaW5dhb8oHvbzn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648782800, "uuid": "d9beb8bf-10b7-4f91-af16-4e7add002294", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648782800, "uuid": "2a52fab2-921d-4783-a5ac-f1122cb06216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648782800, "uuid": "1a6feec6-627a-476f-8140-4b65220887dc", "value": "a95c1c6d9e0ea9941c430e6143e27f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0556df4-b183-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648794077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794077, "uuid": "d71792b1-ffe6-4525-8bc3-c2576c22cb20", "comment": "Malware payload (Heodo)", "value": "bb70b179711d5b9cf578a87d3d75e56f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794077, "uuid": "e2a3db8b-3969-4cb5-852a-4a7475665378", "comment": "Malware payload (Heodo)", "value": "b26276e62cdaa6ecc810c1c66ef5fb7a78fc78e2db5c3fa85ab52a7c7da4dc3b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794077, "uuid": "44fff8ee-b43b-4e4a-b9f3-b92688df220f", "comment": "Malware payload (Heodo)", "value": "dbeea2d972f1cf5f39baeb7b1c5bffc3da38c520", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794077, "uuid": "8a9d649a-9797-46b5-b9dd-90d44e377b8d", "comment": "Malware payload (Heodo)", "value": "8dfb727ae2a706b7d4c2b5dd0c1373c01e67f256df232f81af1503ce77e5f9ec2cd281407badb720723ced0a90ba2bef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794077, "uuid": "ac9b7f5a-4704-4264-ad3d-3c01d4314cb0", "value": "T1D905F73D2FAA4062D8660734145C1FE891ABDE25BB2255FF24843E6E2EB53C74879F0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794077, "uuid": "b6dbc613-e661-4b91-b863-77683027f118", "value": "70b8cfa68ef2c7898ee65b9a0ce218ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794077, "uuid": "f7c1e30a-5b55-40ef-906b-72fe42609ba4", "value": "12288:iKJCPjp1g4SbBKilbUD4/mQjcQ6JC3s5cYL:yPjp1g4S11lgDoRAQAcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648794077, "uuid": "95dd212a-d725-4045-9fda-09c346f7d898", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648794077, "uuid": "21bbba18-6283-4d34-9024-0d3b1ef9c5f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794077, "uuid": "de383ed4-37b5-4fac-9e9a-ddd5a51bf529", "value": "lumber.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e88d4c-b1df-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648833336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833336, "uuid": "51447879-8720-4694-bf0a-d5fb6dc63ad3", "comment": "Malware payload", "value": "ef1952b755ba912b9f60b2ed8dd68d30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sasser", "colour": "#5A067B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833336, "uuid": "d445344d-9fda-4f3d-9e3e-556b3677b102", "comment": "Malware payload", "value": "b2fa6edaa5ffc51d12150424355a0c86ac9f46d7ec772d35ab8d9f4fe7996d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sasser", "colour": "#5A067B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833336, "uuid": "3f45bff4-b6a5-458c-bca9-c513161cb9ea", "comment": "Malware payload", "value": "dcabadcf6f4a6079c8373ab2eb94b8ffeebd8d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sasser", "colour": "#5A067B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833336, "uuid": "01b4a2c2-1fe8-4380-b12d-a4e180fd2a4e", "comment": "Malware payload", "value": "ac5d11363bc3b2744ed4415e55be83f25c997f4338e16bc551ea6e3e832fcd3ee07703c326d91b03413d120017aad0d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sasser", "colour": "#5A067B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833336, "uuid": "15e15941-cb3a-42b4-8534-c8717aac37df", "value": "T163A37B327CC102B7C69285B214B95B0BEB3F29322F61D543E7C89A9B2E315D0AC39717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833336, "uuid": "ca2cd597-cd84-42ae-b56d-b8a4d60c867f", "value": "18bb2336932d8ba139414e3556f642ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833336, "uuid": "4f874621-6c0c-4808-bdb0-ea3d733848dc", "value": "384:k/exp+OvWEcAB9KybxgUamOUOtTMmlTD1DtkzyQ+dTXr9421qYGI6s37uP:k/WpR606UahvXDDkuRBXr9115Gq37uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648833336, "uuid": "2644ef00-9cb2-4a00-98c7-7eef23a08b6f", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648833336, "uuid": "95012208-3f71-40bb-be80-140aadf1d5b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833336, "uuid": "cf766821-f70b-4d2d-9199-8787e6a5f4bf", "value": "Net-Worm.Win32.Sasser.a-b2fa6edaa5ffc51d12150424355a0c86ac9f46d7ec772d35ab8d9f4fe7996d91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96b2bb4-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819352, "uuid": "b78f09dd-f333-4341-85da-f2e54994d689", "comment": "Malware payload (SnakeKeylogger)", "value": "bcc6a662a87cf38cbd8d9a9a29f3acb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819352, "uuid": "2c1cafeb-6502-4af6-964f-46e729c89dd5", "comment": "Malware payload (SnakeKeylogger)", "value": "b300d970709d713c3a86487f1b90a1fbe93e15b1ec2dca41c7bcef2c632a5068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819352, "uuid": "09cbb9e6-3402-4dd1-baa7-bf7a85ade86b", "comment": "Malware payload (SnakeKeylogger)", "value": "e5dcb56baad0f5159ecd1208e6d6d363d8398617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819352, "uuid": "ad658ca2-3c2f-44dc-b0d4-a4d96b304b72", "comment": "Malware payload (SnakeKeylogger)", "value": "9de57e80373c1a74c7dbabdbfb79dc0630f3bfac8d667e0687a53505ebbaaa51799e4a4843c568bb6581d8fa6291444d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819352, "uuid": "7669ecda-84af-49f0-9231-25bb105d831d", "value": "T126B4F12A77FACA23C1B45AF291D3121043B6E747A273C7496DC113D94F627E21E8A787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819352, "uuid": "640e495e-98bc-481e-9548-723af37293ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819352, "uuid": "c8e9338e-152b-4afa-89a6-1811c6a6f5d4", "value": "12288:quvYusyXM4SLB9rTksjQ3QQzZ86JFziWozRC6eUJd:LxsyXlS9pVjQb86vziNeUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819352, "uuid": "ddb49616-caeb-4e45-a61f-32f2d092c537", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819352, "uuid": "01cf6d6d-2349-401c-8bbd-80bcce96b5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819352, "uuid": "6ecec4f8-81ee-4de3-bfe6-ffcdce8d0819", "value": "22041081517_20220329_16042903_HesapOzeti.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d2db1e-b177-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648788712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788712, "uuid": "823ad70d-8e5a-4ca5-80a3-ed78dc3d8b26", "comment": "Malware payload", "value": "81fc8e057cfaaa44f20280f1339f06a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788712, "uuid": "cbfa51ce-3514-4aca-ac1f-4b09ffad58a0", "comment": "Malware payload", "value": "b31974b450b7254fdc0a508c1e907b30350d004f5b61750a1e42c4ace6d8f175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788712, "uuid": "a1e3803d-8b4e-4a3b-a2c1-a9d5992053c9", "comment": "Malware payload", "value": "88f2f21eb05add19ff18950c6ee373ab2c7012be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788712, "uuid": "6d94569c-f9af-41d0-8543-9d091483680c", "comment": "Malware payload", "value": "551cf84055e8e8dddd5c8957ee5f34276a12f4392d6eea0614de4adedaa301fbea14c7f40bd1034f245c15166889d3df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788712, "uuid": "7a2f84f4-d9b9-4794-b01a-d43f7c7ba461", "value": "T1F8968D3879FA022392B6D7A4C5F6545AA7633417B4358ADD1CCE034907E3782EA85F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788712, "uuid": "c7bb2ffc-6997-4af8-994c-9e6c269f490e", "value": "196608:7Yo+oQV95ePBY53skNyjwoycOssmWQ7YgtjDR/:73wrxo9Ogjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648788712, "uuid": "29719992-c131-40a5-b9d0-6855210af4b0", "value": 9123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648788712, "uuid": "9ffb626b-52fd-4068-82d4-175bbbefc25c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788712, "uuid": "9388bc0c-fb36-42e5-bad2-86a71b33fe7e", "value": "81FC8E057CFAAA44F20280F1339F06A8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce860351-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819360, "uuid": "569ba52b-22c8-48c1-833b-53c52c403a8f", "comment": "Malware payload (SnakeKeylogger)", "value": "791bf45e5a7c5803ce308be14b0bf05b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819360, "uuid": "12cc2efd-fc0e-42cf-92ba-3cf1982e53af", "comment": "Malware payload (SnakeKeylogger)", "value": "b416728db05b8f69c95cd82b3b5e255a3f0ab28cd5582f568d10af9b83ae4c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819360, "uuid": "7280dc64-3f68-4f5d-88be-83110e73e9c0", "comment": "Malware payload (SnakeKeylogger)", "value": "5ebbe48a53ffe989e0e808c90ca35386fd7adbcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819360, "uuid": "7a90a242-7d52-4e07-bda8-00ad9be60430", "comment": "Malware payload (SnakeKeylogger)", "value": "11c2ec62afe37be592883d6128436f171e91b6572f4b25d2ac5b4a5a90656359668b04cd747a3bfc27822ea19c822f89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819360, "uuid": "de5f92cd-93bd-4dd6-9a78-3f83b986f310", "value": "T19DA45BADF2F07ADFC45BC0758A581C69BE9078A7630B8503E52715AACA0D9D7CF143A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819360, "uuid": "9880dd32-ef73-410b-ae2e-d38cb135207c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819360, "uuid": "cd6cd67f-3564-4d13-9a7b-019f7a7a4507", "value": "12288:BcQr0Gljs2UsFvkaGN4/dpf5bp//U41hhrVarMOrv52usMYvS:BcQVljs2dFvH1RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819360, "uuid": "9116e1c4-a2eb-43dc-90b9-0830ab238b94", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819360, "uuid": "dcccadac-a490-4822-908e-ddc0e15e172f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819360, "uuid": "5feb0357-1760-4ce1-8c34-a8258f3ce930", "value": "PO08-9422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d733f699-b197-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802625, "uuid": "a86e0722-bdc2-47fa-bfb8-f6884096e115", "comment": "Malware payload (Heodo)", "value": "73b67b2c747c36d1f7c5acd6aabd3f30", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802625, "uuid": "d95633ca-291a-4dbb-ae94-bd57bf29f127", "comment": "Malware payload (Heodo)", "value": "b4b710ab43ad28e7267c8a7d34f035a04bdec4f61355a2a3eb4e1595319fb528", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802625, "uuid": "cb038478-73c8-42b9-af92-56a35ff11fcb", "comment": "Malware payload (Heodo)", "value": "955ca6028db05ea9e54ab2d8240bc504c6515ace", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802625, "uuid": "e66ed2d9-4a38-459f-b7a5-586ac1b78d37", "comment": "Malware payload (Heodo)", "value": "07f67120cc4431ab081a11bb3cd82308918a713bf5935f61c7bd541832e98d7e77c442914439293157069c3e094c6e57", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802625, "uuid": "646b1385-a2fd-4846-8fbc-1f1931681985", "value": "T13C94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802625, "uuid": "5ffc7461-6e22-4eee-b73b-2e2243634c02", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802625, "uuid": "64cd45a8-4886-415c-87cf-378f6d5ba6fc", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDgS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKQrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802625, "uuid": "cf322b58-2aec-439c-b9ea-5e4cd8e89f0e", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802625, "uuid": "974dac86-0835-4706-b5ff-35af6bbee187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802625, "uuid": "92ed57b0-f021-4193-ae95-0b157714ee61", "value": "vnmXW0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98053ec-b183-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648794038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794038, "uuid": "f7a6ca9f-a15d-42bc-98d0-0d116361df4e", "comment": "Malware payload (Heodo)", "value": "c1d01204a1d52156067adf613a495f24", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794038, "uuid": "5cc9723c-66b9-45c3-8dbd-acc524465c28", "comment": "Malware payload (Heodo)", "value": "b6408e0e6008426cb6e0e9b84c6fbe0aa92b9ce477da7b66397b8fcda5c293a4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794038, "uuid": "21dabef3-cf8a-4e9e-a7dc-ed1462bde4c2", "comment": "Malware payload (Heodo)", "value": "ee32972290020c49e561bc70672c15a5cec020fa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794038, "uuid": "66e2a1f2-61c0-456e-b922-a135cf3e2e59", "comment": "Malware payload (Heodo)", "value": "50ca0fc91338f91f04cebe138d6ff7ea2306d0a835559cce5d095aedb95d28576de77b661e1fc01ababa06df3a30d6d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794038, "uuid": "05f274d4-c90e-4fef-a362-8520a670a375", "value": "T12BD47C0EFFD1C1B2D36B123019D5C64823ADBF2CEAA1C5B777A8BE1D69326C14512B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794038, "uuid": "4ee987a5-d137-47be-8dfd-557434ac5ec7", "value": "d63ab94f4bb6b5d2f0f6092bf07e00ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794038, "uuid": "8fafc86c-ed54-4838-9e8a-cdc71bbbc6bf", "value": "6144:/6ZMFXzqfoSHr/mvcQYbi2HN8C8BgifO7y7dcuVqrWLWN7Ypsi6Ih9vH0/oUHahE:/8MFX47ivcQMNsrDCKJjO69cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648794038, "uuid": "821896e4-67ad-4cfd-900e-aac69c55cf76", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648794038, "uuid": "c6448c2d-a4c4-4102-8a4b-8dca31474183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794038, "uuid": "757952fc-499e-407b-9c79-4a79fc4f1024", "value": "brick.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3334e9-b18f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648798930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798930, "uuid": "ae1fc53c-2d72-4bfb-9705-6bf609024547", "comment": "Malware payload (AgentTesla)", "value": "76ff5110d16230c2af065f31701dccc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798930, "uuid": "fb311e3c-8990-49e2-a482-c42791158a73", "comment": "Malware payload (AgentTesla)", "value": "b7abba441867ee61f404e114e4e47b03e0f70a6ca43e578665942d3e02440ef6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798930, "uuid": "689d03a8-1337-406b-a98e-1c97d1297a58", "comment": "Malware payload (AgentTesla)", "value": "25de3d28da68eb0dee650a37446c2ad5bbbea67a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798930, "uuid": "fb20f62e-1927-49f3-92a4-f94e38691deb", "comment": "Malware payload (AgentTesla)", "value": "761dc5abc232733efe04311476f3299491165acacdae47b08fcd3100b3477657a682206ac2c1eb89e9bdb0218bb6886e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798930, "uuid": "d7612b2e-dbdf-42cf-b732-91ec16912873", "value": "T1A7C47CAEF2F07ADFC85BC07289541C69BE5078A7A30B8503E11715AADA4D9D7CF143A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798930, "uuid": "46479c92-6aae-4119-851b-a35950b57c93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798930, "uuid": "aefe251a-600c-401b-8aae-7389b205a99d", "value": "12288:3s6hziOK6mA2dRYFFqHAUqUffW/FOYRF0sPvCE1xB0/S:3sYA6kqU/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648798930, "uuid": "5ecb1487-6206-4bbd-b800-c85a084954ae", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648798930, "uuid": "3b467df9-28c3-4804-bc59-a578e628c292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798930, "uuid": "7677e972-b5df-4df3-8a3c-a31161b88167", "value": "2Comg1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380c6d4a-b1da-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648831134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831134, "uuid": "526f5288-3dda-44e5-b78b-cf30fb4bd8a4", "comment": "Malware payload", "value": "6f821c7f65b38ec747ac029ccd8d8c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831134, "uuid": "2d66996a-4421-444b-ac02-1ac1598c978d", "comment": "Malware payload", "value": "b815d179a6cf2089ef51a8173f3f9a91dd0f774b778f87ecfbb527bffe4c63ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831134, "uuid": "54221cc6-b37f-4ac9-8f38-26ffffc79eaf", "comment": "Malware payload", "value": "6de0176e7353cb0a8347d50c30bf0ef4ec087c02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831134, "uuid": "af6ac786-4315-4391-afd4-ac7a37f844a7", "comment": "Malware payload", "value": "f499cff762faf687bfe1f2347f2b9573eea01a47100a6316676d3163110980b5f520d317f71875681a39e2a8bdfa06cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831134, "uuid": "ea29c2ab-19b6-429d-9c16-139458735859", "value": "T16273C643B752C580F29AA179688383A96753FD70AF0376075164FF3F3AB39A14D91B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831134, "uuid": "e661316e-9873-4ef4-a6ae-18e187f9ea1a", "value": "bfbf457d52153d2191e67bb6c9212334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831134, "uuid": "52098d81-1d16-4a69-a2d6-4d61771e8a94", "value": "768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd0T6hJxn:HeT7BVwxfvqguKs6/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648831134, "uuid": "b71f00a2-cdb7-49a2-bebe-40282598ac21", "value": 73946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648831134, "uuid": "44df96ea-bd77-4cf7-96b1-b4473d702958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831134, "uuid": "567d4937-fb60-4c91-a621-a19aa0d4b033", "value": "musicvn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7961f8-b19a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648803605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803605, "uuid": "ed35069d-8d3f-4928-8a30-44b03c89d9d7", "comment": "Malware payload (Formbook)", "value": "3b94fdc5e66e0366ea3fe045413e27d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803605, "uuid": "79418480-5db3-4995-ae11-b87a51ccc8b2", "comment": "Malware payload (Formbook)", "value": "b90122d45b3e426cdf4343cc47fd486e67d4d2fe861f6a686f4d29919a327ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803605, "uuid": "22f15429-d70c-4482-a2f7-e091292eb58c", "comment": "Malware payload (Formbook)", "value": "8895637c0016e15baa66a60d0066a81c38a09213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803605, "uuid": "e7a4eeda-a5f6-4877-bcbb-722d94ed305a", "comment": "Malware payload (Formbook)", "value": "757ef8a7330fe3a3807bad7303f4f35d148ba3b56aaccd16fdb7002ff556c182a632a63d31d578c29750f41277a08079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803605, "uuid": "b70d3ee1-23cb-4bcc-9523-cf2325a17764", "value": "T17715AF62F2C1C937C0235A7B7D0BA3B56836BE556E6865463EF43D4C2F7A64238291C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803605, "uuid": "67a9b245-ae14-4ded-a9aa-abcf8c63960e", "value": "fdad361144afe229033565a59cbcac71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803605, "uuid": "ce3857d5-c8db-459f-9535-47e15fa5a208", "value": "12288:cB+PnwfmejogYtFJpFulAJDtHTALKsd/mSf2pSgj3R+li9B8h2+2nwcBz:tweOYtFJPulAJDxWKUmSf2x9wSV3wcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648803605, "uuid": "73449715-0dc1-49d9-aa0c-b5f8acef896c", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648803605, "uuid": "6da4e33d-251b-4f73-8457-e9f155b25305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803605, "uuid": "84dc3a46-4ba1-4727-b71c-432fee437dbf", "value": "HBL - TPLINNYC20220211 - ZET MFG -.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7c74ae-b177-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackGuard)", "timestamp": 1648788755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788755, "uuid": "5286f7a4-6196-4cec-9722-db96c37b55f5", "comment": "Malware payload (BlackGuard)", "value": "79a61e4b2b9c84436ce2010aa04e718f", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788755, "uuid": "f6200614-a036-4f78-a9d0-2ecc131bbae6", "comment": "Malware payload (BlackGuard)", "value": "bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788755, "uuid": "d10df5c3-bbdb-4fdd-bb5f-468fa6fe7b22", "comment": "Malware payload (BlackGuard)", "value": "4b676837ce4520277ad05c0657c147c9f161d3c7", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788755, "uuid": "26a8aab0-f2f7-4fcc-a5fe-d5d93f443927", "comment": "Malware payload (BlackGuard)", "value": "0eb778734afcf5453d93f6985957f74b09ebca6f1087d9b6964c914fa84772ef6c4cf790313dcf55d897676e83738333", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788755, "uuid": "b74560d5-0acb-445c-b67e-22d512e32bbc", "value": "T1CEA3F63C3F9A5115D6BFCFB0ECE035D58AB95363B4119A4A498511961E03F80EEC3EBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788755, "uuid": "e077e3ef-5175-4687-919e-9ea907979cda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788755, "uuid": "207363c6-a79d-47a8-b2e5-4326b1924c2a", "value": "1536:89ViwRj2U7TFSiXcSRXB61Nrov7c5sR99Hzsa8C0tPUCZfFKoPpAKQaIc6W/yMi3:QiwRj2K5MQ6fov7bHz1oBJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648788755, "uuid": "5e343b56-489a-4c3a-a0df-30daa686cbd3", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648788755, "uuid": "701ee265-c0c3-46d2-9d52-e78b52d6cb7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788755, "uuid": "804c883c-70f6-4d2f-b855-fa6a43e08d72", "value": "bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14d1329-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648800091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800091, "uuid": "93090cba-c12c-4349-855f-829421934e46", "comment": "Malware payload (Stop)", "value": "a93a3507275ef2c6b4613ee6ca9293bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800091, "uuid": "5a590f0c-a75f-49c3-b90d-9240d204df4f", "comment": "Malware payload (Stop)", "value": "bcc5f2c69c785eb5b8cec1447d741ae718ecd3dc59da3b767b1f4834c804f7b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800091, "uuid": "cf77f851-3ef6-48a6-af0b-d4c62b7ba1e5", "comment": "Malware payload (Stop)", "value": "a5cf8942c563f38db0fe205e5f3da63c440ef458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648800091, "uuid": "c069fe6a-b4ab-4063-9a3f-4ebe56dcb954", "comment": "Malware payload (Stop)", "value": "601325443958c869f0fb5b10fbe2103bf2302684260209f8ae940ba11963830d24c4d212527e1c34a5ef30775830f74d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800091, "uuid": "df0ee056-d9a1-4fdc-acea-fcf62daa3698", "value": "T1FCF422257E41D073D291F435341FC2A22A6ABD3B28209A877BA5331D9FB23D1A71DB74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800091, "uuid": "f9a408f5-3573-41fa-9a90-2d927e2f485e", "value": "459bfcb200a89956a21c6292752cdc81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800091, "uuid": "5debffb3-3a9a-4b4f-8a00-cfab6fb9cc51", "value": "12288:g2x0Q7kY68pNmyxHK1jVI3CTNu1IPAgMJW5W4YQkyo2rLmi0CKjF:gcPkY6YUjVI3CTNK7hyoG+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648800091, "uuid": "5dfc8355-f630-49b1-ae0e-fa72adac8b8f", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648800091, "uuid": "85243aca-41c8-46ae-bf34-745c57ef96d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648800091, "uuid": "f485224a-c970-4981-8af9-4a443a45f7f4", "value": "bcc5f2c69c785eb5b8cec1447d741ae718ecd3dc59da3b767b1f4834c804f7b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1c63c0-b19e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648805663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805663, "uuid": "a6d12648-1e24-4ce8-b73e-9609300e2737", "comment": "Malware payload (Heodo)", "value": "9584d71bdb3395a0cf930be5f49f1a60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805663, "uuid": "ff2ff4a5-cdc9-4f6d-b933-34c2cbc1d493", "comment": "Malware payload (Heodo)", "value": "bd52735ce398c058e7bdefa62befcbdd5aefda04257845a3fb135bfbd836ce5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805663, "uuid": "fecb9820-afcb-4abb-82bb-6275dcce5cd5", "comment": "Malware payload (Heodo)", "value": "2f85b1667ec3659e26cc4ad80c016be291426cf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805663, "uuid": "f86304a5-2854-43df-a698-e81dce3b1333", "comment": "Malware payload (Heodo)", "value": "9b4b118be152918b46e605b96273371b333bf10c0f17e3be17da2fe80b15060ebde364e3842f8fb3e13a6d94bbd981c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805663, "uuid": "a4198430-19c7-4587-ada3-c2a4daae173d", "value": "T10894BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805663, "uuid": "63587fca-e0d0-4f1a-881b-72e47d0da347", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805663, "uuid": "0f20adc4-58ee-4389-9501-03b3c1cb8b6f", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD2S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKSrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648805663, "uuid": "be2e23fe-d2c9-412c-b430-d7b4ef936356", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648805663, "uuid": "01e18ccd-bb5b-4099-99de-db30cb271d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805663, "uuid": "839a924d-b279-4c8d-a573-a5b5e931f07d", "value": "9584d71bdb3395a0cf930be5f49f1a60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb95568e-b173-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648787197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648787197, "uuid": "a846faa6-29b3-43d6-b5d3-90fceb2ebba1", "comment": "Malware payload (NanoCore)", "value": "0f13de858dbfb72d82b64e8084f9aff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648787197, "uuid": "ec8aade6-482a-4bb9-bd6b-6d59657233de", "comment": "Malware payload (NanoCore)", "value": "bf1c2338a7c733a0ea4467606c4bbf5de0db86f615b01c71dbee049ed1037d14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648787197, "uuid": "0c20a55a-c8bd-4fda-9928-62ef8758a6a2", "comment": "Malware payload (NanoCore)", "value": "9966f84988f19b3902b9a8e26e7bc493c5772985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648787197, "uuid": "3c300599-2ede-40d9-911c-5cac7c2457b9", "comment": "Malware payload (NanoCore)", "value": "af239749cfb27175b801f0e53328f1396263e2139a623e48b4377a1c7e4f3b78aca7bbbde2ce725813aeb8435d3d16c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648787197, "uuid": "1c9e0b03-92b1-455f-9971-c81694d2e5e7", "value": "T1E594CFC60AE93D37C7CA51FAD41045819BB9CB23AA17FFF2E951A0F9C8533D1A916243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648787197, "uuid": "69180420-5946-4a52-8ee2-657be010a05a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648787197, "uuid": "337da39f-9015-4d35-af97-f85847008ed5", "value": "6144:fFIAycwz+zkr+Cv+zLEPdMnHs+Jy2tYz5y2Rz0tTsNZdbWVKHkYsQqt3aC:y1l+Fw+XEPOMOa0Oz0t0bHkzb3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648787197, "uuid": "64f7efb2-f029-442d-a9d8-31e6478d0a84", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648787197, "uuid": "782d2798-5f62-4c13-8b9f-42e1c3c35149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648787197, "uuid": "d3da62ef-4b76-4854-b997-060c3e0e20c6", "value": "0f13de858dbfb72d82b64e8084f9aff5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4d5a5f-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648820086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820086, "uuid": "d8426a52-5098-48ba-a96b-be9046d88da9", "comment": "Malware payload", "value": "66b42c9a6c292179f994d2ef59fe1e36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820086, "uuid": "427ba8dc-80c0-480a-ac74-0231d9e2609a", "comment": "Malware payload", "value": "bf4737d1003544ac9fa65fd5b2bc42114baa9691b968f7905d70f8b2c82a9672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820086, "uuid": "0fb4733d-3d6d-4067-8553-b81f958162b8", "comment": "Malware payload", "value": "ad4347156c9af12bc6bf6432a59073d994174a75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820086, "uuid": "1cc5ddce-db34-4a0b-85fd-ccfccbcefd69", "comment": "Malware payload", "value": "ae30db61dd931f3423a9df55a9f5ac8c3bfed9ec81fb4ba87acd59cc423a3a375fbc8733e79e4bc27f2ac3059ee2b0cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820086, "uuid": "5cd56a57-d892-4bbc-a13a-3917cd8210c0", "value": "T1CCD3F01067B8D113F8A693314C326F27ADFEDD71683092071BA06B4A7C79751D72E36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820086, "uuid": "c4ec467b-87cd-4f14-b800-53deb8cfabdc", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820086, "uuid": "bc1fd72e-7a5a-42f3-8488-eefdfca83147", "value": "3072:U3yddvw8pSutvbwfW1XUpvAaPqinDt/cnc9Y1OT62aVn8CKb8TDbI:U3yztLwfo+AaCKDVcF1OW2AbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820086, "uuid": "f9b03534-3f13-424f-ab57-59d05ec2d0ec", "value": 130096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820086, "uuid": "dfefff61-835f-4492-a693-e76cc55f04b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820086, "uuid": "59b70d2a-a550-4f60-9fc2-41e98c5fe5be", "value": "Get to know your Tax Obligations.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9feee347-b186-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648795230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795230, "uuid": "c9c88da1-4cfe-4e13-8eff-f0b31a49225c", "comment": "Malware payload (SnakeKeylogger)", "value": "e0c4b407bc8c674f9ac5da6e67030899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795230, "uuid": "f9efff3f-6ee1-4843-a180-981ec2046acc", "comment": "Malware payload (SnakeKeylogger)", "value": "c078da552c8615a7ddd35f704fc934487d4943fa3cc7a99b919783d3e2a75c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795230, "uuid": "1360e026-35a3-4482-9619-ea00fc4e6f9a", "comment": "Malware payload (SnakeKeylogger)", "value": "24c8cf332a4056faba94984a047de304009a210a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795230, "uuid": "1b899197-14e7-4348-b2fa-359354b21e4f", "comment": "Malware payload (SnakeKeylogger)", "value": "6b7e127a561318aef216efe2a37e28735c22a087edb7be1d2c78e706b3b9844505bf2c423c01f1fd41bc9354f6743b9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795230, "uuid": "749a7539-7bd5-4aaf-8567-effa48c46234", "value": "T154B4F12E77A6CF22C4A816F144EA521103B1E70E7673DB8E2DC513C91EA33A75D4678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795230, "uuid": "99d852f4-9724-404a-8f66-f2ed37d17f9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795230, "uuid": "60276929-cc72-42cd-9382-e173b73fe2d1", "value": "12288:r9JhyyU3uYQGYBhr6AEy3ALwDxs4qjx1:EhCBnEy3zD24qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648795230, "uuid": "f018b986-8eda-46c2-87bc-27b67409d2f5", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648795230, "uuid": "d3b19ebf-462c-4cb6-ba50-7023d099f343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795230, "uuid": "19f29540-8109-4b2b-96c4-68a092d1f00d", "value": "PO_0010322-0339.brb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7586fd2e-b198-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802890, "uuid": "554b4d49-4d67-40ff-b602-519e5720f439", "comment": "Malware payload (Heodo)", "value": "fff1e9c521ea6c55e18f19b3dfcaba95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802890, "uuid": "265ae7ba-b70f-40ae-92b1-3b7c2f6b1114", "comment": "Malware payload (Heodo)", "value": "c0e857cc4192417098f486cb54bac66d53dd394a1febd73ca3b4f81f53af3cb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802890, "uuid": "6fb59001-9b10-4a21-8560-8c03d3a490df", "comment": "Malware payload (Heodo)", "value": "3cb0d13a5d5df852a760e1a9e4570f6494d1046e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802890, "uuid": "327e0705-2a2a-44a8-b402-07e15ac62f40", "comment": "Malware payload (Heodo)", "value": "d93c8e8b0e83d86819f8af0f34ec406180ae832fa6170701742ddaf469941f4332df0bf3f4d524e1ae54db3d0e530d39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802890, "uuid": "d7fc43f6-5a93-43e5-8df6-646e8f7728b5", "value": "T12894BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802890, "uuid": "20ad44af-cd17-4cc0-972c-82877e6bfdd4", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802890, "uuid": "6bb271b1-4fd0-46b7-8435-57b69782b616", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDeS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKCrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802890, "uuid": "02f2216e-8fac-41af-bd4a-03c5a1b390ba", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802890, "uuid": "d31d5bf2-c2be-4c12-9882-3ac36dd8265a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802890, "uuid": "d6e9e564-062d-478f-9b15-9ef4647c64a3", "value": "fff1e9c521ea6c55e18f19b3dfcaba95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808cfec8-b1a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648806345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806345, "uuid": "2e7ff6da-2433-4b9b-bbe4-a3352a1fcd28", "comment": "Malware payload (Heodo)", "value": "4d26fb5594661a5b4180aedbefa179b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806345, "uuid": "949a5cfc-c9b1-4408-8566-fe1188a64e2c", "comment": "Malware payload (Heodo)", "value": "c11942f4e5df89ceef7af4e4593275fb69e20dfd41c785448ac376a369628142", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806345, "uuid": "c7efcdf1-0611-4ccc-bd6e-65bcfa431b89", "comment": "Malware payload (Heodo)", "value": "271106cae385ca6f74c0f65fe8fee2698f18bbd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806345, "uuid": "42102ca2-ba64-4b2d-a6c4-4699a530ec91", "comment": "Malware payload (Heodo)", "value": "e8e87213f6193ef9fc3c530317284b985d1297e03273f2a24c0c040b89e81b495d2f0f177abe7f5a4aeeaaa5fafb29f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806345, "uuid": "de6da650-eaa4-4c4e-a4a5-ecdca8778965", "value": "T19394BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806345, "uuid": "911c688c-d81c-4149-be65-9fd2700cb8c9", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806345, "uuid": "0aa5b8b3-d790-43db-a5b1-80d809c777b2", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDiS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK2rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806345, "uuid": "7fecad8f-068f-488f-badf-cdf82fca9c9e", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806345, "uuid": "5c561ae1-99a8-4fcf-bdc4-ec2e2ca91e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806345, "uuid": "9748488d-857c-42be-928b-5adcdccb630e", "value": "4d26fb5594661a5b4180aedbefa179b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f41578-b1aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648810805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810805, "uuid": "042ab3cc-f4cc-4ddd-b614-847b7b33b207", "comment": "Malware payload (Mirai)", "value": "0f52ddfe7e18b482a5ec1ece61747975", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810805, "uuid": "de973665-5557-49be-8613-17c0daae41ce", "comment": "Malware payload (Mirai)", "value": "c1fb402130abb311f7695d17e4ae224e6d3727c8ba2d9d8d676295167e1ed70b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810805, "uuid": "2044fee5-8f50-431a-acb2-b306a6f838d1", "comment": "Malware payload (Mirai)", "value": "91bc3dd5604a71ddf8e11a7aadb201ae6936a5b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810805, "uuid": "caf1a0ed-5a24-423b-af8a-a14367a263bf", "comment": "Malware payload (Mirai)", "value": "afcc2f87fdac8d372b73e8126848ac6c59c3194868439bfd23f193c37416c82f9010c77f9d62cd0c0949d59dddb8ae4d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810805, "uuid": "6161d856-3d93-4373-8be0-7aa864eac63f", "value": "T12FD35D46EA818F03C4D527BABA9F414933229754D3EB73028D289FB43F86B6E4E77505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810805, "uuid": "c1c51e0d-5b0b-4e05-966c-511d015f37a7", "value": "3072:WAzbIGJzcKRDvaYJi7EZSLVmknsNsC2blg8RKWlNxIR+KTE0M/9EIR7e2:Fnj6IDvaYJi7EwhnS2blg8RKkxRKT7MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648810805, "uuid": "88d53d86-0266-48a2-9f93-2ee7991b1d7f", "value": 141068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648810805, "uuid": "24a2889f-426e-4a40-8d01-f2663e25fec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810805, "uuid": "8912728a-09d5-4616-9658-6e69fa55ceca", "value": "DEMONS.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfd164b-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819653, "uuid": "0f4ff9b4-6bf2-497a-b085-94ed6b3f6b56", "comment": "Malware payload (Loki)", "value": "a5a758b645d9063f7eefd26a7f9ed09d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819653, "uuid": "ab2c937f-7f3c-44fe-bccd-dbb5ebecd6d8", "comment": "Malware payload (Loki)", "value": "c427e7f810b6a5a8b17e35ce18a06f817e7c0b1dc317e7a473f8a386fe74107d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819653, "uuid": "ebf65a0e-e045-4fe8-89bf-3e793c847a5d", "comment": "Malware payload (Loki)", "value": "b9191f1eb8bdfd0014f1d368a91abdc05c35c2bc", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819653, "uuid": "846690f3-c6fa-42e3-9bee-416f0afb87d0", "comment": "Malware payload (Loki)", "value": "d7a4c772f99b988dc0bef9710235f381adf95536b1c3befbd1f40cc030597701a4a49430a7397b87f71a2204f3e17eab", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819653, "uuid": "d42e05a4-13d8-44fa-ad48-337b3712e4b2", "value": "T12C14028065945E7FDAABD3F0E86908D16E73DCC3AC0BE7EA9644B22673B54734640DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819653, "uuid": "256ad7dd-bc1e-49cb-bc37-8bf7f695f27b", "value": "3072:Lq4XGXQW+fLwosjQhZ9MOpta6mZSecE8BThE9wTgbQnyQ53n4K8it:9RkosUhZ9PKZSecEGE9wLttt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819653, "uuid": "1025c45d-88ec-4843-839b-54e61d66d743", "value": 192168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819653, "uuid": "bc78c550-9b6a-49bc-95e8-2b63917be841", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819653, "uuid": "aec10bf5-3dd5-4f9f-ad69-afcb7e72e6f0", "value": "AT3789935.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b4fe9c-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819646, "uuid": "f3ed6b08-faf3-408e-8b7c-173a95bf88d2", "comment": "Malware payload (Loki)", "value": "7b79a36552e33dbbc56bf3cb99b3ab34", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819646, "uuid": "499b7c9e-15a5-4f35-b342-cd28798aa0f7", "comment": "Malware payload (Loki)", "value": "c4ae8dcff76e3d40d1df3f08bf3c2bb0a41525422a92ad97510a688a4554383d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819646, "uuid": "4921951c-8484-448f-8d1a-b8cfc8dcba9b", "comment": "Malware payload (Loki)", "value": "aac00e2ff56225e08bc8b532e8f363b7d2a5f7c4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819646, "uuid": "50a97568-2850-49c5-9d3f-5071d017072b", "comment": "Malware payload (Loki)", "value": "7720e64d8432e8d3a8d8883aee4f7bd6de1c11900257404f085f59a0988fc4dd58c4ce4c3bf16950c98a1d1406739224", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819646, "uuid": "01ac2d27-5cce-49d3-ad94-c755be35af1c", "value": "T17C14026039FC5864FEB21873D6D4038C54D68D15FA58A3A06802FA1817FC9DB4DEAF36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819646, "uuid": "339c97f4-0621-451e-a146-62b75a41b791", "value": "3072:npk5gjQGpuEel2Ko8l4+3QvEn4zSvlf+Qo3XIHFjRjL5+7fx8Otr2ngE5RA5gt:p5l8Pol+XdGQ04pP+7fCoYg5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819646, "uuid": "02f35217-b33f-480e-8820-9fa30adfbd7e", "value": 192104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819646, "uuid": "ec584dc3-86df-4d46-b345-d42957348939", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819646, "uuid": "1641d005-c2bc-4bf6-a1db-a3bb126bfef0", "value": "inq_20220104.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbee535-b1c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648823167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823167, "uuid": "7614a97c-e92f-4a81-88d4-8164f9845267", "comment": "Malware payload (Loki)", "value": "59f49dc05749550437c2dc62e4e8e983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823167, "uuid": "153bdcb9-a590-4bdb-beb6-c1d5718b649e", "comment": "Malware payload (Loki)", "value": "c50975ad7a05cde971c0b0863a044710edcc898effcb4d1b498617a0c86ba8db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823167, "uuid": "4c21ebb1-2496-4079-9e55-4888458d2065", "comment": "Malware payload (Loki)", "value": "c40fd446b2615b6d92af195e43891ceeb00b5e41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823167, "uuid": "103187f3-e3e2-4013-9a27-3b25e177822d", "comment": "Malware payload (Loki)", "value": "202832583774c6dccbf0872f5680cd66343de903818810d49037df7f9273d353b95315b7d7af155b9302c8d0307b94b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823167, "uuid": "30e0b707-91bc-4755-9075-2ad31ec449fd", "value": "T1313412352AB4C4B7DCA30732463B1B115BAAA4236408474F93217F9DBD253D1DE5EB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823167, "uuid": "ad21bf03-d6c1-452a-aa83-f5f30ab8bd04", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823167, "uuid": "21f291fb-9157-41bb-8c98-ce17bdcd6d3f", "value": "6144:HNeZmTa+pa5L68cHcCzjDKvDKSKIZSDZf0qI:HNlbG68IccjgDeIZSDZf0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823167, "uuid": "f51dcea7-8c44-4fea-a93f-02e16b117f3f", "value": 239897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823167, "uuid": "ba54312b-7b09-4e49-9764-e6694d11f53d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823167, "uuid": "a80326a3-08f2-48a0-8e72-4b1d74fb2c6e", "value": "59f49dc05749550437c2dc62e4e8e983.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b76c0c6-b17b-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1648790257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790257, "uuid": "dc2808fb-7d91-4cc8-b016-37501347665a", "comment": "Malware payload (CobaltStrike)", "value": "8098003a6bac124b16bc1d013f86a9eb", "object_relation": "md5", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790257, "uuid": "4587522d-d758-4ceb-a22e-3efaad869e07", "comment": "Malware payload (CobaltStrike)", "value": "c5140ecb646ecccd0d5f78173b49e73be0dbb46355562a2f8ed4d63878967684", "object_relation": "sha256", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790257, "uuid": "9b28a003-a09a-4623-83a2-57213c9bc75c", "comment": "Malware payload (CobaltStrike)", "value": "0c7f54739c0beeb4b671579be505e4e24ce0e045", "object_relation": "sha1", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648790257, "uuid": "120c9656-f363-4c97-8452-5b739c5f09c0", "comment": "Malware payload (CobaltStrike)", "value": "f3ab5eeee421dd00f74cbcbf1cb130ce12dfe98a64881f33fb93d4b087e63df2838141f45e9ceca53696e00135f14d54", "object_relation": "sha3-384", "Tag": [ { "name": "43-132-174-96", "colour": "#65C7E4", "exportable": true, "hide_tag": false }, { "name": "8-210-180-142", "colour": "#2ED03F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790257, "uuid": "5cac263d-6d44-4a9a-abc7-1633c6fa71ad", "value": "T11E84F15BB3AA30F9D4678239C9A1595AF77278320731DF6F139003B61F232509D6EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790257, "uuid": "951e5ce4-f9c6-481c-b358-e0905cbf6c65", "value": "07044be2c40e611c29183d5d3b7eded7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790257, "uuid": "09024774-32bb-458a-8ce0-e091ebac8444", "value": "6144:ig8S8bLU2IVqDtiz/mV2Cp/3ScDy4CKk1+gx7Or+ajfTaT4ceOkcohJ:ig8mHqgQ3p/jDy4wCyatNncA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648790257, "uuid": "7631ceeb-2a26-4820-bf8f-1502910545c6", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648790257, "uuid": "72c3fb41-c0f1-4582-8390-87dc32e76532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648790257, "uuid": "e037d358-25c2-4da0-997b-5ce3da923c20", "value": "c5140ecb646ecccd0d5f78173b49e73be0dbb46355562a2f8ed4d63878967684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19acf47-b1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648837753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837753, "uuid": "84a65e8f-bc8c-4d75-a3dc-c4f0ced6d2f1", "comment": "Malware payload (Heodo)", "value": "d4292b0ee7d737f96844aa3b1e6e33c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837753, "uuid": "9e498dc7-ada4-43a8-b91b-8b1bf1911f77", "comment": "Malware payload (Heodo)", "value": "c55885e99c7456d6ebcaf90a5b07bd92483260031d730a8c62866c74ef94690c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837753, "uuid": "4adfcf66-d1f5-485e-b636-40265706ccb1", "comment": "Malware payload (Heodo)", "value": "af8d9798b370f1f6f378a48aacc51bf02ce2dd6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837753, "uuid": "ebe428cb-0857-4b93-b5fa-9da5062dadae", "comment": "Malware payload (Heodo)", "value": "1736137ef1c184d626fe3a6ee795a79ec56f0b188ffeee0ecbc11f8b8e03e8339a4a1abc71a4b17eaf30313e2aef85e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837753, "uuid": "278bcc07-0b22-482f-ace7-b32d18fde931", "value": "T1B194BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837753, "uuid": "5cfba1f5-363d-4157-a46a-2eb1570ea3f1", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837753, "uuid": "3a74fa96-334a-4de0-a1ab-375be0211463", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDNS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKRrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648837753, "uuid": "b511adf9-8d4c-4f5f-bd13-887a4fcdc0bc", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648837753, "uuid": "0c965db3-05e3-41b0-af63-2a7ec6b96d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837753, "uuid": "e347c69a-573f-41f4-a1ac-435296eb485a", "value": "d4292b0ee7d737f96844aa3b1e6e33c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13137a81-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648819905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819905, "uuid": "dd54c360-a08c-4366-9ec7-a4807c2f21f6", "comment": "Malware payload (RemcosRAT)", "value": "b8d8601565690837b5392ffe1841a140", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819905, "uuid": "5e84904f-042c-4976-9dce-bfbced925d99", "comment": "Malware payload (RemcosRAT)", "value": "c57ea1f64979c6a3c283e6f5869706fcc49772f7717df7d34add28562dc2aed1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819905, "uuid": "13b2dc63-08a4-4b3d-a38f-92679e3093cc", "comment": "Malware payload (RemcosRAT)", "value": "0886d6a397d8863a70ce25bd1c794147a2af6db2", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819905, "uuid": "18d35389-82f3-412d-8269-64e64850bc0c", "comment": "Malware payload (RemcosRAT)", "value": "5e0357b37ba4696f72586c3bd991531703cff239c31d6161fe48e4ac6e0e9420040833264b46a120a3cb9044f4a4742f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819905, "uuid": "149eae76-63e0-419f-bd9e-7bc5f81493c3", "value": "T1CC0430D5E686297B5DF702A2AC0F495EBE2360A2221116217F4DE4CC232165FD7F6B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819905, "uuid": "826326bd-f0cc-41ce-8b0c-75d866b26070", "value": "3072:AnFkJughJ103pvjOTXhJ103pvjOTXhJ103pvdhJ103pvjOTXhJq:APghJMjOTXhJMjOTXhJMdhJMjOTXhJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819905, "uuid": "c7a8733d-6c88-4c1c-a57b-a4e0a6d05563", "value": 187900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819905, "uuid": "ae08281d-abf8-4987-987e-10eb01761160", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819905, "uuid": "4627fcaa-4f93-467d-ad4c-2b4a39877507", "value": "Curriculum Vitae.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d15b34-b197-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802545, "uuid": "27a6e5e8-32c7-42e5-8d4e-e0300f299c62", "comment": "Malware payload (Heodo)", "value": "3d230401a44d31b9edd22f9bed2382f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802545, "uuid": "063513e8-a6cb-446c-8748-9ad272c63fac", "comment": "Malware payload (Heodo)", "value": "c66e5aab61c99f7d2d877683af83e0367000b48b3e27b6c6e88aa4c6fe6a8b0c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802545, "uuid": "45fa0863-f180-4703-8dde-2ead2dfb5008", "comment": "Malware payload (Heodo)", "value": "376b6b3c07c726f27cc730f4b982a25df61b52fd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802545, "uuid": "d1441e00-b0fd-4088-8aaf-e889382a6e05", "comment": "Malware payload (Heodo)", "value": "2420e1527c948f9461ff9434d42035990aebb58d85206b66194d613e230cb7091368bcbaeccc53a2e0028cb1f796160f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802545, "uuid": "289750f2-6524-44eb-9831-7124c8d44fee", "value": "T176B4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802545, "uuid": "f7ad6ca4-b219-466d-86ba-3976457b742b", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802545, "uuid": "a9cd6cfa-b90d-418e-a8b0-ef5007dc42b9", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQAJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzEDIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802545, "uuid": "3bd8afc4-8489-4d7d-90cd-b8d07b13db39", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802545, "uuid": "acb35803-46a3-4ea6-b6f7-00d3be48b82a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802545, "uuid": "065b32ba-43ed-46be-a7d3-2ea476f64fbc", "value": "WwIpuL58DT.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21fabe3-b1ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648839553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839553, "uuid": "c2e7d942-d33f-4cf3-97e5-1597ea7c37c7", "comment": "Malware payload (Heodo)", "value": "a9ef1e0ece50657dbaa4d6297be044a2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839553, "uuid": "ec08db18-7698-4099-9646-528bf8845618", "comment": "Malware payload (Heodo)", "value": "c6b503d110e62ba661c7a34cd2214051b5f8c507171c0195da7d4ee30a0ecc6d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839553, "uuid": "231a43fe-4aa6-484f-a783-15e2f16a9229", "comment": "Malware payload (Heodo)", "value": "0a93e0b22b6af1d7c4471940f69d5efb075fafdb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839553, "uuid": "ad490205-add1-423e-be68-7321fa6b2bc4", "comment": "Malware payload (Heodo)", "value": "32bb2cfb59c4444e6dfe27ea8f84a67072d9f85598aa6b53b41ad82e237b91e5b22f4929e6e91b56f80b50c9fc3c5f8f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839553, "uuid": "8f6e674a-84b8-4bcc-8a2e-dafe562cf96f", "value": "T10833E996B659D969FA1187354CEB87E66322EC205F5F17833229F336BFF88B00647106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839553, "uuid": "57f8cf48-8b22-4e28-8d5f-58ebf3b730a6", "value": "1536:bRKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+q43SaU3hT5:1Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648839553, "uuid": "4598f3ad-d8d6-412a-83bf-f15e94bfc3c2", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648839553, "uuid": "219ca505-bd8b-45e9-b409-24eae0246a43", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839553, "uuid": "7b4445e7-90f1-4e37-8a57-cb920b1329a6", "value": "doc-935.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124f0548-b1a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648806589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806589, "uuid": "cb23612d-0b7b-4361-bfc0-47c4e629cef0", "comment": "Malware payload (Formbook)", "value": "55b1c37b52d13f64914c77a6bbae5e66", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806589, "uuid": "98ea899e-281a-480a-909e-fcdbb77d2c10", "comment": "Malware payload (Formbook)", "value": "c94f6837f01f7562aca768377b73b23e0aa400db10eb371403b6bd439fa4f4dd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806589, "uuid": "72ee5556-b420-4618-8671-8ea54521f6ff", "comment": "Malware payload (Formbook)", "value": "7ebf8ff8ac002626fc4e99636cd2b2d7130e9ee2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806589, "uuid": "750feec5-82f0-4c32-9d06-caffe8f0b421", "comment": "Malware payload (Formbook)", "value": "d7200cede72950513d26aaa9ec405be7af5dd8adcd6a0d337d3c0af58ae2d42f994d4d95c730450a0a8d4ddee786c740", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806589, "uuid": "f2c53a24-4c4a-4e4c-aaf1-793a33ce7c89", "value": "T197F433787B519980A10E960E13F8C105CF17522B9D73ABF5688F4CCFB27DE896DAB085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806589, "uuid": "50231965-9937-4fe0-85ea-c6ef7af7eeda", "value": "12288:A79oWpRgXe3/JBWNl99ofNXrIOHDIzWoF0d37GT08aqoLMUv55yEU8Eb5Lii8nb:A79oWpRuePJBSYprIOHkzVUMHUvDyPLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806589, "uuid": "27c75c23-8b31-4e38-b9f2-99af7b1b4079", "value": 746036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806589, "uuid": "04a71657-7234-42f6-8b00-9e40a4446d68", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806589, "uuid": "f3944d94-bdbe-44d8-8426-3b7606e1e10d", "value": "Request For Quotation GM-0034.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56a6bde-b177-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackGuard)", "timestamp": 1648788797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788797, "uuid": "efdb70e5-a828-4597-bde1-8b0d39894efe", "comment": "Malware payload (BlackGuard)", "value": "bbb9de0f35d59374d7267f983a3f362b", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788797, "uuid": "4cc61ff9-7eff-420d-bb08-9947a10c5a21", "comment": "Malware payload (BlackGuard)", "value": "c98e24c174130bba4836e08d24170866aa7128d62d3e2b25f3bc8562fdc74a66", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788797, "uuid": "a303e043-2a2a-4cea-b1a1-61df9ac7c855", "comment": "Malware payload (BlackGuard)", "value": "0c4df9e1941b1f555b867b016148409b51f49f63", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788797, "uuid": "110cad44-3cf8-4ba7-9564-af2cc1a8254e", "comment": "Malware payload (BlackGuard)", "value": "76e4a3d7a95e5617ae7e4f2ee86e9e1cca352e44ae80379697d1efaaa26cfad55a51efe6ff5192c2f24a0a81d7d97a6c", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788797, "uuid": "b86b3c28-e810-41bc-8d6a-44a5eb094ac2", "value": "T1CB163A1827E84617E3AED3B8B4B048B593F1F82FB363FB4F6545A2B61C567905802367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788797, "uuid": "9116f0ac-7e7b-4f00-8016-eabe51efa567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788797, "uuid": "cba1027c-2d7d-4d2a-9d54-896397df9432", "value": "49152:ghpEf4/4hyBYKMD+SNfXCwJtezvOd0HSC3souk1b36rH4cseBzjyxeb:ghpEwMD+SNfCWtwlcAxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648788797, "uuid": "91d60e82-06a1-4316-83f0-7809180ca9fa", "value": 4354976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648788797, "uuid": "53082b8d-75b0-4885-a349-fd28df169217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788797, "uuid": "7cbd05df-4692-4a1e-8b3a-a0e1be47874c", "value": "c98e24c174130bba4836e08d24170866aa7128d62d3e2b25f3bc8562fdc74a66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a6f7ce-b197-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648802434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802434, "uuid": "dcf23dfa-c622-4628-85fe-7b62c670bfc2", "comment": "Malware payload (Formbook)", "value": "b47cf656e1d8997f78702f1b5c34743c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802434, "uuid": "f55585b0-fb94-41db-87a8-985371f89ef8", "comment": "Malware payload (Formbook)", "value": "ca7d37a30904725a82277567c30ba0fe5b441dad6d86d48afc3a954e8fdbd78f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802434, "uuid": "483ba4c3-a830-4f19-a5b2-64a5f029d59b", "comment": "Malware payload (Formbook)", "value": "b6bee167e2785945f9997ac0c6203963c85894c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802434, "uuid": "21e9c166-7918-47c2-929f-f97dbbc477e8", "comment": "Malware payload (Formbook)", "value": "0eb0e38260d3b773c0540e52c41ba1f30ecd33e9f90f6e18b4fd570873d7566f1b58324f51a5fc434e7cb7c52fb0584b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802434, "uuid": "a761d460-2a2e-4a6e-b208-fceb340d0394", "value": "T12FE423397AB848ABCBBF47F49892581053B9D702BAA5D7489C9530FD58E33D10E813B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802434, "uuid": "348b8aae-671f-4ac0-9825-f1e090dd307d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802434, "uuid": "97f6528b-7fab-41d6-a5a6-71a1c26a1535", "value": "12288:Wnw/tifTLDbGQnsVyIXMymCZ1/T94prpK1tWv2sMbEngXrCk1diJzD9g:HtCTLDbGSWy6bmY9Arad2gXrCk1dYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802434, "uuid": "6a0d3607-f84e-4047-b60e-d84c517c8e9d", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802434, "uuid": "b6e2c2ea-f1c6-4ede-acda-451289c4c98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802434, "uuid": "5645c06d-a235-4b54-a654-f074ad474f18", "value": "PO 2224467-Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d2c935-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648820175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820175, "uuid": "6d5018af-2ab5-48f9-8e0a-5e58583aba6f", "comment": "Malware payload (AveMariaRAT)", "value": "10081ebdb9034e40298b3bfbf8c5a141", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820175, "uuid": "68154809-22d9-4f32-b6ea-6c086ae79edd", "comment": "Malware payload (AveMariaRAT)", "value": "cb493d95faca1e74deefd235946202bc339f80552c29c495ae056d6082d22ff0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820175, "uuid": "15d53edc-18c1-494a-aaf5-479da957afab", "comment": "Malware payload (AveMariaRAT)", "value": "ccc3953638e8e351fea5f562209f1f83c63b4025", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820175, "uuid": "3877a089-c3fe-48f9-bd3d-14080bdfde95", "comment": "Malware payload (AveMariaRAT)", "value": "06ceb422bd35958727533c2416f4445d3b3b28d9e66bdc52b8a642ee3aaa99c1530886df6fa8a934e51c12bdfbff9aa4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820175, "uuid": "775d984b-069c-4856-bf67-3156b62fc14c", "value": "T169155AE17728C8E7D79F3B33CCE26EFB48D123D525421A8A115073C53479BAE291A729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820175, "uuid": "ef2c66c7-b10d-49e0-8fc5-aab1e1cd8908", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820175, "uuid": "882cf7e0-5674-442a-a7c9-f30c915ab0b9", "value": "24576:ntqvVI6T2TgO5fsvhEm2g2DTfl71plWp:YvVDMH5f2cO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820175, "uuid": "9063bfa5-ee84-4df1-b204-aa3487b35e83", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820175, "uuid": "3991524f-e33c-420d-9a86-50dd6bc49a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820175, "uuid": "5658fffb-7799-44ef-8734-e93d77f44e79", "value": "Documento de recibo de DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f17fbcd-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648835145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835145, "uuid": "aba1a8e2-f636-42e5-b6a5-417cbf840f2b", "comment": "Malware payload (Mirai)", "value": "611630a580e33017be32de8c72625489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835145, "uuid": "7fa8baeb-d0c8-4fe0-b4a8-01815fb5de77", "comment": "Malware payload (Mirai)", "value": "ccd4db70685eb8b0af24596d81684938d378053e35253504ff4fcfc357b41de1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835145, "uuid": "f542cbc9-419b-4030-b849-ca73c83135d9", "comment": "Malware payload (Mirai)", "value": "db226fcca063125d8d30970cf428a035c5d809fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835145, "uuid": "20a6397a-f59d-491f-ae39-ebad7b53d1f2", "comment": "Malware payload (Mirai)", "value": "124d5f73d211a0e803c733098c4e81d965f828903298a8f0ea567b4f51bda8968ade84e1f2a672fdb8c276afa861826d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835145, "uuid": "dd35af53-bd0d-468d-968b-efe16ced7485", "value": "T173633A85F583E4F5EC02047921ABAF769E33F1BA7536EE96D3AD59329C01602E10778C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835145, "uuid": "1f2626b9-afc0-42dd-9433-4da7ac861f9b", "value": "1536:S+nNyb4fgUrbsLF86fPLxiUaUBC6t50573Ony6mtrbe4F:5ngb4fgUrbsK6fPLY/F+5g7+yRplF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835145, "uuid": "662ac2a0-e068-4333-9fec-2a32b4d93609", "value": 67284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835145, "uuid": "99dfc87d-3ea9-42a8-8dbe-981990bf1047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835145, "uuid": "f12c77a2-46a5-4416-a343-9807e59c2eab", "value": "611630a580e33017be32de8c72625489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f7a19c-b1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648837727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837727, "uuid": "78118577-c89a-45ad-a9d8-4389dcfb13a8", "comment": "Malware payload (Heodo)", "value": "0b8b0da11d6c11b64be761b5b94a9389", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837727, "uuid": "859e7391-3d65-4a93-bea9-3acddb544d78", "comment": "Malware payload (Heodo)", "value": "cd55e2dc6fddf3db80bea9a1dd50cca989866e7948985c5b18156ed1fff1433e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837727, "uuid": "8010c853-3823-4435-9cfa-116c0b56d8c9", "comment": "Malware payload (Heodo)", "value": "b82199aa2c49ad03338db48373a3e404c11c99cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837727, "uuid": "7eb24e78-2063-466f-b8c3-e600e17d40f9", "comment": "Malware payload (Heodo)", "value": "caf24c0393684c2cf772ff0732ca0fe813d606ee0ce89731a9dfbfd3f4011b3f5de69510bf5db8d7f3eb1fbecd37992b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837727, "uuid": "d7fdc087-bba4-48ad-b765-1dc085a24b3e", "value": "T16094BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837727, "uuid": "0fdc4eb0-689e-42c6-8b70-b273f7be04f8", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837727, "uuid": "dd3f9c4d-39c4-42c7-bd88-ad14e0589d7d", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD38S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKDwrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648837727, "uuid": "e8d86239-666b-4372-9bb3-8c43f14b7868", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648837727, "uuid": "ec6cab71-d87d-4664-8353-4e8e2978bfca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837727, "uuid": "b2308dd7-ae31-4409-b305-c4191809c3e5", "value": "0b8b0da11d6c11b64be761b5b94a9389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c56bc3d-b179-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648789507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648789507, "uuid": "59ddc884-2156-4ead-a63d-79210f152e96", "comment": "Malware payload (Heodo)", "value": "3112ec80c2061804f1c624d179cbcfe5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648789507, "uuid": "10e066e0-29f3-4a99-a264-4f80f9cd2325", "comment": "Malware payload (Heodo)", "value": "d0105d1d011e7e3e2a9f808ebb1749590374a92c71c244735e720dbadc51cb68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648789507, "uuid": "aefcc57c-c212-4e8d-be51-c4d2299b31b8", "comment": "Malware payload (Heodo)", "value": "d206b6eb6b3970f6836a3c7af31124e5caac0d04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648789507, "uuid": "ce813f79-ef40-4daa-8e20-5545a7b63ab8", "comment": "Malware payload (Heodo)", "value": "b4bca557f00c135a2a5bb3e6259c56ba7d10a009d2db0540ec21aef0b02e71d2b771c2200f522b4f0a11ba38c08c6bb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648789507, "uuid": "a29be534-b8ad-4b96-84eb-7246e6fe886e", "value": "T102B4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648789507, "uuid": "1db5c50b-6946-4c41-aa75-4693c538a195", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648789507, "uuid": "c4aa454e-18c0-455a-bbe8-1e71fead37ae", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQhJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzrDIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648789507, "uuid": "571afec6-face-4c3c-a7ef-3120060908fb", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648789507, "uuid": "820c9069-83a6-4a1c-ae04-212aa8e5cd1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648789507, "uuid": "0ec432b4-9611-4314-8529-e5c2f51da8a0", "value": "3112ec80c2061804f1c624d179cbcfe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d79971-b1ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648840098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840098, "uuid": "c0c21883-63c2-4930-8aa8-97568fa214f1", "comment": "Malware payload (Heodo)", "value": "dc7d5ffe854139ae2734ea5133a8d364", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840098, "uuid": "a0b7c942-d867-4e84-a324-ac4f6e627f5e", "comment": "Malware payload (Heodo)", "value": "d0b1e642915ac1f888c6d0c4553dde5fc6c55e3c06511ee2b98724c766f50d98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840098, "uuid": "796b1116-a0e5-4666-8cfc-6621bf9abe5d", "comment": "Malware payload (Heodo)", "value": "50bdfba9523956fc911ef2226c23576712b84bc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840098, "uuid": "0a374c40-8999-4b92-8f8e-607d193802fe", "comment": "Malware payload (Heodo)", "value": "32fa4cf137eb7012f53a59f39e8a593735c73e17f1d413bd88876d007637782126ea2c8b3d37733c38aaf3063fe76c48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840098, "uuid": "c404f7c9-f4d7-40c0-ac47-b4bf490e967c", "value": "T15D94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840098, "uuid": "3a223f67-bcfe-4769-b614-7bb55400d7dd", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840098, "uuid": "ebb1ead5-0f36-4ae3-ab25-b210de3c98ea", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD7S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKrrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840098, "uuid": "89b7f91b-fa54-4dd7-b327-ebf1309a0eb8", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840098, "uuid": "fd02ff9a-0dc9-4add-ba6c-0cb1303410f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840098, "uuid": "2c73492c-0baf-4ed3-ba51-da0098bd68bd", "value": "dc7d5ffe854139ae2734ea5133a8d364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57051bb-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819855, "uuid": "7920b189-0ac4-4a88-bcc6-02f6eb3f5ad4", "comment": "Malware payload", "value": "658ce03c22fc00050809577bd2e82528", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819855, "uuid": "257aba20-350d-4ab7-88eb-60980fc27e6c", "comment": "Malware payload", "value": "d153050b2a67eb4e9d2f305107201283941b76e9fcdba4f6182a13df49197571", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819855, "uuid": "c4eb1c87-814c-4deb-94e7-1b2f4f08d623", "comment": "Malware payload", "value": "4512bd48b4ece79c287bf3de885a63b9451d8284", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819855, "uuid": "a48daeb5-9712-42cc-b456-0c792391bd97", "comment": "Malware payload", "value": "9acb3cc562de12d5ba2412907b560800d39ed98c4d57f0f041c577fd598938974769eebe3f9aa67435f6f9dd3179e1e4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819855, "uuid": "2ba3047e-d24e-4a0e-a52b-57d0861aefcc", "value": "T161565B1BBE84653ECC6F0A3E4577A25C993F7BB12912CC5667F0088C9F35A416B3A607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819855, "uuid": "83e50802-492e-4b47-bdbf-073dbf90e755", "value": "49152:JEdfNnbwVlrKfmp4SqT1GESlyltd0Yj+t9vMQJszdfmi7Vt+5eCTT73Q2lh9hXGe:C1bO9yTd0AQJslmiUe+D3jGYGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819855, "uuid": "78a52436-f171-4f5e-9ebc-46ffc3824e11", "value": 6359552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819855, "uuid": "35ac0579-c8c8-41ac-952c-71d26218121e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819855, "uuid": "6fa94aba-bb15-49af-90b4-f278e23887ac", "value": "__=cilq.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a1ee4d-b1b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648814186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814186, "uuid": "75e1d58d-5b62-433f-81db-aea258f18ea5", "comment": "Malware payload (Mirai)", "value": "ed29f1113cdb0bfd53646895e76c2928", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814186, "uuid": "ac507a49-b218-468e-b21e-187eaf5af344", "comment": "Malware payload (Mirai)", "value": "d15ece5e708670eae076cbca8e3c96483e5b5e94a906117de52b98b0d7d6a760", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814186, "uuid": "57125dcf-2c04-40ec-b1fc-4846890e4472", "comment": "Malware payload (Mirai)", "value": "b3cc24e14c2053f3408ff7104822d217220da0c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814186, "uuid": "ca82423a-d83a-4e20-a0c9-32e3ce5b1bef", "comment": "Malware payload (Mirai)", "value": "700ddfb971f2434c8658f58b9e9aa432fe6dd5fa436b2d9e668e46e804058137d87a77205516f64d2bee3a42baa093f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648814186, "uuid": "32c1b3a5-95d9-459f-9762-e3cdaf227f9c", "value": "T1F8D2E1F1F50A8AB1C6700036E1A903637358A77979A8656294500BA8FFE72D463FB9C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648814186, "uuid": "b35d0f3d-454a-4978-a538-9f2a9d2fe0ea", "value": "768:gREw56sf+I/spgx568ni1uYlEajxewJq3UIOK:gKwIKN0pG482DxlmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648814186, "uuid": "4a7622b5-96f7-4b06-a699-4a1b76ddce98", "value": 29856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648814186, "uuid": "df1b014b-20c6-4188-86b7-da28032e5279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648814186, "uuid": "914ba285-c256-456f-a1a7-9269e9867f1c", "value": "ed29f1113cdb0bfd53646895e76c2928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529e5500-b1e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648834185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834185, "uuid": "96002001-5a93-4eaf-bbf4-7e6e3f26ca25", "comment": "Malware payload (Loki)", "value": "b6d36cb695f76f7a0e7fca797691b481", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834185, "uuid": "dbad5351-c603-4cf6-a0d0-a3375714961c", "comment": "Malware payload (Loki)", "value": "d21e92e587090269f509a9d48b870504502a445058d89f47a4880851c5c27d56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834185, "uuid": "100f6ae5-d489-48b8-8bf8-de27431e555d", "comment": "Malware payload (Loki)", "value": "26d002b9f814444dfcb5804a677c93c1238c88a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648834185, "uuid": "c4f50495-1d5b-41e8-9653-60d149258d2c", "comment": "Malware payload (Loki)", "value": "5b50cc927d347b47e6f2942bc96869f7c8a8975e0b622cede56ad712e677ec73d773f4f1c78d3883781df8ef1d902bd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834185, "uuid": "428565ef-090b-4942-ae95-fdb18638eecc", "value": "T1AFB4012A33788F16C1BAB3FC4836508057F22E392835E75D9D8234EB12FBF529951A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834185, "uuid": "e06513ad-46d3-43bf-9ccc-311acca5d893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834185, "uuid": "398db6a0-ea24-4eb6-b629-ec49d15daf90", "value": "12288:7kSegUehssfi4Ja5nQ3la5IRFuU46oan+Tu:7kSB5walOImU06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648834185, "uuid": "6595e07a-3f2e-4b69-a46d-1ecb139dfc61", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648834185, "uuid": "b98657ac-3533-4e68-96a6-68205d55acdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648834185, "uuid": "1b5eecf7-6e5a-442e-8f32-d9de7de78b19", "value": "b6d36cb695f76f7a0e7fca797691b481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca02d0e-b1c7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648823303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823303, "uuid": "8d761d33-55e8-497f-aa4b-170e808484b9", "comment": "Malware payload", "value": "f386c78f488197cec042a2268abf5b81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823303, "uuid": "ea3a9778-9eb0-4f89-abc5-774668b4d37d", "comment": "Malware payload", "value": "d23a3aae9a1c5b8d5502b108856f0360a4af56c79fe421ca9125ba6bc259420d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823303, "uuid": "bb552130-cb31-4e3c-ad96-d93acb82383e", "comment": "Malware payload", "value": "099d70f73ba77f77c6bba0544b8adf3e495ae245", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823303, "uuid": "c303ced3-1323-4c19-a7fe-d02793f61318", "comment": "Malware payload", "value": "0add161019158a9401bb267116593b0faef3e47841c0e52384d56801a6034f598b00fe7359371482a205f8d0c8756fd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823303, "uuid": "3b7117e0-89ed-47b1-9828-24b609b470f6", "value": "T147E423ABF7059E3EC85D2E369247FC261953BF28B9CA172E1798B51C15773423CA0827", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823303, "uuid": "d0f69bcb-5804-4d3e-ad6c-23360e01a0f9", "value": "cc21113cced77ca6f5c5fa42f742719a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823303, "uuid": "56d7cb2d-faf5-40e7-894b-2c530b678cd4", "value": "12288:7rBKXFMOUA0Q6hXvz/Dhaoa65WqC1GyiQgz4+LvWWOZG1Jk2mfPvBytYPZYa/:/BoFMo0Q6h/z/NaolWf4QgbW+bkvnJyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823303, "uuid": "b3fd1580-74b3-470d-9f2b-a89d0d224e1d", "value": 698256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823303, "uuid": "b1a7a081-c4d1-4bf0-8caa-2c2ee34d1b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823303, "uuid": "9f38ac12-2545-46e5-8c51-2fb6f5f8a413", "value": "f386c78f488197cec042a2268abf5b81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7403880e-b1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648837677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837677, "uuid": "fe5ad53c-fc71-47ad-8220-5c38fd6862fc", "comment": "Malware payload (Heodo)", "value": "450419cb38805a0427c7cafa3ce24233", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837677, "uuid": "d59dcb87-bffb-471e-9c2f-f043118b5749", "comment": "Malware payload (Heodo)", "value": "d29a0e17c32710f5a68f20f1775f3c9c6ff49946d66432df3b113865ff42c627", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837677, "uuid": "bd78a2cf-644f-4fcf-a677-d42f362d947f", "comment": "Malware payload (Heodo)", "value": "797e383d3784680d98cc85f9c8b1bcc5bab108b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837677, "uuid": "d226d35b-6700-4958-b765-0e4a0534d427", "comment": "Malware payload (Heodo)", "value": "bd6967d26ce80870494781f1c8eb20365a116285bcb5506a43c124174116ac6d1d9de9abc309a102103e9afa5ba5c872", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837677, "uuid": "96273311-8e5b-4c74-bd5d-3008a68cdb7d", "value": "T1A794BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837677, "uuid": "f62100f5-048c-40be-b7eb-c698044e2392", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837677, "uuid": "ad24e1b5-4626-4a76-8b27-180948dd1668", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDgS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK4rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648837677, "uuid": "d9a604f7-bb78-4da7-8e0c-b027fcde0a47", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648837677, "uuid": "3cfe800e-3d95-4f3e-b01a-93e953b0ae25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837677, "uuid": "fe0a232d-560a-4703-8490-c99b9ab89cca", "value": "450419cb38805a0427c7cafa3ce24233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f58d852-b1fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648845722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845722, "uuid": "d939f2a6-982f-4619-9875-96f11766e4ab", "comment": "Malware payload (RedLineStealer)", "value": "83ee93fdb5f41d19755f27eb67925964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845722, "uuid": "9e81a4f7-1e37-4d47-ace7-b5ff7c71f88b", "comment": "Malware payload (RedLineStealer)", "value": "d387247c7e6901ab07a1e3d42e6840b927939c861292e6ea5e8e4c51c390d3a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845722, "uuid": "2dad9356-b40b-4826-82ac-08f4b3ac37d7", "comment": "Malware payload (RedLineStealer)", "value": "cc7ce9e29d2d871285b7277ff87784ba595e3cf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845722, "uuid": "83b9f1fe-59e8-4b33-8710-3eeb4aadde6d", "comment": "Malware payload (RedLineStealer)", "value": "38ad9053ceac2b067b962c2b00309bf29db739d52065ba463774cb3657e51012159c4804b484b8789063c6c1f33a973b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845722, "uuid": "1a48dbd6-e4ef-4361-a114-3e8bb3a49f28", "value": "T1A174BE10BB90C039E1B727F09879D768B53E7EA06B2495CB62D41AED5735AE0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845722, "uuid": "6b5df685-eeb1-4bdb-85a2-628cdc72769a", "value": "f22c415437cc9d7cf824990538373125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845722, "uuid": "9a016268-b3a0-48ac-a7c1-36dd0e588c79", "value": "6144:QTyxBLP0IuZcyypQiLzjaivK8vdco2/iJxqpIDqV5oBkNie1ZyyqWYOyHzkB:QTynrtuZcyIQE/i8v8aJxcI+V/NTXyVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648845722, "uuid": "a0354852-213f-4532-9113-85c5b74e5daa", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648845722, "uuid": "27d450ea-c982-417f-9169-569469bdf90c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845722, "uuid": "cf02248c-fe7d-4710-a59a-3b3b1f9e6ce2", "value": "83ee93fdb5f41d19755f27eb67925964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0b7ff9-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648799843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799843, "uuid": "10b49e72-8962-4d66-b0a5-d7c37f6a43f2", "comment": "Malware payload (AgentTesla)", "value": "5c37aa8fc543d7e13a0a88fe33fe268f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799843, "uuid": "75305a09-8f1a-403c-8a72-834a1472683c", "comment": "Malware payload (AgentTesla)", "value": "d3fc9469f80bd7a82bd970ca503ac564e555e1033ce175867b5826028809cbc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799843, "uuid": "f25c7300-1169-4b10-8990-3ee19fa236fe", "comment": "Malware payload (AgentTesla)", "value": "3f9fdaec35861cc4a3945186870e81a4618e6a3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799843, "uuid": "6eb107a8-0143-4481-81ac-bb0ee7e028bd", "comment": "Malware payload (AgentTesla)", "value": "cdb45f0308b71a8c73429cf0887fb597f28920ba3b45c5aaa93bbfa4d4c975a39c9573f60130df158e62135a28b2c235", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799843, "uuid": "bbc70d91-defe-4306-aec1-ce3a1f2bee15", "value": "T199056DA9F2F074DFC997C4725D19CC34BA517CBAA20A411261D73D9FB9BD9A38A00393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799843, "uuid": "95dd8594-f7cb-404d-9ecf-6d34f87f29ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799843, "uuid": "4cd077d4-1323-4699-8447-1dec0e83f69a", "value": "24576:EXhQ9NKoqKayi3aL8t77BV5BD/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMu:EXhQ9NVHiqAt7bD/MMMMMMMMMMMMMMMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648799843, "uuid": "4ac98209-50f2-42e7-b4a2-7566adfa5ef9", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648799843, "uuid": "f6cf2711-260b-4604-b731-7756a08f4d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799843, "uuid": "5bb05458-39cf-48c7-8877-42a49e76cc8e", "value": "Outstanding-Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2cc72b-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819517, "uuid": "b6d6321e-8c05-4a25-88cd-33a19bc4f8d3", "comment": "Malware payload", "value": "37799928afbe2613feb4e9699a728cf5", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819517, "uuid": "d5d0a5ca-a04e-43cd-954e-76edcccee808", "comment": "Malware payload", "value": "d43489191e39ed08b4471ce752e10f0f0240127ad5192c548a0bf1da9d00ef0d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819517, "uuid": "c5651d44-0192-4eca-9ed0-dd3d69fd6fe1", "comment": "Malware payload", "value": "b262909286f1f5e2e5318a7f1d07a998f87cc2c3", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819517, "uuid": "a3b2d795-6701-4595-b225-26518a9fa83c", "comment": "Malware payload", "value": "436fff00de907ddd76f9f90b025dc95a401e810b8be2c19a311d32c8032f79a8d357a14b3b9b68058e290f3c3a488b8b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819517, "uuid": "48477bef-09fb-4d1c-bb74-4357d51e61a5", "value": "T158A42200B8DACFABF66389760DC5D7965379FC207F14CA076799776FA8306C8860059B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819517, "uuid": "268ba89d-0e60-448a-875a-abd5c59c8517", "value": "12288:j2uX9Zgm4oRC2aWhar9UZ+PMUs33XOor0mp2Xjh:CuNZgZWharqqMfOtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819517, "uuid": "19dc79c3-ae16-4e28-b401-fc5294e26531", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819517, "uuid": "140308d6-cd05-4c11-871e-9066e57273d8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819517, "uuid": "8fcf27e1-e66a-4dc6-b734-81f686ed7fe6", "value": "Payment Remittance.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6601576b-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819614, "uuid": "069464b7-043f-437e-8629-5754373d0740", "comment": "Malware payload (Loki)", "value": "1f912903bf45097d31408651d21785fc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819614, "uuid": "34bad010-7bf9-46cd-9ab2-0ef5e3a177dd", "comment": "Malware payload (Loki)", "value": "d47780901c834c1c6903a4135914dd3b75e2a052c51f6024633455d1e919e72e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819614, "uuid": "add70a23-44b9-4f0c-a7b0-af375bd6efba", "comment": "Malware payload (Loki)", "value": "94732292830712762673a7e4125ac8992cf478cb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819614, "uuid": "6603f56e-20e4-42bc-8c9c-54fc6bd90622", "comment": "Malware payload (Loki)", "value": "f0b909eeb48a58fcabf49db2ead8018f03a76790397d4fcc611a1c73094a0adb4f0fa2990d84363ebb17d8ced885c523", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819614, "uuid": "3b5ef953-f7f9-4366-8002-5e321e510e8e", "value": "T10E14120AB6DD0F8DF47653B64D5337C0DB61CCAD4A66A8778482B2070AB0C7D8607E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819614, "uuid": "978fc2ef-ba20-4e04-9a2f-9d0075d58b5e", "value": "3072:UoM2sygfftJHgq/LXXXmqaGC9A4XIrANlPrmxKi2stGDxmXPG+Oh/veKT:A2jgffngqjX2qaGC9nXIrs1mxR2s4xma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819614, "uuid": "d191b1d4-d75a-4bb9-b841-1a0d6fefc3ad", "value": 192056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819614, "uuid": "bcbe6629-4507-42a2-8d26-b9f8bf4b71cd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819614, "uuid": "82291c65-eb29-4141-9086-a8f622e7818a", "value": "_AW New PO# 05236.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7020efc7-b1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648835093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835093, "uuid": "80a30a8c-7d33-49e7-aafa-e51d41c97c1e", "comment": "Malware payload (Heodo)", "value": "54eeb8f2741547f5c9d3406bc205a983", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835093, "uuid": "1936e121-6c34-4080-861e-fd09c8e45a3b", "comment": "Malware payload (Heodo)", "value": "d5052f0f85c77d3a8263d9e6b52c142c122f53e3a39df28b06b528abe81d4102", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835093, "uuid": "6a2bc1c1-dc08-44bf-a380-5381a7366f13", "comment": "Malware payload (Heodo)", "value": "89df1210592816aba1955e5848787886c2e613fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648835093, "uuid": "6d887dbe-526a-4c0e-9523-8016f0632f73", "comment": "Malware payload (Heodo)", "value": "adb2103f256dd57e3bfd3e21b2089ec7e22cfda95b529457c11ee37218e9e58c5c84dd4f1d08f81f427c64b86b859a3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835093, "uuid": "640cc4b9-cf48-4898-b81e-bae6f245386c", "value": "T10494BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835093, "uuid": "46936e52-cc53-4d33-a2bd-9edb035b2aac", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835093, "uuid": "1afbb3e1-fcda-4001-8d80-221c707100e9", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDxS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKdrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648835093, "uuid": "a1d65aba-38d8-4fd0-b7be-303b413f218b", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648835093, "uuid": "8ab6ed4e-1eef-4f43-a73f-02197e5e963c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648835093, "uuid": "337db702-3d62-455d-8855-7ef2ae4b1025", "value": "54eeb8f2741547f5c9d3406bc205a983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24ba1ad-b1aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648810804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810804, "uuid": "7b88b7ce-382a-4a87-aa06-667dfb301ec1", "comment": "Malware payload (Mirai)", "value": "dafcc94cb33987a9303c48cd26204192", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810804, "uuid": "9f23588d-5d09-48a3-8120-74d01925a22b", "comment": "Malware payload (Mirai)", "value": "d55cb8d4df8be9c67b9d6993a837ff9913f9e5b8005fb2cdf76bd5db90ffa5e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810804, "uuid": "acb2c162-5b58-46a0-9fd7-be17db66feb1", "comment": "Malware payload (Mirai)", "value": "0b5181e12e185f77a71728f73ce7ec52e6b7299c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810804, "uuid": "d0c77ec1-cb82-4db4-8140-907d62990553", "comment": "Malware payload (Mirai)", "value": "8e06516a068487a11e535829fa7710db3dffa3e199b6f43e907667a161160d358accfd6755d5b6a0a8543d68d6126fda", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810804, "uuid": "6301a271-2699-410c-b345-f4f89e333286", "value": "T16B435BC1EA83D8F3DC12467534679F328EB7E57F2166EAC2D399943AA949400A10739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810804, "uuid": "3ae3c031-baf3-4f82-90c8-daacfd23d6f8", "value": "1536:XAjFk3BKboL6uyjyejpRz0r4VD8BFTqpGixd+w:X1BKboL6xye9+r4GvTGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648810804, "uuid": "3778ba9f-a2ef-4155-b320-ee7125c47393", "value": 59120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648810804, "uuid": "55a9c76f-a9f7-4beb-bd91-d2dfdac54749", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810804, "uuid": "96b68735-3ab4-417f-96e2-6ba96973a3c9", "value": "DEMONS.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62dab39-b19e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648805683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805683, "uuid": "63ff23a8-905b-4bae-b0e6-811a5d010bfb", "comment": "Malware payload (Heodo)", "value": "a0ae0fee8a1e52a4691e28c2198b1b19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805683, "uuid": "3c2adfe3-8212-440b-a1f6-9f0d04b03a79", "comment": "Malware payload (Heodo)", "value": "d568eec3d0a75e286e879bf210fe6f1d8eee45dc5b2af038123240c01e7d912b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805683, "uuid": "6474972e-c91e-4f20-a24a-b0dc250d5e4f", "comment": "Malware payload (Heodo)", "value": "cb20d441695a8e333a86c07066668dc5faa8478f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648805683, "uuid": "c08bf77f-5849-42b6-97d8-77076f5ecb28", "comment": "Malware payload (Heodo)", "value": "63b40a465411ffd3a8f51d8d51bf8307ed59f15d35eb39fd12240ba3d3610fcb0067b773e884c579aa0c2d76f271c9dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805683, "uuid": "8e1ac39d-d848-4ffc-8f1e-75163c2cfa62", "value": "T17F94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805683, "uuid": "b095e635-e77b-4462-a010-b13fdccc6a98", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805683, "uuid": "3868741b-e9a5-47b0-b1cd-4fc1bef28629", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDlS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKRrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648805683, "uuid": "bbf33421-db04-4ef2-b459-77da600ec07f", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648805683, "uuid": "820de9f2-7cdc-45b1-906b-26d09a7440da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648805683, "uuid": "ea7bf588-612a-487d-86d4-50f515a1c535", "value": "a0ae0fee8a1e52a4691e28c2198b1b19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcc9581-b1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648823463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823463, "uuid": "86f7d385-9196-4e01-ac9d-e21cf69ee157", "comment": "Malware payload (Loki)", "value": "be29e1e7203b3383bb87b4ad234efea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823463, "uuid": "e5dc12c9-944f-489f-a7cc-be620bf6289d", "comment": "Malware payload (Loki)", "value": "d678e7253d7e54232d22ef19e5e8a64b50137cbd2883c59c27a8e91fee5e320e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823463, "uuid": "a125f9b0-31c2-4921-b006-965e7ff30f41", "comment": "Malware payload (Loki)", "value": "1afce411cd2cc2fea7afa74409b113b28db7d18a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823463, "uuid": "c3d27cc7-f172-4140-8d7c-fe27862f4bd8", "comment": "Malware payload (Loki)", "value": "3de7f8895c197a13565240f28b10f63436e815048e041318af1d824b48e776219177204c77d923a1b6d7ff0e901cb4cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823463, "uuid": "d6e8e6d9-9562-46c6-9dab-090f73dc35c0", "value": "T1D234120823F0C097DA575631AE3D5BA6A9A4A936206D535F0F704FA87EB3BC2DC2D714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823463, "uuid": "ff39e083-4425-4729-ac20-4178c98d4cd8", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823463, "uuid": "07a24af2-fd87-4edb-9e1c-975596c5b772", "value": "6144:HNeZmzP+XsA+NTYC5i+BKsTBb7WHkUOPZNF4b/EzvlWrkqlh:HNlbO+FYCLTB0kdPZC/AGk8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823463, "uuid": "d7f116e2-f88d-4774-98d8-77bdcbfef39a", "value": 238175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823463, "uuid": "d0c64ba5-6a83-45c4-a81c-1cdb04fa8ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823463, "uuid": "1b164252-29cd-4f0f-b6f7-51a4df2431e3", "value": "be29e1e7203b3383bb87b4ad234efea2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614bafbf-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648819607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819607, "uuid": "beb255b1-877f-4d30-9d7e-d9451f313dd1", "comment": "Malware payload (Formbook)", "value": "726e5337e6668d1b12e30a98c6c9d18f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819607, "uuid": "8a4d92cf-2b26-4cc6-8b5f-4c686e089fb7", "comment": "Malware payload (Formbook)", "value": "d697ba3fa41d2c342e341ea035c21e64d284f2e13e69a84e21d477bf8bc62938", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819607, "uuid": "1dec00b5-4f8b-4a59-bbbe-7361f8686e7c", "comment": "Malware payload (Formbook)", "value": "f425d82e6a5af7cbce9b5af942b8785eb781beb7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819607, "uuid": "64ea0433-4ed0-4582-a431-d50c6bba2be3", "comment": "Malware payload (Formbook)", "value": "52bf895485aa3cc85728c0eaad4622a3f2fe8537089a324fbf052407264885ec7feff3e19ff40e44c8e6f582deb25f55", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819607, "uuid": "2e393916-60bc-4606-be56-589381592f5e", "value": "T1C1140144E34C65CEF9B9DC721553366ECA27BCDAB61463C72961324D01BF0A2F912A3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819607, "uuid": "1ce14e7d-ba84-4cdd-8328-6d09ad2509fd", "value": "3072:Jj2lK/iueGAjqCUKEs/xn+7VederTovbHSxNvafuEI2q4tyepRWcR3Vd8l8oS:klKK9DqHNm+7xnqjSzEkGyepIC3Vd8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819607, "uuid": "a44fcd22-7db6-456c-8306-98d02aa5a7ad", "value": 192072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819607, "uuid": "d1d9ab85-6d66-4949-815f-ed4a4359a28a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819607, "uuid": "3b3baf53-ad96-467a-8067-2c2330c85e3e", "value": "Swift Copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1691996-b19b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648804279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804279, "uuid": "33bab9a8-ef3b-4b69-8bd8-607555d408c8", "comment": "Malware payload (Heodo)", "value": "fe361c133769b10acbabdd7fd0c224fb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804279, "uuid": "ce5c9a97-bbb8-4a12-970a-3da090efee36", "comment": "Malware payload (Heodo)", "value": "d7215cb6342057d15f709283e47c2d8f4972a63e92a923e0dffd0885dde706ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804279, "uuid": "bc32b735-638c-451a-b60a-46b3ded0dc75", "comment": "Malware payload (Heodo)", "value": "b40ed7a43a65a90ecddbda119ac637ccf9b50761", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648804279, "uuid": "df985cd4-a5d3-404a-8360-9a6d2d061399", "comment": "Malware payload (Heodo)", "value": "c14c5f751e8be2acf99a180043df2e5652383b50849d2447db31da9befa192409ed42c039f6c21ea9beb14e2f1821fd7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804279, "uuid": "039c38c8-2a77-4e74-beb7-fff4a13adadc", "value": "T1F294BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804279, "uuid": "ec064de5-76a4-485f-9089-ccab12e3d4cb", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804279, "uuid": "a1362948-d5d8-4afc-beea-6a7a34fefca0", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD8S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKMrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648804279, "uuid": "39560519-9fa0-45d4-802c-a6716c7a6e87", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648804279, "uuid": "8b1fdf6c-1498-4a70-90fe-f85c4c92294f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648804279, "uuid": "37779a31-0031-468c-b38c-cfed32540a21", "value": "E8PY2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e5c839-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819853, "uuid": "f2b77010-f967-4d47-998a-c7193d02a5a7", "comment": "Malware payload", "value": "b2bcf4d335398041061735158951b293", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819853, "uuid": "9462ac87-6b0c-46b0-8ab2-876072d26698", "comment": "Malware payload", "value": "d909f32b25a8b087ef92e19337471af42b25c364510174e3a2e58bd3147b7f7e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819853, "uuid": "146c2aca-8ad7-4a8d-b227-eb34be9a471e", "comment": "Malware payload", "value": "a2e444c798a81d0ff7d4e797ab1d195880bb9361", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819853, "uuid": "181caa48-e6c4-4838-8abf-4fc905c30838", "comment": "Malware payload", "value": "0d4aaa70072f6f6d85ee7f3294fad5d04a160d1af0de01a3850e3757aa3631855be6698e5a25cde79e01e71f97faeb1d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819853, "uuid": "d7d55bed-a318-4a00-b4b7-9c276f022c1f", "value": "T120366D26B284613ED0AB1A3A5937A768993B7B713922CC5B57F4088C8F355807F3F647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819853, "uuid": "3dd73ce1-23a8-4ff2-b21d-eabf6465cf2e", "value": "98304:YsXrd6Lai/cRhZMCYD9+Ad1V8HrFoqrqvBtTGYKA:YsXSV/RVQrFYnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819853, "uuid": "a124c0b5-8a0e-4ce3-8414-94c1b3cf2ee7", "value": 4940800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819853, "uuid": "2d425ebc-d7e1-4e87-ad90-11fe3519dbe5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819853, "uuid": "acbfa967-fd7c-4082-aca0-1d0e37bc05d2", "value": "__.Rmlyr.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca636067-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648819353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819353, "uuid": "e9d39145-26fc-4f17-8c21-4d607e1963f8", "comment": "Malware payload (SnakeKeylogger)", "value": "5599fd345d369dcf110cd00ef108dd82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819353, "uuid": "0a82536a-f616-428e-88c4-ed21ba72e35c", "comment": "Malware payload (SnakeKeylogger)", "value": "d94fa8183f77388e82a210f504780ead836174c8bab0885d82b2758a8ff8dca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819353, "uuid": "1dcad2a4-fce3-4fe0-895f-5c56df46d098", "comment": "Malware payload (SnakeKeylogger)", "value": "4e6a3ef940fe59a6e6c30ed950e7b3b34fb59155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819353, "uuid": "a600280f-a9fa-4c86-9893-71ae8acc7755", "comment": "Malware payload (SnakeKeylogger)", "value": "284869ff84f78e3770f9c2f46f47ef86939c9405c6396a1d79a0a47fc2d73ffce1ddb07a884f0ad093d34712f6113b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819353, "uuid": "d20ec249-fca4-4c3e-ae3a-abe4b719ef33", "value": "T193B4012977E6CE12C6B80BF680E3110403B5A7866773DB8E3DC813D94F6A3A25D85787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819353, "uuid": "e8587d3d-e957-4e8e-a5ee-a4685d39782c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819353, "uuid": "3ee51d3c-e6f7-4d22-9eb7-ad617eb9cda1", "value": "6144:/yIwvNrOM584SX/n981ILfbyJ0YbsFfUkNEzEtwEPo8uTqPdPqOZ0Mg4Ytw:gjSv98CvybbwaSwWoT2pqOVdcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819353, "uuid": "1aaf3134-0368-4812-841c-e4cb3df94db3", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819353, "uuid": "ff929496-a6b1-47ea-93d4-757ee95bb135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819353, "uuid": "7e6b1905-e07c-4f79-9491-bb045b536b76", "value": "PO CTL20-041 SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52e4ae7-b1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1648845625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845625, "uuid": "c690f46a-9e1f-4d06-ad5a-dc28c1a1939c", "comment": "Malware payload (N-W0rm)", "value": "0d60197c142237bea519d66fd793cd51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845625, "uuid": "2a60ef55-cd4d-413d-a05f-06fdd5b4b234", "comment": "Malware payload (N-W0rm)", "value": "dab5482e0609dd2e03f365f3a2635110ea1a8b78235ab9e016036a865ab96c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845625, "uuid": "f11db7df-940d-4611-ae6c-07f493bb1fdd", "comment": "Malware payload (N-W0rm)", "value": "e59821e35f923d987f06501d898175e84dbbc14f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648845625, "uuid": "8cf759ef-6afb-43e7-b8ef-fcce96597cc7", "comment": "Malware payload (N-W0rm)", "value": "ebaeba50a827b35297a34bb63fea07a869adaefa21a42d48a7789b9e9124888926786e859319903574556f63196890c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845625, "uuid": "6d0cd899-c6e6-4949-b4f2-daa95609055e", "value": "T15774CF10BB90D034E1B716F45DB993A8B93EBAB15B2495CB62D526ED4734AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845625, "uuid": "55c75610-63c7-4390-83a2-68b3852c3e80", "value": "f22c415437cc9d7cf824990538373125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845625, "uuid": "267a514b-5a25-492c-98e1-9063ad671815", "value": "6144:B5yNgRvwPcWZMZMvxdQzzPBuvKcGX3EJRii0i8DV2KoCjrRln7jLKxpLdnWY:B5yNUY0WZMcdE9uicg3pi/9c3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648845625, "uuid": "37956998-60b7-4f99-9482-1f383aacf796", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648845625, "uuid": "1456bca5-2f15-4a1a-8dca-c5f9fb229d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648845625, "uuid": "5a8a73ae-5f42-4683-b288-d8fbfd26d1a7", "value": "0d60197c142237bea519d66fd793cd51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c92125-b1a6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648808801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808801, "uuid": "4751f9f4-1c62-42ef-a06b-d1368a1e9cbd", "comment": "Malware payload", "value": "1cd0a9566ffeaef7b00d608015578469", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808801, "uuid": "a18285c1-cd72-4fa5-b6f0-621f20336ebd", "comment": "Malware payload", "value": "db10e91b999c39e742fca4f7c6cb9bed658ab72033150d96253dee651af489b4", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808801, "uuid": "e9c03edf-603d-4808-90ce-4dbef2726e5e", "comment": "Malware payload", "value": "6c8d4b86c179f834c589fd411d14285cc452b33e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808801, "uuid": "2aade5be-791f-498d-b7eb-a713e7089bb5", "comment": "Malware payload", "value": "91bf883f45912f751311ab155d2d340886ab61416a319ccadd34db6f781d6b78c0bc54b86dd4a3396fe2bbdf2b1b27b4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808801, "uuid": "16530f74-f0d6-4ee0-aa03-af0b44879c01", "value": "T1701412C672E7A2E1FE1F76F00DE3D342211CFE016B324A692566373EE839D51A564293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808801, "uuid": "1f33798c-a977-4d3e-9246-2b2c0731e783", "value": "3072:H3xl4eZkfkqueRydQcUrXJQzaShTyeZnU/Efnovavg3HI/h6RU4iNSUtcxBNhEn:Xf4epaImcULJQ2ShTyEBfno2yHIKU4q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648808801, "uuid": "6b1fd144-ba74-4c34-967f-1716c4dd87a6", "value": 192008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648808801, "uuid": "8fa21e60-25e1-406c-8d9d-26ee99a328a0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808801, "uuid": "084d40b8-3344-47ab-adc8-96a364d343ba", "value": "aaaaaaa.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f9d15d-b1e7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648836920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648836920, "uuid": "0c480034-ff34-4251-936e-f124107afd0c", "comment": "Malware payload (Heodo)", "value": "087a60e322562e8602dc7d18210da01b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648836920, "uuid": "17abc56f-4a68-4753-93eb-68e224ab0c51", "comment": "Malware payload (Heodo)", "value": "db851cae4910a5eac926f5bc2d9a394e70ac036012c1c82a2b46af1daf59df3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648836920, "uuid": "c0ab1e07-c868-4cf1-897c-e246f8928659", "comment": "Malware payload (Heodo)", "value": "aa716671b30129829441d960c6301052f8e11766", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648836920, "uuid": "ac8b7b3d-2b65-4400-919a-4bcec63b5f7a", "comment": "Malware payload (Heodo)", "value": "1d4d913a26e0dc735985b4d2894a903d23ac5383ee4bc45dcf7a472497752ca2e94361661f5c8eec1fd993d0d41b9235", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648836920, "uuid": "874d0dd5-5fb7-464e-9806-ed2a357c7346", "value": "T189059E0675E18477E2BF01310E66777E67FEEA504F205AFB23909A8D4971AC24E3631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648836920, "uuid": "0bc7395f-af1f-4990-a437-3d10b8e41941", "value": "2d2fa1ca6236044d56cef7b752fe5a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648836920, "uuid": "d8ab89bc-c97a-4912-b27a-d5074707ee6b", "value": "12288:OBOHvWMwoyDdgp4W5dhdu1sRcwc8b3UHv8qDznxN6t:OX/RgaW5dhg8oHvbzn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648836920, "uuid": "3d946614-fd35-42a1-b1e9-cdd74b221a9a", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648836920, "uuid": "715b2cfa-d154-4e04-b5c2-4087357eba5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648836920, "uuid": "73138fe4-30de-4875-a839-7de7bb26cdd3", "value": "087a60e322562e8602dc7d18210da01b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe53ad66-b18e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648798825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798825, "uuid": "3515b5ee-fc04-4d96-a584-920a4c31cfaf", "comment": "Malware payload (AgentTesla)", "value": "3c072b02e696ebede8c81ea0a4293bce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798825, "uuid": "4d797534-9e05-41a1-b4b9-2ce0fb928bca", "comment": "Malware payload (AgentTesla)", "value": "db86911e49c9ba5247f6de301dfe42f2b16178cb038701662980fa14f2d38095", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798825, "uuid": "171acdfd-f83a-4934-b7e2-2d1df81aa603", "comment": "Malware payload (AgentTesla)", "value": "6b202dee57408afaa9b313905ca95b2a42f79f04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798825, "uuid": "9d37ce2d-3681-491d-a43b-ae237cd8aeae", "comment": "Malware payload (AgentTesla)", "value": "ef8e4f3a7c2c9687758d4764b0ed36f3fca5fd82fe1c52b44c5991609830cb91184d5af26f094610b1c452e37798ccac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798825, "uuid": "b5979eb4-f3f9-41dd-9594-d46fda40b39f", "value": "T13DD3E1001771D463F952AA310D3BAB27BEFEE9413920420B1B543A5A7CB2782873F35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798825, "uuid": "ef3819af-0557-43cd-b5da-5ec10d502436", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798825, "uuid": "a0557b5c-2bb0-4569-983d-d0ed11268e7e", "value": "3072:l3yddvw8pSutvbJ+NW1XUpvsjKdoj4O0MxRUbLxeMcpiV7gPTDbV:l3yztLGo+lyj4OLTuAMcpycPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648798825, "uuid": "ca460401-9884-4727-b609-13d968bab827", "value": 130816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648798825, "uuid": "d0bc0d16-bd17-42e8-95bd-95da1ea6cae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798825, "uuid": "46d2037f-4230-482f-9920-1ec7ee811bbf", "value": "invoice28dhldetails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad8030a-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648820079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820079, "uuid": "1f2417eb-496a-4eb2-ad43-3ebb0a3b2c08", "comment": "Malware payload (Formbook)", "value": "a7798d416007c05606f85b86386da9a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820079, "uuid": "d5cc9a0b-b975-4cd6-97a7-b8b6b9ea2b86", "comment": "Malware payload (Formbook)", "value": "dc36fc5d4c108d54e3a2a4a5309f87093f484e4bc928158c0a749417052f6f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820079, "uuid": "2ac80984-0c84-413b-a4b4-b4191888fd1d", "comment": "Malware payload (Formbook)", "value": "81c01be62b0e6353489c2016c9b4b61d2700dcf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820079, "uuid": "8dca86af-941b-423d-9417-691bb91e4b8f", "comment": "Malware payload (Formbook)", "value": "924de81fb6112865fc73ef680d3e3003d56023c5b0f6df90720e2ea85ffa65b08c4ce6c4f553323d9ead4e42cd4a13bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820079, "uuid": "13eedd99-7685-4fa5-b628-ac02b8568dc6", "value": "T1E1D4E025FBEBCC6AC03514B850A1521006B6DFCA6713E7CD688D793A9D313437E89A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820079, "uuid": "3b59e98d-bf23-4a6c-98e3-3d0251a275fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820079, "uuid": "b4e53306-f6c6-4f4a-8f9f-ccd2028d3339", "value": "12288:NBH+TS7QF7qj9z9K+MmVZ2WdkrGDoHHPmHbbu:Xpk4tkUVQwD2HPcbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820079, "uuid": "eabf88e2-c68d-4a3f-a02a-8160b9549e32", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820079, "uuid": "ad8229ac-416d-4dfa-84b6-8dd86e5513e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820079, "uuid": "e9a67a6b-dd39-4a0c-a084-c0d697d11828", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84572cc3-b198-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648802915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802915, "uuid": "1f423474-1798-42d0-bd07-7a5f9e00ea9b", "comment": "Malware payload (Heodo)", "value": "e8675488265a168c87189499f5b712f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802915, "uuid": "a4e2217d-dd40-439b-b809-179893c1b3c2", "comment": "Malware payload (Heodo)", "value": "dc6ef2c4ba567e60bd05ef9e0f1a7d326f8f7cd9936b1b74038bfa1f92720d32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802915, "uuid": "3c8e8a35-73c5-4664-9426-b4ed01210069", "comment": "Malware payload (Heodo)", "value": "a8893ee7e99c4018df922d1dd9244d47f2022e36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648802915, "uuid": "d6cff1e9-723d-43c6-8038-0ef5ee2fb257", "comment": "Malware payload (Heodo)", "value": "de82b1af9df01db208a51d47eba15fa013cad49075a73eb32dea86887617eb605e5b38d0ffc3a26608cb8281a5b4a72d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802915, "uuid": "06133c0f-86ca-4ed5-bfb9-c7502aa34c33", "value": "T10894BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802915, "uuid": "2fd03b0e-a22d-4fae-99f3-59ef93a63891", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802915, "uuid": "66b7d5e4-e94b-4a81-a118-e44f46e7e6fa", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDBS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK9rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648802915, "uuid": "2fa1b080-7b3d-441e-89aa-5889b037e4fd", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648802915, "uuid": "02e36672-ab36-46b7-aa99-6873704a97f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648802915, "uuid": "ca1e0c4e-aeb2-41b9-964b-fed0fc6b58c7", "value": "e8675488265a168c87189499f5b712f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12531eb4-b1ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648840090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840090, "uuid": "0b2db074-ca40-4aef-a7c0-1429b47b7029", "comment": "Malware payload (Heodo)", "value": "222b4949cdb9166535f8427636b9aa62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840090, "uuid": "5595d5fc-9074-4f7a-96c4-e78a859c3ada", "comment": "Malware payload (Heodo)", "value": "dcc3d6775e3aef065478d67dafd2608b1dbbb2dec5672f023b0dfaf9a3d304b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840090, "uuid": "888c6fc4-f757-47e6-9df2-cb001a319723", "comment": "Malware payload (Heodo)", "value": "5ed6b5e765fced468902dff8919ce22be7467223", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648840090, "uuid": "3b0b5202-868b-48b0-860c-c944429421d5", "comment": "Malware payload (Heodo)", "value": "feac635865b25a223cdd64a4399d52e33889ca9cdf1aa92a50a6ff64471fc0ad3e14d4792770c0bf4dcb1e21d8ce52a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840090, "uuid": "3d9358fe-d918-451a-91b8-195d09a2c76d", "value": "T1F394BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840090, "uuid": "2e2fc76d-fe44-4bb3-bd2b-629924820edd", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840090, "uuid": "ced8862a-1d87-47a2-a59c-8aa6bf6ae8a2", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKD4S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKYrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648840090, "uuid": "b4190e1a-d05d-4001-a382-a8135822a633", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648840090, "uuid": "0125e2d0-935a-4d8b-8dd8-2d838db9763d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648840090, "uuid": "0715d5f0-c5de-4fe0-8b0c-6882b4f494b8", "value": "222b4949cdb9166535f8427636b9aa62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3cbb2f-b1a3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648807435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807435, "uuid": "4e282916-f4df-4284-a469-e1f8ad027d8a", "comment": "Malware payload", "value": "3a7c52396375c8c29fb71aea81131216", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807435, "uuid": "e12709c8-6082-4b36-a0eb-f3fb6ad37d46", "comment": "Malware payload", "value": "df59f7c7efd9350d8582aed1ea36c3f6748ce1515392d88ac694e87652ec0173", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807435, "uuid": "26fe3f34-c0c8-4c13-857a-02f3bb8d8c1f", "comment": "Malware payload", "value": "3f70e4b12417594460d3d7e0035fbafa69868c85", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648807435, "uuid": "28e2b321-9d32-4e6c-b678-35a4ab7b9fe9", "comment": "Malware payload", "value": "96eb17a0a6823464ba2847a0351021f6e9b8fb74829ad21af54637c510ea23a472c47dbcf9f2da5c008a027214ab1e3e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807435, "uuid": "e538ba6f-42ca-4d93-ae24-0f8347c1778b", "value": "T1FB772387E3E8E95EC8F6933284766132555B4D20CF939BCB2A04773829B3AD45F49BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807435, "uuid": "19b3b3e6-f3d7-4c71-b679-a08a5dc4012d", "value": "786432:H3UChKpB/1NdNZBIlRoLXLuk5oWBHWA0qZW0BCTQuWiiT0VeyUG:XU4CBNHBIlGXLuG0qo0qLiTSUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648807435, "uuid": "002df188-da05-43f8-b043-4e889b0489a3", "value": 33360544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648807435, "uuid": "ad860403-5951-47f7-88dc-7d22faa38c79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648807435, "uuid": "4f82d280-aad7-4728-b726-0df4b314ef1c", "value": "Text Messages Lite_v3.17.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f46fad-b1ac-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648811404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811404, "uuid": "9b581765-43dd-4a48-bace-c77f4330e179", "comment": "Malware payload", "value": "b69e5279797f4ef20952d018838a456c", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811404, "uuid": "8a2ba6be-0858-43bf-8f5f-3ee69c2116b7", "comment": "Malware payload", "value": "dfe604c5788ed5e73ac8f6877e7947773a1d0f540c58e967c0c9e2bbc382095a", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811404, "uuid": "fe7653bf-9132-424c-999e-fcd73d28b35a", "comment": "Malware payload", "value": "b82a8e2af677e277a6a467f3b2914339a87b1111", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648811404, "uuid": "df40c5ba-8569-4de1-8e15-098f7fda65cf", "comment": "Malware payload", "value": "f116e19a7cfdc2042e78dfea7377797804ad8f8d49da840d129ccd08a9654d731043efae88b533765001ff3eab2a0604", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811404, "uuid": "81d68d3c-8729-42c9-a68d-edfaf4f8a270", "value": "T18684239DE97A010B64781A58767EA433C4A0478BB8FFA65FD9121DFCCD60A095181FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811404, "uuid": "c827e3f9-bcf8-4575-a611-586772e03e9e", "value": "12288:5z/nMOL2lKoGmOhSzah3gia3aVlXadLpHf7xb:hEQTG63RRVlXad9jxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648811404, "uuid": "8cf35df7-c074-48d2-ab87-0458c91f1976", "value": 405763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648811404, "uuid": "5036462c-fe31-4223-9d32-461e40e54672", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648811404, "uuid": "6513836a-6ef9-4a9e-9f7c-cd99ffff36b9", "value": "Scanned_IMG-SWIFT Ack MT_103 $46380.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8137ce68-b1a4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648808064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808064, "uuid": "c84a7238-418d-4ab7-a252-bc5bcd7fdff0", "comment": "Malware payload (Heodo)", "value": "0d37db06985348e894f1a52db3c926e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808064, "uuid": "9168a6a3-190b-4364-a4c7-e2e4f23f3333", "comment": "Malware payload (Heodo)", "value": "e01b56d266e103960d05829a04283c39fef67888f0792edd7197364965e9c96c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808064, "uuid": "59c05cd2-d0b4-4e4d-9f36-992f4bba7b67", "comment": "Malware payload (Heodo)", "value": "c7bcb4a8de1c084a3e7b99eaeff1c988375f3932", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648808064, "uuid": "3d581555-878e-4605-905f-f8fd9154f7ca", "comment": "Malware payload (Heodo)", "value": "1e0b49df36093c70333fba45cceb9f882ae61cea1a217a397ac5f1d972ecdc3bc986b1a74f8f0a1f95a762a95fe7e757", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808064, "uuid": "4318402d-78dc-4b87-9cc2-7663bcdf7121", "value": "T19394BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808064, "uuid": "1ce993d8-7250-4646-b668-3cd55156a90b", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808064, "uuid": "93c9e48f-1fa6-4f21-a6c7-a585fb3b49f5", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDdS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKBrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648808064, "uuid": "e0dce84e-3361-4915-b11d-66e30dfbbc1a", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648808064, "uuid": "7c3c4c73-2a15-470b-b61d-0903014e806a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648808064, "uuid": "712e116e-e056-4d2d-be5e-e57c93242904", "value": "0d37db06985348e894f1a52db3c926e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e516e69e-b189-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648796635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796635, "uuid": "9369c352-e86a-4181-a269-9904a4cd8f8e", "comment": "Malware payload", "value": "59ce5f49b0defb65d0a9a4e740f9a55b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796635, "uuid": "8ec60907-1397-4459-954c-c6f0f97978df", "comment": "Malware payload", "value": "e0502e7fb54ddac6941add42b08b5f925d5641fdccdcc7fa04296ef1e0b74a13", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796635, "uuid": "02ff8e3d-8f38-4713-9ee0-3751379a32e5", "comment": "Malware payload", "value": "d0aedee54226d53c5be895e781b8cc5f24455081", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648796635, "uuid": "4f45d039-d0c5-46f9-a2bd-f291a3aa909b", "comment": "Malware payload", "value": "c9bbef1cb84f089881cb02495186b75c3a9a9a65daf39dd244568958c0c1f851a754285dad3efca87f8074b9345b0195", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796635, "uuid": "ceb7097f-12c2-42f6-a919-dcf555940b4a", "value": "T1CFD24C036671C5BFE48744B5106EF728BF75E219A6FC86E3879088E6BD216CD843D683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796635, "uuid": "05c976f8-4af3-48df-9c4b-ea1654b00fcd", "value": "fc0224e99e736751432961db63a41b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796635, "uuid": "b4ad9193-4541-4f7d-81d1-63b9a97bdc11", "value": "192:j93Q0qWTlK7z6zm86lVo0s7Wen/wtnbBOhaKAbc9+f/rhj0QPi:FmQlK7z6zJ6lKRvn/OVFrhjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648796635, "uuid": "27c7363a-865f-4177-9650-f5ba11bf16e1", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648796635, "uuid": "c5f7c113-d82c-478b-ad24-54855770bb7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648796635, "uuid": "8558fb20-e40d-40d1-8049-daae3d6903db", "value": "guchild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad07a71-b177-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackGuard)", "timestamp": 1648788699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788699, "uuid": "af90fd3b-cf44-4b5c-bb0a-56e2a7a9ebd0", "comment": "Malware payload (BlackGuard)", "value": "3079b3a7ffd65f2574333e5fcd72f24e", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788699, "uuid": "6529e2ae-f637-49e2-b04c-9e5923b94513", "comment": "Malware payload (BlackGuard)", "value": "e08d69b8256bcea27032d1faf574f47d5412b6da6565dbe52c968ccecea1cd5d", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788699, "uuid": "3d329f7e-f0cb-44c1-8bf8-6f0a8595926b", "comment": "Malware payload (BlackGuard)", "value": "05f62eb4c99ea212ab93d5de150a9365bf4c3db5", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788699, "uuid": "22860b5e-afc5-4266-88ef-e3c46a51698c", "comment": "Malware payload (BlackGuard)", "value": "8de378bb18fce53f40055b1c88bf2d1eefc668ad6b2c2e21d6a11ab8bca2d281cbd8fe1f6bd9e5444411260288a0afe1", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788699, "uuid": "f156ddc1-b539-4326-b38a-d95c25081f0b", "value": "T10F3633BA97C1D74DD1C9247F5305270FAECFB9E9D922401310B4A6788BEDA8CA1CD927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788699, "uuid": "e20269a7-14ac-4346-bd39-7f321d9750e8", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788699, "uuid": "23aded86-8a28-4083-9e9e-e63088bfde12", "value": "98304:aESCWLq9HiyyV0eKNVV4QPKn6co0D9MpYXyXlaHyfn0m75k:pWeJGoDy626iXEloan0O5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648788699, "uuid": "995b31b0-be94-4916-a3b5-5d261adc6663", "value": 4927944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648788699, "uuid": "de5d3b5a-5b58-4352-a977-b7f64b567a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788699, "uuid": "05dfd901-82cc-4862-a94b-3c3780d184ec", "value": "e08d69b8256bcea27032d1faf574f47d5412b6da6565dbe52c968ccecea1cd5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf21f2f-b19f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648806067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806067, "uuid": "294e7359-7723-42f9-b6ee-605e0d0b98e0", "comment": "Malware payload (AgentTesla)", "value": "447fbc68d969dba7c85b31cd83e105d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806067, "uuid": "13dfeffb-73c7-43c3-87b0-6bc81b9a5279", "comment": "Malware payload (AgentTesla)", "value": "e17255fd5c725f323502d1bbd9190248b57e5bc0fc9b67806a6cff0c40b403d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806067, "uuid": "b98911d2-d2b8-4f64-ab55-626d53c1d5c4", "comment": "Malware payload (AgentTesla)", "value": "2a30c9b5e9bc45fa5f4c95d284b119fb9781a0b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648806067, "uuid": "53842ea8-73f8-49ee-859b-911ca5ac1692", "comment": "Malware payload (AgentTesla)", "value": "0783144dd41e85753e6d5489cd94f3577c54970acfcdc5c7fdd8f6a2a9f77f45b2f7aeb11f9dc68b69d234b1173996ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806067, "uuid": "494ce53f-21cd-4442-97ef-3f0283b86587", "value": "T1C3D4025EB6E5D923C46C6BF6C0C251101376A346AA77DB4E2DC813C94B5B3A32E8634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806067, "uuid": "c4bc861e-0cfe-4df0-86b2-753234f4f9b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806067, "uuid": "5a74f774-4f9e-4801-95f2-2eadc7b29a42", "value": "12288:qdsy70cc1+Fkh7Ya+xCUXY2zyTmjEKH07OsQ5o:qk1ok1YXCUZzyTmjEK5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648806067, "uuid": "809d0bde-9773-483d-b7cb-26e1fc260655", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648806067, "uuid": "7e791110-00ce-46dc-b3f7-98df18cdc88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648806067, "uuid": "5187c1d4-20e9-4a22-8655-ea522701a50a", "value": "eSBYziNWSbpKgUT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a46e0a-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648819688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819688, "uuid": "96a96393-2768-41ee-af80-2f6b6524a195", "comment": "Malware payload (AgentTesla)", "value": "934dd30dc0e8b129dd109c4501f0e381", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819688, "uuid": "d01e0c1a-f3fc-495e-aa0e-e25daf91bb42", "comment": "Malware payload (AgentTesla)", "value": "e1ab28b7f9d3cfa9f547858f1f5b3d42e264d67191523b752401c96009948b9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819688, "uuid": "2f48e58e-c993-49fd-9152-fff57ee592cd", "comment": "Malware payload (AgentTesla)", "value": "04579a24c782d103ede23b5aba90669cd6aea38b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819688, "uuid": "71d65028-5e52-44a6-b18a-fd3918ab5c27", "comment": "Malware payload (AgentTesla)", "value": "1481e05b6b6183a3889f940509a8181b4fada62c1c1165f0d0bac1e789d7aa6db1be4599036ac4aca627cd91056e7206", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819688, "uuid": "73e78c53-4405-410e-a1b0-42039c37bfd8", "value": "T1DC1412643ADAD926F013E9F94EA8B93B07B0FC45DD5D65F9B140F34288FE8225F08A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819688, "uuid": "096f6f6e-3335-4b95-9a71-90cc9479100e", "value": "3072:zcaO4vFwavQ+GjjJpyIO9P8KWG1ik4FWbLtaF/l3ldyg7iUX3nr4EbFeMptU/:waO4Oa5GjjJWPNJn4SLolNlgg7XZzt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819688, "uuid": "58d3c856-a8aa-4e22-b83e-86efcd069ccb", "value": 192072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819688, "uuid": "4dfd6e1f-85a7-40b4-9aed-0ebbdf56ea61", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819688, "uuid": "837c9db6-9b20-4b8b-81bb-e7576a87031a", "value": "Re_ PO PO2203.0685 - AU206751.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cd28aa-b1da-11ec-8e58-42010a9c0032", "comment": "Malware payload (Worm.Shodi)", "timestamp": 1648831296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831296, "uuid": "ad07b289-f31a-493f-ab85-d5b08384286c", "comment": "Malware payload (Worm.Shodi)", "value": "9a1676805825c070184e90036c0d2961", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831296, "uuid": "77feadce-de74-484b-b9b6-b921853108f0", "comment": "Malware payload (Worm.Shodi)", "value": "e28c8495af9e23c232fb480067121b92a0158032601812fc07fb4e9639e6a24f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831296, "uuid": "224a388c-cafe-4888-8aaf-feb1ade629c0", "comment": "Malware payload (Worm.Shodi)", "value": "a4287c87f258eaa469c6b0c2c391f0bddfe831a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831296, "uuid": "1b547eea-89f5-4aa0-b1ba-26024bb86af3", "comment": "Malware payload (Worm.Shodi)", "value": "e20f131cf7ab8e621d4625829836f9672b1200c9ae257907d1f826ee360f9583cc6487c994285fec659e892e759cf3fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831296, "uuid": "9683b062-82a5-4b46-b762-33341fa4f15c", "value": "T1D5348E17BB9480F9C07A813189A69A56FB73B07A1B2157CF1764839E1F233E09F39B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831296, "uuid": "fc7d70b6-f88b-41c6-a305-c9dec43bbac4", "value": "77f13bc24efea5a05601b43cf44d1f1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831296, "uuid": "31325d15-2efa-43bc-9385-f480c82aa9d8", "value": "3072:NR2FoCUI2aAIamToqId5mtT4XOyVop6PsoB7LTKTeFq3PFU0teELdGJN:NSZ22aSamR4XOyV5R7LUPS0t30JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648831296, "uuid": "6fb4c49e-3728-477a-be71-a03e85daef06", "value": 232329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648831296, "uuid": "0117e2f3-0449-450f-9bd7-e2c4896b8903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831296, "uuid": "3960b1c4-4e56-40e0-9324-8631c29e06f6", "value": "choose.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c255834-b1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648837717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837717, "uuid": "fb60e9a7-d76d-427e-9336-2c6b70288c01", "comment": "Malware payload (Heodo)", "value": "ff76cc9776b1b21e6eeaf435e6433fe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837717, "uuid": "71b10068-90a9-4f6e-80dc-02804fbf7cf6", "comment": "Malware payload (Heodo)", "value": "e2c18ea0126e2a21dae279371c7262c01746349ffdb182381baac6c71acca6a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837717, "uuid": "d1eb4354-008d-4f75-999c-2199c852911e", "comment": "Malware payload (Heodo)", "value": "1671dc66ec16a588fc441e1e10bb10e4d539ac24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648837717, "uuid": "eacf2103-665e-4e38-bc31-984b65d1b7e7", "comment": "Malware payload (Heodo)", "value": "a2af23ee4c4d9a59eefe4e2e4f40eedb37ba43f665c8c7b36d8174ec7169882b17bee9a85dca53870b39503ded164ccd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837717, "uuid": "1ffea2d3-8d23-461f-8f96-96478f6a871d", "value": "T10594BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837717, "uuid": "171bc16a-8dcb-4017-9095-b0bb8a4a3893", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837717, "uuid": "7d46a4c9-18ed-4ee0-a9e2-ffc773bf596c", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDPS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKvrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648837717, "uuid": "cc7f2acf-bc6e-44cc-ad64-6125558d5615", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648837717, "uuid": "0ed49bc9-d37d-4742-9a26-712a5eac38f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648837717, "uuid": "bdcf18d0-109f-4135-a83b-16a88d9e751a", "value": "ff76cc9776b1b21e6eeaf435e6433fe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bebd8fb-b18e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648798579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798579, "uuid": "bb17a016-4d0b-4a3d-a6ab-b77ef451ae8c", "comment": "Malware payload (Formbook)", "value": "d4a18931d6753a1d3c339cc7ede5441f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798579, "uuid": "fb810d67-754d-4a99-8bda-83fdeaa50d08", "comment": "Malware payload (Formbook)", "value": "e317c68d3bdb0734b23c52d5e5e0e1fca0423cae2a9c3418a69a9f982f2da541", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798579, "uuid": "4837fe77-1949-4d7c-bd8b-adad31d2e714", "comment": "Malware payload (Formbook)", "value": "c23eb58f2668b6c3bb46a2dc6ff4766cf3b82802", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648798579, "uuid": "03371d6c-0e7f-40ad-91f2-81db2e2d7e06", "comment": "Malware payload (Formbook)", "value": "1aabbbe336a6fe13b3b5e6fbbe0ff99fff1882003c5c09b7026fa63678ff256fe17f3caba0169adc91976f8b455eaf02", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798579, "uuid": "7cc08560-1518-4365-bcac-d098ac631e5a", "value": "T14584239FD697F54F8B9F9702A0066C6AA0A3F1057831B4AE3D800F95371B25817A5CFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798579, "uuid": "2d6456f3-9457-4379-9386-43fd17c71f5a", "value": "12288:fKY9WC4ROGmhFBtkTxCe2IjUlTx5S3eutc:dcRMBqTx29sOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648798579, "uuid": "6f748e33-9800-406d-8f42-e965eb47ccdf", "value": 396108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648798579, "uuid": "f4609c6e-ffe7-4cea-8af3-20634800ff5f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648798579, "uuid": "55458894-59b5-43e6-813c-f0ad6ecf2395", "value": "DPI FTT # 13666 dt 30 Mar 22 (Eur 70590).7Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fae668f-b1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648827389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648827389, "uuid": "6c2ac4bd-b006-44ff-93be-1f00b51f526a", "comment": "Malware payload (AgentTesla)", "value": "7e009a7438ef29795b614e24b7a300e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648827389, "uuid": "fc43e61d-3387-44e8-b5f6-7931f4260b1b", "comment": "Malware payload (AgentTesla)", "value": "e3985383408021ef29dc04ac0a25fe3133a50ca766da403795ae734d850b3b98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648827389, "uuid": "6a1d1da6-babf-422f-b7af-625ab89173bd", "comment": "Malware payload (AgentTesla)", "value": "ae2d0af5dce1e6384120a99c15d23b5365a1bff7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648827389, "uuid": "0e6b107d-649c-45f8-850c-ca54b920ad84", "comment": "Malware payload (AgentTesla)", "value": "80239f1267cdacefa08589581823257fe8d87d6f6e7933d5dbe17a9a2323db98ab913936a2013a7839b195e0f0cff2a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648827389, "uuid": "6786ee5c-abfa-44d2-8ae8-71e7016ed3c9", "value": "T108A4D0ABD3FAAF1BD4DE13795420841A3EF0E483B620D648FE8B15BAC96B7D54054783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648827389, "uuid": "578d3eaf-ef13-48b0-97c1-87fe9366ffad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648827389, "uuid": "a273fad2-f67b-4ae8-b11c-d5273b7e5d3c", "value": "12288:OwcvSyl0Z2A68w5wsUlX5qr7ret5tTZ8z+PVnW:1ylY68wd0X5I7reh6ydnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648827389, "uuid": "707df364-24fd-4916-86b2-b793ffc7d325", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648827389, "uuid": "dd863087-6919-4054-97f3-49fbbe06682a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648827389, "uuid": "cb469724-2b8c-40fb-8dcf-ae727f2a44fc", "value": "SecuriteInfo.com.Scr.Malcodegdn30.22687.28407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4742900-b163-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648780340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780340, "uuid": "f44a744e-11e3-46dd-ba90-5e8fb71b4395", "comment": "Malware payload", "value": "1449f326dac3e20b96b00b46b41be8d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780340, "uuid": "bdbf0769-adb0-4afe-b540-a4f702a3dd96", "comment": "Malware payload", "value": "e3e014edb038a6267fa084d97ede596e209731e5e91d75767a0ebf8ee78fe8e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780340, "uuid": "0728376c-1e37-4443-8052-0ac5b51cabea", "comment": "Malware payload", "value": "001e0080eb42e4bb91732c5a340dc87e2f4be157", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780340, "uuid": "a5b781dc-78ae-4446-ada4-29cb7f7f82e3", "comment": "Malware payload", "value": "6504e3d54185f3fe33ae78e4d04b9456004309a101398bdb22f7c2d941e6c7da3c267dd80c47925c47c8b7e115c1a7d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648780340, "uuid": "30c5e6e6-178f-4d3c-b701-5d16ea819422", "value": "T192E3120779235D10C910933258E867FB1BB9563BD49A287D00E7E2D8A58BCF2F16F19B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648780340, "uuid": "3132ee42-9290-4294-84ca-b7cb25684a10", "value": "3072:KcCfLJn10ferCw/LIz3BqprEAMEKSrebvpC+Gsmj9Sf6zDfB+g:KNNSferCw/Mz3BSMEfibvU+UBSizDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648780340, "uuid": "8862bd90-6e59-4b66-9213-fcb64c3c781b", "value": 145739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648780340, "uuid": "8b9aa249-8c01-4a10-9d08-1681e57b8141", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648780340, "uuid": "444efdf2-a6c2-48aa-a44b-67a2b67344ab", "value": "Breast Cancer.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f858cacd-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819860, "uuid": "1a50b00e-cd7e-4506-8e36-daa26ad77c4e", "comment": "Malware payload", "value": "1f7f023b29024eaef14f36fb760dadf0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819860, "uuid": "ff2a2b8a-8959-4aee-ad9d-4dfb868b1b12", "comment": "Malware payload", "value": "e50207bdf0a7ff69d7f9be55e4920e6c958439706cefb257f93c01af6866d8a5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819860, "uuid": "b550eedd-2846-4917-ae00-b3e7bce726e0", "comment": "Malware payload", "value": "466932e93de356f2d5e5eae1f52651eff3c26ee4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819860, "uuid": "4a2919ec-8ddc-40fa-9033-d314ee02a04e", "comment": "Malware payload", "value": "8d4f167f901b6f4466c062663ab7e1f87279d51f073dc1096631da9ea471ef16abc33b8219f1431d0050a01eae63c847", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819860, "uuid": "8b44a9fc-ab97-43ee-bf79-3eea21a9ae06", "value": "T1DE566C13B384753ED46F1A3A4A77A654A93F7BB13912CC5B67F0088C8F358816A3B647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819860, "uuid": "90fd3771-a7ac-4e69-bba5-f22b1673b6e8", "value": "98304:BGYrA8GS3gdtuydiQEurXgpJRHvzqRFeUNdbf8:BrngdBrbRFemFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819860, "uuid": "8aede9d5-023f-4a52-82a4-9a979effde65", "value": 6278656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819860, "uuid": "afbf62dd-7d3e-459e-aa24-93851bffa550", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819860, "uuid": "1faaea18-e864-4367-bf36-e44a9c9d52a3", "value": "^^$-euqs.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b170874-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648799866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799866, "uuid": "f81fef99-f979-4336-9423-3ce405ffaa63", "comment": "Malware payload (Heodo)", "value": "5d9072ac79b1bb3bf7eb14ba453b2dd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799866, "uuid": "d57a4f5b-48c3-4ad5-bc92-5140d9da640e", "comment": "Malware payload (Heodo)", "value": "e5e0ce2a9ed7499c96c25b3cecb5300e285b4109502787af2b47ab4b47370a2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799866, "uuid": "5e31488f-7594-4338-a033-06c17b4501d7", "comment": "Malware payload (Heodo)", "value": "3b36acf010db1c6d51a3bb216eca60915fbc1155", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799866, "uuid": "c612db4d-9a0c-4b8d-8ced-af65a7b776a1", "comment": "Malware payload (Heodo)", "value": "3361d4936e65121388f2beed727c63e9645f2a84ef99309fac760c92939fc774e4121d09f640bd1f6cce7a5f5583ed73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799866, "uuid": "d9ff4d80-387a-45c1-b782-847176986563", "value": "T19AE4CF0331E0C276D3EF62304E62BB7A77F9BE904F6599C7A7405E6D0D729C28639225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799866, "uuid": "3e872682-c52a-48e0-8879-61ea2dafa2ae", "value": "de41e9174ae62fc0386daea226fb733e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799866, "uuid": "d49c83a8-d656-4a6b-a1fa-e10f4d427b46", "value": "12288:y6ILjk5qGZp+8YEODBeckLxBqx9o5zIw:y6h30EOAio5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648799866, "uuid": "57a69ea4-bf6c-4979-93f2-4c05721cc6d4", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648799866, "uuid": "74df02d2-5b2f-40ec-ae80-31fc9d44c44f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799866, "uuid": "6f3049ff-4d01-4978-b35c-7b67c7f4f32d", "value": "5d9072ac79b1bb3bf7eb14ba453b2dd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c65f65a-b184-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648794151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794151, "uuid": "51a02a2c-ab73-478a-9c17-5efee77a18c6", "comment": "Malware payload (Heodo)", "value": "6dc04ddd37d44245d833e447f37999c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794151, "uuid": "5dda30b5-5191-4d4d-a02f-78ca00f56f34", "comment": "Malware payload (Heodo)", "value": "e85446f4aa5bf66858e3450987853c7ac4a3504730f32a247c169453dba32dc0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794151, "uuid": "28348c67-fe97-44ef-8965-f96d7691b7e1", "comment": "Malware payload (Heodo)", "value": "7152963a54cb3db7dcf522892a62a12b9df74b8b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794151, "uuid": "ded5b232-5e5f-4786-9004-e3745fad1a1b", "comment": "Malware payload (Heodo)", "value": "ac5dfa5b31b8d7aff3e593737d51e8162b30e1c33bb94c5691327832d2add6da1aa07aed2aee48a1370e43133a52478a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794151, "uuid": "b91d26a4-a800-4956-915c-9080b94c5dc9", "value": "T173C4BE29B1F1E4B1D6FA00F929F592DBD2AFBE425B29419BE7FC210F09345804B35A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794151, "uuid": "84ccb413-ad7a-4c9a-899c-b8745e2a10ba", "value": "f4d2f65566a93075f8824e97bf321580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794151, "uuid": "3ceb3ecf-fadd-46c2-a206-65c0f4a09af1", "value": "12288:B2AavzUBPSczbeeTLjvGyMwWd3DYr6i64/:OUBPSczbeeTnv6ZDWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648794151, "uuid": "e1b5ed0c-61e0-4a13-ba67-b4c997964a5a", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648794151, "uuid": "235cced1-6e03-419a-be08-e16193123895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794151, "uuid": "35b4c8a9-10d4-4a24-b3cc-6b19f8da109a", "value": "ticket.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ae9e93-b217-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648857327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648857327, "uuid": "ae0afd43-4369-40a5-ab1a-f7140584ddff", "comment": "Malware payload (Mirai)", "value": "b7f59989e82e09949f2f5de994086181", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648857327, "uuid": "9a2f6a41-d9bd-4f4e-87dd-28b0f9201b2e", "comment": "Malware payload (Mirai)", "value": "e9ceaabd606ed6ec475be19b452521910101775321806fc37e049c042823ed0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648857327, "uuid": "670d5994-0e9a-445a-b9b8-2f11d52d7d62", "comment": "Malware payload (Mirai)", "value": "be3e14ec0d93b9e13cda78d2b99fbc8e47bed227", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648857327, "uuid": "45a048a6-8fa1-4e2b-8cb3-6bf9b8c6b37b", "comment": "Malware payload (Mirai)", "value": "844f7948f4fcab203914cc2975d72994c8ec4e136c587d671cc0ed9a8eec5884b9419b2d486afbe62eb305bd290a5a61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648857327, "uuid": "3087ac08-fd26-4d90-88b7-7f714ac2dd24", "value": "T106A34A0123294957E4D74EF015FF1BF183BAED805AB2B608A91EFF940673BE25489F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648857327, "uuid": "ef4d225b-c744-426d-a87d-5b981369c96c", "value": "1536:Q37iZquXA3BX97WgT+VMY/zRUgLPQepLltb7nSXLaR8cSF3k8x57yVI:Qri4RRXFvhY/zigLIepLltbzGV4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648857327, "uuid": "3dd3f480-90e6-47e1-b889-8e3f09b01534", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648857327, "uuid": "5ee00348-a6de-4d03-892e-c714812553fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648857327, "uuid": "52de16e8-8e16-415e-97e7-bb3711ba350c", "value": "b7f59989e82e09949f2f5de994086181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc77de6f-b184-11ec-8e58-42010a9c0032", "comment": "Malware payload (MercurialGrabber)", "timestamp": 1648794473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794473, "uuid": "d67aeff7-4a91-42ad-bd76-f7f1844a1656", "comment": "Malware payload (MercurialGrabber)", "value": "9113775e2331c9ee4df2513fb0e0cd31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false }, { "name": "MercurialGrabber", "colour": "#A11B56", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794473, "uuid": "07015f05-82ab-4cf8-bc73-6959dbaa810f", "comment": "Malware payload (MercurialGrabber)", "value": "ea9bd34dcb71a2bb40e4f5693bce58fba42bab6ca231f5e7f2d5e1376640a52a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false }, { "name": "MercurialGrabber", "colour": "#A11B56", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794473, "uuid": "46592bef-98f2-480b-b37f-3cab7c6eef83", "comment": "Malware payload (MercurialGrabber)", "value": "bc35bb653f0232c799251ccf3d28c942e7ea2c2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false }, { "name": "MercurialGrabber", "colour": "#A11B56", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648794473, "uuid": "b851b6b8-6615-4d5f-be3c-e395f443a818", "comment": "Malware payload (MercurialGrabber)", "value": "9b0dd57d963a052dab138d98bd20fa6e73f1609525888b50e60f0d603988fe4c1f624e1e278fb75d5f7a5bfeb97f4f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false }, { "name": "MercurialGrabber", "colour": "#A11B56", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794473, "uuid": "c20fb20e-bc7e-48ec-bffc-4b00d14a90a9", "value": "T1291317087BEC1609F3FE5B7A6CB1456446B6B9A7AC31E74E1D94589C0873B808D60FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794473, "uuid": "703ea4d1-86c6-4518-bbb5-1e10b5df0560", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794473, "uuid": "9a4e7489-15cd-49e7-be00-aff92094a3ef", "value": "768:+IFHiOimlL9ra82jNuZQLxFTjUKZKfgm3EhwX:+sJdlL9rclLxFTYF7EOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648794473, "uuid": "1ee9bdb1-a497-47fa-9120-010caa9f09d9", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648794473, "uuid": "d7d82e18-d809-4201-a056-1e27ef1ff2c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648794473, "uuid": "c77594a8-31bc-4611-bd37-b4c5435a1c16", "value": "Exploit v1.3 rethi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c0d0dc-b177-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackGuard)", "timestamp": 1648788724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788724, "uuid": "242f5d99-06b5-486c-be3e-cbb60457f0f5", "comment": "Malware payload (BlackGuard)", "value": "05d3edc56331ce405e49ad2fc4e6c01e", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788724, "uuid": "051e6d92-df08-45e9-aac3-8982664298a8", "comment": "Malware payload (BlackGuard)", "value": "ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788724, "uuid": "cfde52dc-cfbf-48ef-b7d3-29bef4ac0493", "comment": "Malware payload (BlackGuard)", "value": "0b0491f9b654bb0bc41929456ba2943141be6711", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648788724, "uuid": "f6aea2a2-afdb-4c4c-a5ff-05317e7661bd", "comment": "Malware payload (BlackGuard)", "value": "4643d594b1e73f527cb9daefb94c1da91c6674fa6f96359c45d3f79cee402c3e6e9e914a93709e7844ae1536a70757e3", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788724, "uuid": "cf15a1a4-8bca-42b9-bddb-2133ea619a67", "value": "T11F752317563E6752C81868FD54175ACBB3B0AC65A392A923304EBA3B4D71393DC0F1AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788724, "uuid": "b149ae17-e01c-4250-8b72-c9b01bf1ca62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788724, "uuid": "e2b03174-ccd9-458b-b710-5912aff3bd7e", "value": "49152:w/g1HFiTbis/86UejYACiyeQntq5+eCr07s:wIImoD09eY07s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648788724, "uuid": "d4206e8b-c1bc-4985-a159-7e7867b5102d", "value": 1574912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648788724, "uuid": "5c9c1aef-461b-4553-8b6f-ed0490443ac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648788724, "uuid": "962c2730-8827-4e8e-92ea-bbcb1bcc7145", "value": "ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097ddf85-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648818600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818600, "uuid": "8cdfb77b-2702-4eaa-a336-8edebfbb03f1", "comment": "Malware payload (Quakbot)", "value": "dec597d191ac75ca1259e0fece21e58c", "object_relation": "md5", "Tag": [ { "name": "biden57", "colour": "#AD8FDE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818600, "uuid": "18aa4a7d-40d0-45bf-aae3-1fc0c894e1c3", "comment": "Malware payload (Quakbot)", "value": "eb14763a3242cfc46ea26a42f68dec0f08488b12adb9590aebd142844de903a4", "object_relation": "sha256", "Tag": [ { "name": "biden57", "colour": "#AD8FDE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818600, "uuid": "e8922b12-c939-4e85-8adf-81e970e0b728", "comment": "Malware payload (Quakbot)", "value": "2d6bc4f974c1fc026fdb61027ae714ca074fc367", "object_relation": "sha1", "Tag": [ { "name": "biden57", "colour": "#AD8FDE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818600, "uuid": "9ec2a749-6269-4e19-8154-5d725d636e9e", "comment": "Malware payload (Quakbot)", "value": "cde67623f5610f2e629228800ad640c232d00f1f02ea0de882c7499cf4838c848b04ae373c84506017e7396d01ca6642", "object_relation": "sha3-384", "Tag": [ { "name": "biden57", "colour": "#AD8FDE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818600, "uuid": "b4cd1a05-64f4-483a-8c72-17ed66ca8f3b", "value": "T14AE4BFB436046CD6D5AF427BDED9ACD913BB2A32CAC6D8CD90657BC30963372EE11805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818600, "uuid": "959dacfa-31bb-40f1-b41f-8f362a4f0444", "value": "5cc1965f3858b0491d03c9ffe098fae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818600, "uuid": "fc92e71b-5bfa-4d60-9228-e28af0b806dc", "value": "12288:4uJdUZjRNcK7jAu1girY66/uy/ZxrhQlBxXIk/SbbkSk+Hlir+gtTfZOgu:hJd0nFjA4Y62NQHdIkU7rkr+gtAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818600, "uuid": "0b972dd2-74c0-4cb6-8265-41a65aaffc5e", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818600, "uuid": "a3b8d711-122e-45af-b826-c61e45e120e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818600, "uuid": "f08a6ee8-8d8e-495a-9325-ac79ce2ff848", "value": "eb14763a3242cfc46ea26a42f68dec0f08488b12adb9590aebd142844de903a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18113f28-b172-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648786412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786412, "uuid": "7ed8c7d3-792c-4e38-b454-065b6ae74f0a", "comment": "Malware payload (Heodo)", "value": "16a94ca5bbc1c09ae7dd8af613f252be", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786412, "uuid": "b7c07a30-cfd2-405b-bae4-78caf783d9d3", "comment": "Malware payload (Heodo)", "value": "ec60ffdf238a88846426d03ef4e86559a287f46a332539f3b2431bfb334a9501", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786412, "uuid": "3990724b-4d89-4e51-949c-3cbe9f10fc43", "comment": "Malware payload (Heodo)", "value": "54d2d9308b2b30618eab5266e24982dbb7db9af2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648786412, "uuid": "06cdc392-71fb-42da-81e1-a7614329e836", "comment": "Malware payload (Heodo)", "value": "1e90c1a503699f50c5a215a1eff683ff6f70e5efaef4faeea0ae687e9ba65181980bd10cfba41e779feae285f83edd0d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648786412, "uuid": "6a273618-a28d-490b-a0a6-1a0d04e22b46", "value": "T15FE2AF5DB3A5F0A4F6226C38499CC8F34A1DEE814046B926747CA75FEA942BB11CF478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648786412, "uuid": "2a09097d-3896-49a6-ac78-417bfb1ae8ef", "value": "384:xuRfHYzzaivCm84njX3Ou7HWNI6ZuVEEWS4UyRMCYMVM7btUMLW7joHqgmPhXlU8:7tXnjnOkkY43SaMdbLWAYvUxK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648786412, "uuid": "aa09c472-e2f5-4ccb-ade4-6d4d6c135273", "value": 33441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648786412, "uuid": "7692e1b4-5618-4f8a-ab2d-4697fbd7f8ef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648786412, "uuid": "938b9342-35ae-4065-8124-b1827202acd6", "value": "allegati-3103.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501a1439-b1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648826450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826450, "uuid": "d3e9d737-f9e8-4683-ad12-49a31f685f79", "comment": "Malware payload", "value": "81de49ca238aa13eec9d1dd49934dc1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826450, "uuid": "2d57ad55-7117-4a3f-af3e-91687cef98b8", "comment": "Malware payload", "value": "ed26cf7c1e212b911017851bdd62dbddd9ebeaabc1a7c39a85780cfe2159a66b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826450, "uuid": "d1a75f7c-8401-42a3-9acc-b27772eacfd1", "comment": "Malware payload", "value": "45ccc44d959434a3fc2e5c01ef0aee4d00a4be75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648826450, "uuid": "a395d728-2aa7-44c5-be76-d722f916a8cd", "comment": "Malware payload", "value": "fb9e8ce46c60e524d4be918d5d9cd0befec06bbae33f056f533001040c760b2d27e7ccea020f7d6ff56314494dddd0c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826450, "uuid": "5b08e05a-2af7-42a8-bbf3-39acaf313644", "value": "T11A15AF63B293C637D2262A709C7B46B5DC25BE032F3498797EF4AD0C9EF86A03515193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826450, "uuid": "d7c988b0-598d-40fb-997c-0b9abb6bac05", "value": "6781b7d6dd8c416ff00a8475f55a2b9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826450, "uuid": "19091d3d-66fe-4a39-a3e3-58cfe72c9749", "value": "24576:eMJPiT/CLjfGwa7MA76/Ox57UugI+5Zt:eM8srM7PgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648826450, "uuid": "a440fbad-4ab2-49ca-aa9a-2ed6efe4f5f1", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648826450, "uuid": "0c9c2083-c671-4be1-a3f8-f5a3e7c8dd13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648826450, "uuid": "346581c0-6e36-4e13-9b16-0a42e4a7ddcc", "value": "81de49ca238aa13eec9d1dd49934dc1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5bb414-b199-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648803494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803494, "uuid": "79ff178a-4001-4017-b298-52493cbfbd04", "comment": "Malware payload (Heodo)", "value": "6a94cc24d84aa36d38010bf906b1b685", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803494, "uuid": "12e555a7-a6ec-44ad-85b2-0cdde8ec1f32", "comment": "Malware payload (Heodo)", "value": "ed30bcb4c4584a9d7577e93365ff8a70d66494dde8a10f97aa9031a849839abf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803494, "uuid": "6e4ef56b-a4ef-4ccb-9582-389b7ed8e983", "comment": "Malware payload (Heodo)", "value": "4de0fa3128afb6f7d0f64bcceb5eb221e23b771a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648803494, "uuid": "25a54aa1-e6f0-4b70-9b71-8571add305ad", "comment": "Malware payload (Heodo)", "value": "641f50ec2ca5ea992b80166144c8b6920542cb6bf0dd88e05fda697c64f99332c86de09e96efe44b4a2efce2fcfb0c9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803494, "uuid": "a9268cf5-c403-41c1-8323-1b5389e51176", "value": "T1CE94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803494, "uuid": "98067ad2-54f4-4b49-b1f0-9aaad25335a4", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803494, "uuid": "40e03819-5235-48c9-a3a6-e822e37b6004", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDQS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK4rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648803494, "uuid": "4d482ddc-0664-4784-9223-b34ef495bf72", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648803494, "uuid": "a53c2145-9d98-4c88-af39-3775ea4e64e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648803494, "uuid": "06113988-5b50-4b70-a4e5-097ac2477c64", "value": "6a94cc24d84aa36d38010bf906b1b685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bc1b82-b196-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648801951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801951, "uuid": "8ee89ba0-b0f8-48dd-97de-f2a37c2b6485", "comment": "Malware payload (AgentTesla)", "value": "a19f17fd7d3a29de1c4a56a8891f96cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801951, "uuid": "037094c5-be80-4e36-a0c7-eb48f582baf1", "comment": "Malware payload (AgentTesla)", "value": "edca643740843dd1f9a1fef7e5e7c9aca37df7b1897c4465affe18d42007008e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801951, "uuid": "6940d58c-b9a8-42bb-bf94-c80ad89303ff", "comment": "Malware payload (AgentTesla)", "value": "57ba2e3e08a1234e27a4e100421c307920ecd6ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648801951, "uuid": "c6cb4b5d-3977-45ff-ad04-84abe0d2e242", "comment": "Malware payload (AgentTesla)", "value": "4f176990ba6d2ccefe45291c750333cdb55b276d53fc6caed48995ba6a87acf4524f500d0c175afc829e09f953a8f1b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801951, "uuid": "fbd6752b-7477-4868-92af-ccd4a067db2d", "value": "T152C4F12DB6B6FA13C56826F240D611200371A347B633D74E7EC503CA8F523A75D9A7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801951, "uuid": "cd67cf98-e9b0-40b1-b86c-2f224fb75990", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801951, "uuid": "eab3a586-4c24-4b27-b427-03245a0c99cb", "value": "12288:Atixvie4YFtTc/0ZjwrQ49s1ea0RlFUEq2FUEiu3rrLAtPov5:VLv80ZDIs1eaIeE5F5iiH8wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648801951, "uuid": "086b4c64-4fd2-452d-af70-2dfbf7014e03", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648801951, "uuid": "534a2bcd-3dd1-437f-98d8-8dd263d4c173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648801951, "uuid": "e851232a-e52b-45ae-bbbb-f48ccb9e5c47", "value": "Halkbank_Ekstre_20211018_082357_541079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34e3ff9-b1a9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648810349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810349, "uuid": "b9531b76-5811-46f5-b9c2-1c46fb9f5ce2", "comment": "Malware payload", "value": "7cd6d0c22febe9fb2a944132ab7bf42b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810349, "uuid": "47e8bd1d-1882-41a2-9100-5c5f4b6f468f", "comment": "Malware payload", "value": "f09ff7c8a7dadbcbab3c732827c9124d226674381553c6bc8fe28ccab12f51db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810349, "uuid": "378710b7-8b56-4073-892b-1ad21e71e183", "comment": "Malware payload", "value": "ff987ec805528a9095721d184bb24c1c48d1cac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648810349, "uuid": "c25ed7d0-5c8c-41b8-b37a-fac32ac77374", "comment": "Malware payload", "value": "2bfe4d7e84aa4dcba7b58e759877363cb378d324b6d009accd59843a2ade0dfdd60fc30cdce225c18df9ae7dc5792194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810349, "uuid": "8123cefc-8e27-456f-b561-ea3eda72c0c1", "value": "T1A2F36B1CF3C58F66EA6F4B34C0264A241775BC2195A7E38B195839E9B8B33D1F412B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810349, "uuid": "27c2e281-6994-4ae2-8de1-f51cb37e0e28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810349, "uuid": "c22259ef-0029-4a35-9f55-5841d1e73735", "value": "1536:/C3qeKkScQobCKHfs0faxmQMUeNIEySyJoeYihiFb/kT02EWrh0OA8FD6DuqkSZg:1knb5/PibVNnJ2ihu/b2EW12k6DAUcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648810349, "uuid": "d9322c5a-67e8-4df6-b660-5667d31fb1ed", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648810349, "uuid": "17f6db78-b043-4304-9338-af3d21520f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648810349, "uuid": "0e112dac-ab03-4811-a456-4520910debce", "value": "salary receipt..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58de45dd-b20f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648853952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853952, "uuid": "6a544bb9-98ff-45be-ac64-0d88a93160c0", "comment": "Malware payload (Mirai)", "value": "8ad1dddc24b433e57d3775bdeb9293d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853952, "uuid": "5786bd60-8d23-49e5-9a01-854f7742e618", "comment": "Malware payload (Mirai)", "value": "f0dbdc9d8f8c70807b23231af975a2cc4a91160e6939b52aaf2c80c8a3502f4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853952, "uuid": "49ca73ba-02fd-4362-a7e0-f87bda1c2dec", "comment": "Malware payload (Mirai)", "value": "9703d12f59f89f92bb772dd1129086c9d05baafa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648853952, "uuid": "afa9075e-9726-4df0-b3f9-0810234edf43", "comment": "Malware payload (Mirai)", "value": "85623009c74caa4d63d85d365fea69ab0b019d32c393383d73e873b94cb9d62b61fabd85c24c79f50951333cdbb79ac6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853952, "uuid": "81374fdc-0531-4a34-858f-c329bd130346", "value": "T145031986FC82996ACAD41776FA2E408E3321B3E8C1CF3307ED145F15778552E4D67A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853952, "uuid": "2516fb2f-fe8f-4164-9287-455bacb66e7a", "value": "768:q11DkDWmJ2pkY6CVbdxylBaF1n9emuGiLSGNT7s1ao0+xOY2NBNKB:qoKmJ2pj6ydxylBaF1huFLSGFs16Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648853952, "uuid": "0448465d-caa2-443d-9eff-f24110d950e7", "value": 41148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648853952, "uuid": "c679e2ae-06a3-4d0f-a1f1-3c8b673385f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648853952, "uuid": "15dd1457-b8c0-47e0-85a7-cd4c02dfd98c", "value": "arm5-20220401-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198a3db8-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648818627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818627, "uuid": "aca8e0a2-a042-4119-aae5-a4ed7fdb6f0f", "comment": "Malware payload (SnakeKeylogger)", "value": "7f94600dacbdd916b491e8f77a2c94c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818627, "uuid": "cb78bce6-b4e8-40a5-8f93-9174becc8452", "comment": "Malware payload (SnakeKeylogger)", "value": "f17d0babfcf4de34a088d214b9f4c61e881fc2f355efb70f717446da9dbc6cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818627, "uuid": "075c8884-ddca-40b2-bbde-99094da28015", "comment": "Malware payload (SnakeKeylogger)", "value": "85f560861993f10fa6547104e9392fcfa9d27c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818627, "uuid": "b124f73a-5196-4e7b-92e4-395109e0718b", "comment": "Malware payload (SnakeKeylogger)", "value": "375ab26617604ec44f9b8075a5e7b1b7d5db99fcd06943522e9dc23d2d68bb1d1d484bac4b732ec95a5b933e91fe0a78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818627, "uuid": "cda43f38-be63-4f7f-a7cc-1a7ff334782c", "value": "T198B4F119BBF6CE12C4B55AFEA0F796110371A74A6773DB892DC502C50A023A32F467DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818627, "uuid": "5e66eab0-2ff4-4ac3-931c-043bf9861c80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818627, "uuid": "d51d8c54-85e3-456c-9d3f-220d46edf078", "value": "12288:9MN6VhQVqLIMcma6XnQavWtA1a8ckeWT9oD8D:DPQI1M0QHA1aPxQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818627, "uuid": "581d8696-bb4c-4722-a11d-2f77f1b89f33", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818627, "uuid": "da704dbb-d7e2-4e7d-a096-9e221a585ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818627, "uuid": "6aaf0165-035e-4749-a172-6f22d6460bde", "value": "Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c37871-b1da-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648831048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831048, "uuid": "b39b90ba-c61b-44e6-9e62-1dd34ae8bf0c", "comment": "Malware payload", "value": "c1bb1242df6d45fbd14b3932a99b38fd", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831048, "uuid": "fbc6fcb2-0909-40ac-9440-c0d73531da56", "comment": "Malware payload", "value": "f4644d7df68f2c02da73638ef92352c969267890dab736ea48d60c063b1676b9", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831048, "uuid": "59177d65-e9ee-42ea-a5f5-3324f066fd5e", "comment": "Malware payload", "value": "b7852dff877b2473726188e0780427f854d228fc", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648831048, "uuid": "fb213599-55af-414f-b908-addc676c8047", "comment": "Malware payload", "value": "741eaabbcfe9f5c991e9537f32d5a9a7a6553122076b1550423afa205712fe41e3f16e32ebefdb865623e7c9f27238ec", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831048, "uuid": "8d59e447-88bb-4ea8-84cc-f9da7b7b85a3", "value": "T17E7306CB8F50F81EE9192830A846385F8E367CC873DAFD3AAD4545D91CA17A895DC223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831048, "uuid": "bde28bec-2b21-49a6-bd57-544aae928188", "value": "8abecba2211e61763c4c9ffcaa13369e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831048, "uuid": "92baa085-e305-4b5a-adcd-d16869f04253", "value": "768:W7BlphA7pARFbhOm0CAbLgK4fZ9Z34fZ9ZwQkQMTQbzjrY/+Tfq5WxP9sndcycN:W7ZhA7pApH1pb7WxP9snG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648831048, "uuid": "bbec2fe4-1704-471d-b1a5-c7b59bed654d", "value": 77246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648831048, "uuid": "193a6735-9d67-4116-9b1f-1fa115ac5d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648831048, "uuid": "e37ce133-0f4c-4cdf-acc4-f0aa7a2ea161", "value": "sneeze.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeb9f1d-b1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648818926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818926, "uuid": "71aa33c8-d8b1-4d23-930e-a6b518b46912", "comment": "Malware payload (RedLineStealer)", "value": "4e049c88ebd416f20b93a2908212886b", "object_relation": "md5", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818926, "uuid": "9cbc20e8-2c68-40a0-bb1e-4deafc51f5b8", "comment": "Malware payload (RedLineStealer)", "value": "f4ca00a988875fb8a01beeadd538610519b23866d0f16d27bb1c7e647d7a5a47", "object_relation": "sha256", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818926, "uuid": "8a52cf87-4db6-4ebd-b44d-81780414a0e3", "comment": "Malware payload (RedLineStealer)", "value": "1a0afbcbdb8f98d8228eb6e7a86997010220edfb", "object_relation": "sha1", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648818926, "uuid": "dd2927b3-bc94-478b-8974-fbc0842985a1", "comment": "Malware payload (RedLineStealer)", "value": "72d8f1ccd96e1db8dc65f74b2eae18c52b551c3caefb4fda32406409340be8c2c9c196dfda2349101eaa4eb2b0fcbfe1", "object_relation": "sha3-384", "Tag": [ { "name": "50-87-194-40", "colour": "#5EE108", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818926, "uuid": "8eb130af-9b6e-4e14-a818-c81fbb945905", "value": "T14635237E0F0602DDE1EF7032C46E7615BE622FAE15615D980229742E483E12E94FF6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818926, "uuid": "892f26b6-d22b-4baa-bca1-c7a15c9b8590", "value": "96d2c8e1ca22fe5bac14d3d4f7e16012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818926, "uuid": "bbdca2c6-d470-4af2-a2c3-25dc7976e1db", "value": "24576:zZZZpppppUMatJEKxoVIwPt9Kjr7a8ho2yO3iylA0taRgXf:zZZZpppppURtOLVPl8jr7EDGtAoak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648818926, "uuid": "4e1f74a4-6ecf-4b83-9ce9-112591b4dc5f", "value": 1060384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648818926, "uuid": "18554840-0fb2-4580-8d57-b575ee63a558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648818926, "uuid": "0f42733c-60eb-41a3-b8fd-933616e667ce", "value": "TrdngAnlzr98262.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a3600e-b191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648799886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799886, "uuid": "1b7bb229-92d5-40f1-a969-5575cd94e9f7", "comment": "Malware payload (Heodo)", "value": "691d2ffe7bbd0b7d669bb2a4be15f326", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799886, "uuid": "53c82ae2-1588-45d0-a6d0-65107e3c67e0", "comment": "Malware payload (Heodo)", "value": "f4dec5b82089917a2791b26bcd95721fa5a582bb3348645e965780d58985fafb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799886, "uuid": "9c5aba7b-c753-4a6d-a423-b7226828b7db", "comment": "Malware payload (Heodo)", "value": "24523ace95fc60233dec589934ff3f46812f9122", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648799886, "uuid": "2a8c4c64-20c5-4f31-ba67-8c06f47fd369", "comment": "Malware payload (Heodo)", "value": "e5decefa7f9f95e5abdd5a8e8bb3be3f0c13b1d666a3d1f9dbd8ff71f3fa0b2ffd2febd4e970831b2a360efafb37704c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799886, "uuid": "833e9333-9f1a-4c48-a4eb-49de008603cc", "value": "T124B4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799886, "uuid": "34b48371-87e0-4f25-ab15-173babca7c34", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799886, "uuid": "12ee7746-b4be-47cd-8ff9-bef62c70b0c3", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQNJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzDDIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648799886, "uuid": "897ed188-0cf4-4e94-a8ab-a280ba330b92", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648799886, "uuid": "2e39fcf3-4f57-4bcf-9425-ed296e9e3f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648799886, "uuid": "fc4b9a89-1471-494f-8f58-850d2e115cba", "value": "691d2ffe7bbd0b7d669bb2a4be15f326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84df50dc-b163-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648780153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780153, "uuid": "14a63a45-7cf3-41f7-9da2-206d0ebb829f", "comment": "Malware payload (Heodo)", "value": "f322398e7a1074dc31011af4f754d40a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780153, "uuid": "c887099d-909a-4305-9882-07cd1516ff67", "comment": "Malware payload (Heodo)", "value": "f4e10c5743205f55ce4eca43f3741f71ecfdca9391ae883123c3372d5daae4b1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780153, "uuid": "6b144e7d-6ec8-4585-aa43-3cf5bbfad588", "comment": "Malware payload (Heodo)", "value": "94c6cd7611caeb6d6b18a6d859e1655faabc7fd3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648780153, "uuid": "d34d0aba-fa6f-45b6-ba6a-55ed613dc7f7", "comment": "Malware payload (Heodo)", "value": "23077de68f6fbab3ed4ec7af498dca4053b805a393919a610126a2954ff4cbdcdc030de8641c3dcf4e0019e43af632cd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648780153, "uuid": "53d60dd3-b9ad-45a1-bb6e-99bbc10af285", "value": "T12A23CF5FE5AA6D57C2A6DF3C7F448CB8A70D268E958235D90894AF0E3F046631E4F02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648780153, "uuid": "b150c121-4b6c-4b35-86ee-4492a5f2fec0", "value": "768:QmBlntZhEI2YmxNskmoKjBvK3HqK88F/G6YzATUfJnXYS6oRM:hBlntTEvDLmXi3JvG6YzATOJnXYSXRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648780153, "uuid": "30bd8fd2-6420-4070-96c1-f317189bdf17", "value": 47738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648780153, "uuid": "e4a0d090-b863-4479-b3f6-53f9088d309e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648780153, "uuid": "c037fa80-e76e-4305-ba21-455c83c1af0f", "value": "SecuriteInfo.com.Trojan.Vita.6.17493.631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e23706-b1ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648839673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839673, "uuid": "257f636b-979e-474d-b45f-232db20afca7", "comment": "Malware payload (Heodo)", "value": "dd515971b029e160e9f6b91efa32070e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839673, "uuid": "82f7f116-efaf-4992-ba40-a614b9221aae", "comment": "Malware payload (Heodo)", "value": "f57a63a8a2c7aa1ee5f4253218b87856d6d2986e49d9a2eeaf2bfa064bb7c0ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839673, "uuid": "e9e172e5-9f1b-4db1-9d43-62c0250f19f8", "comment": "Malware payload (Heodo)", "value": "2217cf426b44814632fe40b91be60b560aa4a084", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839673, "uuid": "704b1f1f-a514-4ec8-96c4-d522500a88fd", "comment": "Malware payload (Heodo)", "value": "f68824b154adea469a27ecd50eca66ba3969e31bc7050fe5e5db35a7643194a5d7ba6d21481343adabb031166deee806", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839673, "uuid": "edcedc0c-bc50-4323-8084-7715080093a0", "value": "T13794BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839673, "uuid": "59806b0a-298d-45b2-86be-1f896ad79efd", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839673, "uuid": "11d9f8b0-40e3-41ae-80ab-6c733537e9de", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDAS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK4rsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648839673, "uuid": "f91e6ed9-4cfe-4ab5-b819-822a2d1d3ca6", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648839673, "uuid": "e8b7283c-a175-47d3-88de-d1fc1ead6b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839673, "uuid": "aa024756-2f01-402c-8081-4b444df50c9e", "value": "xcah3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5fd4e5-b1c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648823252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823252, "uuid": "969ba408-6170-4eb2-87d4-3e5a0f3712ad", "comment": "Malware payload (Loki)", "value": "26f5c44633d19acbc0d36b5b6cf5da53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823252, "uuid": "59181348-ccc4-469e-bd66-db9c45ba7824", "comment": "Malware payload (Loki)", "value": "f5a5fbc49514afb1313b49a6d52348d7f94c5f427dbc8bdd30ea9166967ed870", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823252, "uuid": "87498ba2-3857-4380-a2ab-d424df7d90ac", "comment": "Malware payload (Loki)", "value": "2d54c581f36aeff53216096e9352fe7d247562f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823252, "uuid": "06945e3a-e4d9-42dc-bd28-97fe8e9b936d", "comment": "Malware payload (Loki)", "value": "62c7794d51e2ca675f92c4a21977de34f3137e5409bb7bedf3460ffddc7bd9a4f0b25176989fa8f3d1bca9a0a1387eb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823252, "uuid": "cea3bba9-99f9-4961-b18c-0d00d87fc156", "value": "T1F9341254B3A4C073C5F306B05A7F6BAA6F94D60626640F0B03F0AF996E633D2DA1D365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823252, "uuid": "2878f345-4f8f-4f2a-b4cc-bb073b5ce94b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823252, "uuid": "e8b623ad-237d-485f-99b0-653c1b652ff1", "value": "6144:HNeZmUub0VKbD/zabBYXjAoiFOy3z+2isqGW:HNlhb0VkD/zabBYXjAoQHC2sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823252, "uuid": "537c20de-77cd-44f6-9837-2bc8d8262b86", "value": 238784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823252, "uuid": "1a62c9d1-0c56-44b9-aab0-226506bd0c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823252, "uuid": "6a17afcf-dee2-4798-a4fc-8d379da9acc2", "value": "26f5c44633d19acbc0d36b5b6cf5da53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db55ca36-b186-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648795330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795330, "uuid": "6770a6ad-c7fa-4c43-b4a3-b8e71d94c67b", "comment": "Malware payload (AgentTesla)", "value": "3cdee4d324dd1a99fc46badeb17ca8b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795330, "uuid": "053d184b-2b8e-4f2c-a63f-c9cbd3d3df34", "comment": "Malware payload (AgentTesla)", "value": "f6d2f38baea59af2a048dd09aa2f891c7b3c989e9ad7b4961232eaeb1e9aad31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795330, "uuid": "d05452e6-f03c-420b-b63a-2e63e845ec8c", "comment": "Malware payload (AgentTesla)", "value": "ff7beae48073add355be848edba3f597b5a0fe29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648795330, "uuid": "bfd712a5-8bec-4111-aad7-db567093e361", "comment": "Malware payload (AgentTesla)", "value": "653bfa0e0c01f5cd0b0c362fd762e839087db5abc446acee605e2e02e1a73a0630c442b267c8053b84a9cfa7e39c83f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795330, "uuid": "0d3d3773-33e6-41f0-a91a-da8d5751a0a1", "value": "T14623C3A20248FC5DEC5206339472560F42945D099B7F9BCF3C7FB696DA3C2B3272A619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795330, "uuid": "aa463810-b0ec-4184-9690-18a54f90dd64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795330, "uuid": "a2fc161c-979a-4183-9de9-000997673a53", "value": "768:4YOXbQI6C7I0XwoVaO+BKyb90Zc5zmnH68y3541Ni7mSpFG0ru:4zbQduLXYOmaPa8S5aNi7mSp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648795330, "uuid": "29febdbe-e64a-41ef-81be-a99b40668fa9", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648795330, "uuid": "84ca33a6-3069-4696-b3b0-db681775c1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648795330, "uuid": "1b0b3ae9-afe4-41ea-ba01-0cfe99dd0310", "value": "Comprobante__Citi Banamex0012#.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5beddb-b182-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648793422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793422, "uuid": "9d395b61-1ace-4f8f-b24a-1190dc5b8e50", "comment": "Malware payload", "value": "308c7561236de09cff02447418b7ea57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793422, "uuid": "75b23d58-9c40-43e5-92e6-5c28787eaead", "comment": "Malware payload", "value": "f75f4baf616cb8222cd5434a6aab710b375f33e4a13153ed810b265b428a5f1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793422, "uuid": "a4576233-c8fd-4455-ada5-09d3e7753398", "comment": "Malware payload", "value": "7cc90080cd1649d395460d631ce98b67a85d44d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793422, "uuid": "8331a6e8-484d-40b7-a65c-1543a2e5b487", "comment": "Malware payload", "value": "c3da73e037409b0690576c59b1874305353b11bb5c239c313f71e53733f3c2351669c31908ec36b20270be2b092aaa56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793422, "uuid": "d4d70ff1-f78f-4494-8777-b6e2371c9235", "value": "T1D8F1B634ABD60626F17A4E38D9F212D00BBDBE4374D6DA6FEE84110E5CA074847A2F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793422, "uuid": "c57cfaf4-bf3c-4976-ba61-56a42934b368", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793422, "uuid": "1e410144-8712-47cf-b051-cc69b1a29a4b", "value": "192:Z6SUaIoYFZcKMhZOdyo58+UqWeTojfFJDx1xQ1:Z6SnIoYE7kEo58+UqWZNJDx1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648793422, "uuid": "e7a686d4-4a4d-4f0d-844e-86e7cac83f7e", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648793422, "uuid": "78eeb169-b994-47c4-aae3-ecae1b3a98f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793422, "uuid": "91aade51-e31b-42ec-ae9d-c10c611a794a", "value": "Protax Discord Flooder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1a11ff-b1b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1648814422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814422, "uuid": "ba95dbf0-6ca0-44cd-81a0-941c20c89e3e", "comment": "Malware payload (BitRAT)", "value": "0fb08700bd94d2054e8ebf16603b01fe", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814422, "uuid": "76bd334f-171d-4332-a9e1-b36aba26f77f", "comment": "Malware payload (BitRAT)", "value": "f889a5010f912f6477f7c15cc313a55c0aaf5c19d08b4597ab40984886a58ea3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814422, "uuid": "21d8daaa-1fc0-4857-b35e-74a0330b13e4", "comment": "Malware payload (BitRAT)", "value": "eda02fd5bc4152ab8b2533fe0d73b9611067c3e6", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648814422, "uuid": "45a62045-a923-4966-a4a6-45029821042d", "comment": "Malware payload (BitRAT)", "value": "e7ef1993867f122c30a5a55fbbd78f195c97ec12fb7f803d23036bdc8d704dfa7fb3502d2e18fd1b3c51bacf64668f33", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648814422, "uuid": "7c32d3c4-827e-4772-8c53-a0aa6e43f8a3", "value": "T19C229D2CA2692C29CD0582F2C27AFDB14E57F314CEEF4503725EE5B077BBA009B94495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648814422, "uuid": "66d849a5-1f37-47b3-bb22-bcfee4c487bc", "value": "192:S28ZhZlV2FbWEkl31UKaUPsqbmqe/cP2C6mrEy0TS9U7VLIDSrzqW/fFHUU1wDqt:58ZhZIp6Cq9eAB6mgCEIDSrzfp1Qq7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648814422, "uuid": "5e384086-30b2-4d6d-a61c-7d755d0eff54", "value": 10751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648814422, "uuid": "553c6c4a-06bc-4f8b-b236-76fbdc48cb12", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648814422, "uuid": "52e37f1b-92e7-4d04-9055-ed83c84e5166", "value": "Inquiry 01 APRIL 2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd264a85-b1be-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819385, "uuid": "9e5290a0-6c73-4f24-812e-687c1e7db7d1", "comment": "Malware payload", "value": "83e2a7b706574d9a3f5b8fdd85c36ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819385, "uuid": "55f4b1d7-0d11-402d-83af-778208872184", "comment": "Malware payload", "value": "f891a259732d6f8ffff3a46c7710dca7a84fc6c28bbc0d0af66558594bf98ae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819385, "uuid": "51a4ecd9-6601-4da5-8a84-5e4a489071a8", "comment": "Malware payload", "value": "d12a487aa174a16d097a368701629f94673d8d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819385, "uuid": "4846b5e6-aeff-435b-bef6-43bde1be5190", "comment": "Malware payload", "value": "962395bb681a6694b2e0fc5f786ea72d90dad0b7e53489386a8d09539109a1e41441630ddf6affc533c6995e4d2cf824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819385, "uuid": "7c1c58ab-089f-4375-88b1-e8d6f15ed2ac", "value": "T163522B59AB58D6F4DC7916B95CB35B001B78B646E4175F0F35CE630BBE2321204B2B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819385, "uuid": "a3ea02d6-7fd6-4171-b3eb-c9c435e904a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819385, "uuid": "b8bd9562-d143-4083-89d2-b792c483686b", "value": "384:qM2UHYbrWB4nsPiiiay9ycyrsR2vZstBZ:qNPbrU4ycyrsR2vZstBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819385, "uuid": "1c8fd5c1-cf4e-496f-8279-4f016e97ed46", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819385, "uuid": "1f8bcdbd-146f-4ca4-962d-fceca09f0f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819385, "uuid": "0d746876-8ee9-4bcf-b0f4-f7dde5a1954c", "value": "22345678909876543456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0645a3-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648820244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820244, "uuid": "feacd34f-ee9b-4c16-a8d5-a7b21d4d5adc", "comment": "Malware payload (AveMariaRAT)", "value": "96ab4a1f751443c460762f00dccba139", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820244, "uuid": "0da4387b-d210-469d-87f0-f57860d027e7", "comment": "Malware payload (AveMariaRAT)", "value": "f8bb0d6e016074f6759f74d8950983793a87aec3cd6d56569fa8809d5c55396a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820244, "uuid": "d8eabc5f-42b9-4b90-ba7c-77ff77a0b0df", "comment": "Malware payload (AveMariaRAT)", "value": "244dd95d46dbc20f900782b16cf0a7f58eff6b42", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648820244, "uuid": "6c9e01ac-934b-4db4-add0-e5d7d3965ee5", "comment": "Malware payload (AveMariaRAT)", "value": "8ba2dcd00c28a50ea39d99ebd753146c3626ecafe61fcc05b56713d82a2a422d85c0c7b526936d23fd94c4aa4636d857", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820244, "uuid": "5c5dd460-950d-41b7-9e9e-c7628971b40d", "value": "T1E4256B5452EC69D3D66BC7B2C4DFA9F3E0E1D2AE04317318504B51AD00B1AE7B39CB9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820244, "uuid": "982718a7-befe-46cf-8ad8-4fa68fc853d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820244, "uuid": "74613b6c-840a-4e67-93ff-8cbc2e152e49", "value": "12288:yW9np85fgTNm/c7cOWjWy2qyCo4pOWbsFA1TXDjoAWqUQhlyAKp:JnS5ITUKUyMO8sFA1TbWqzhlWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648820244, "uuid": "809b5195-142c-41f9-91a9-6d61ad7cdad8", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648820244, "uuid": "63ff2450-918a-44ff-b48c-5cdae49c9991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648820244, "uuid": "924b8e81-6c40-4257-b1b8-503860a59344", "value": "Documento de recibo de DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bae2a2d-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819705, "uuid": "3ca0f1a5-be09-40fe-abaf-aadf997ba2b0", "comment": "Malware payload (Loki)", "value": "180d828e6b3df1c212b2d7c717fd01d3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819705, "uuid": "ddaadeb1-1daf-4f8a-a96f-4a0af12ef989", "comment": "Malware payload (Loki)", "value": "f8e673eb76166b978bdc36e08b057113bb7b892e950e4379e3c614c4c66fe53a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819705, "uuid": "6edbeb70-999a-4fde-9cf8-455836e5bb94", "comment": "Malware payload (Loki)", "value": "8a390dc4410acce7993a19167d63c6324755c8af", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819705, "uuid": "ee251fb7-67c8-407a-8927-4cc4c282d16d", "comment": "Malware payload (Loki)", "value": "d7de5bbd8815056da6a1898ff539c39275218815df8678090cabd47eb8905d90265923b3fa325d74e1ec3fc6eceb3967", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819705, "uuid": "bc4979b0-43df-4e6a-a322-5c661905b609", "value": "T1EA140174EBE0841EFD71063A1D54D7FA19ADEF013802838AA1C9375B1175BCB0A2F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819705, "uuid": "111fddc5-c686-4de7-a13e-3b8033995fd4", "value": "3072:X32fJUEX8g4xth4FlfeThLzu9yLvbax1EjYQw1Qm2RNDKbjyrAR6mnN5nylT2hGY:n2frX8dxth4FA9hbO+FwmjgmrQrnHnoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819705, "uuid": "206a35e0-0351-4c8a-ae33-e8a560933039", "value": 192184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819705, "uuid": "7b761430-dcae-4568-b873-03f144ef7fb0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819705, "uuid": "d61a398d-2df4-47d3-9fb0-33ecdecee23d", "value": "202.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4a00bb-b183-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648793912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793912, "uuid": "57452a26-45a4-4907-919d-4e509f067598", "comment": "Malware payload (Heodo)", "value": "6fad1b816e73c33bd37849a078af35da", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793912, "uuid": "04f7c374-f094-4883-9cf8-0d268541afba", "comment": "Malware payload (Heodo)", "value": "fadd299e61b6bb201dcea210eb82300c0aec7a1e6742be518a7351aa0eac0744", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793912, "uuid": "5e5dd9d1-a7d4-4261-af43-0196bf947919", "comment": "Malware payload (Heodo)", "value": "a30a40f1cd610ea7c030df29345a555b7ef012f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648793912, "uuid": "15cccc91-14bb-4136-9d60-ab260a7507c9", "comment": "Malware payload (Heodo)", "value": "e0ef80715f44a9cf847ec1f74181831f885d67921efb5a4dea62f8ab4ba7c9c5e34b0112c8c386207f47f41999127374", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793912, "uuid": "29684bac-b084-46a6-ba47-ddad2c87ed73", "value": "T107F3256D0FAE0052CC260B70545C0FD9909BCA29FB5256FF20896E2E2EB57D758B9F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793912, "uuid": "221ab5ff-6169-4284-a268-e4c64f232f76", "value": "1536:0wAjC++znd222222dccccxjjjayfzzzf2222cfiu8xrdxHNHNEBQdKELL4Ot4OtN:rA5pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648793912, "uuid": "93316528-b21b-46e8-88ed-bd4b8d5e493f", "value": 165979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648793912, "uuid": "415a3f01-75fc-4885-96e8-9a357079f2ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648793912, "uuid": "1b0a6a93-6a87-49cc-9caf-bbf40a70e6ed", "value": "emotet-low1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8d4536-b1e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1648833965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833965, "uuid": "3a2f3805-aedf-4763-92cc-61b1b854dbc3", "comment": "Malware payload (RaccoonStealer)", "value": "17e8ddc9226235133410f5e9b42d07e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833965, "uuid": "d1eb8d90-e4e6-4662-b250-f655b2ffb519", "comment": "Malware payload (RaccoonStealer)", "value": "fce56d7d967ca633c48de1e3f39cd540115ce75f3e0347ffd641ccc13ea7c45c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833965, "uuid": "dc847aef-33d4-48ae-bd35-19dd5699c879", "comment": "Malware payload (RaccoonStealer)", "value": "74363d0d1e1c8fa205d1965cb49966cbbb75d6df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648833965, "uuid": "e11dc6f8-34d9-46c7-ad80-75b4b9f555eb", "comment": "Malware payload (RaccoonStealer)", "value": "2cfc7bd5fa24869e1b70c82a939fff5f00eebb9969e5b7abced67919797e76edeeb0f1e035b5167dce683ae956635b80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833965, "uuid": "3545baec-6712-40e8-9a18-21d319a33e92", "value": "T15AC49E76B56180B7F17200B0AE7CABA1167DBC7059324DA773CA063E4FB05D19722A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833965, "uuid": "8b9bcaea-b98d-462d-ada1-ec854e4d5d7c", "value": "32006b4f5f2216b7baee1433a001f6f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833965, "uuid": "2953a93f-9890-4995-8b8f-0a0ff38a5c64", "value": "12288:37AVwypN9NnwDLaDHZoFBHq3Ad4Dqo3XWRsauaaqCuJ580f:rkX9JwDLaDHZoFs3ACcRQaafn0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648833965, "uuid": "154552ef-0b72-48db-8680-502f8adea685", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648833965, "uuid": "303dc406-1012-4274-a552-72fac8990b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648833965, "uuid": "4ed76f53-6e75-4e6d-9123-efe937c3fdea", "value": "17e8ddc9226235133410f5e9b42d07e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543cb87a-b1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648819585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819585, "uuid": "0affdcc1-23f8-440a-a291-e0cd4da4d168", "comment": "Malware payload (Loki)", "value": "d887007f8009ce98867fe0acb8222780", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819585, "uuid": "5627c8d3-f410-45bc-b66f-8c49ace93173", "comment": "Malware payload (Loki)", "value": "fde7d3901996e633b7d8c46feb7539b826e6b5c1dc1540d166167b73030961a7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819585, "uuid": "a441be1f-5b1e-4167-863e-78741bc71e4d", "comment": "Malware payload (Loki)", "value": "7edff0da6552466526fbdf552b20ce656955d1e7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819585, "uuid": "8ed62a3a-89a8-495c-b946-c8d9fba82b29", "comment": "Malware payload (Loki)", "value": "aef26a72f52670903b2fe0c41eeaca74904fa9ddda322bacb60aa8545f235a045a1c09494f5292f0568c6dea958ea0b2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819585, "uuid": "e5d8b31b-2720-4b3a-abfa-f532356cb983", "value": "T16D14125A3BD58D9DD955533B8FDE52FDAA1F9C27282B3920720232CC573CD89D80A352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819585, "uuid": "891ee7f0-2d80-43d1-8240-1602a9ede8a5", "value": "3072:lbqx7hjaBLI3hYJxhOryweYdukca5LhJvQW+5GFqSBWS7lfsRhVBQnLG9E:lqxNlletYTca5vQI7/ZfIlQLGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819585, "uuid": "f9572d3e-74b6-43e2-af59-76177fbfbb37", "value": 191176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819585, "uuid": "8d12bcef-d0f6-49b3-9321-8cee6ef8a8a2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819585, "uuid": "7ca995fb-223d-45f4-9810-b6ec4a4d413f", "value": "DTR_Doc03012022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e017b09-b1af-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648812649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812649, "uuid": "d39d43e7-5b81-4f4b-ab14-08cfca194d10", "comment": "Malware payload", "value": "990d9fb8d778c905ba5d6e78e28570f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812649, "uuid": "7c7e51fb-89dd-461f-b007-635c535b6de3", "comment": "Malware payload", "value": "fe3b3525b9eb8320bf8cf2abc0e00316160bca55a1257c40b19dbb7e9259e2f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812649, "uuid": "0f6c50c6-d486-4d08-896d-fb592316a817", "comment": "Malware payload", "value": "885aa4bd5d3ac485e00cb6ff3608c738cf72e6a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648812649, "uuid": "575ea036-f1f9-4d61-a44a-d1e2e48e18df", "comment": "Malware payload", "value": "8328c35edb37abc212bce78955ab9c028ccc7d155ae9b91e5510283713630968afc9c8f238f0b4007071916a27f0a2b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812649, "uuid": "f49b2572-be0c-48c9-bf0b-c7ccb7dfe0b8", "value": "T17BE5012596B2C144F87F833259160A80AFF2B51FE316DA7DFA10504C9E9EFDA831725B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812649, "uuid": "cafd0bf5-fa8e-4849-8851-d162785be3cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812649, "uuid": "e6edc3a3-b3cd-4218-bc32-2d18c5e41e54", "value": "49152:cbKfgggggh2HA3zQb8Mygm/27wim3IdpaS1WXyM5QEOXLvouVF:pfgggggY8rMytONI7yM5QEKzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648812649, "uuid": "ca3a7d1a-098b-44aa-bc31-92c7e5f96669", "value": 3146240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648812649, "uuid": "0d549a91-832d-4229-aaef-77af7e784ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648812649, "uuid": "8ea5320b-4131-4520-bc8e-9576e1388cf5", "value": "990d9fb8d778c905ba5d6e78e28570f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8def85ca-b1c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648823976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823976, "uuid": "7ddd6f6b-caeb-4610-a454-bdb5c2b56888", "comment": "Malware payload (Formbook)", "value": "e54629bc607849f6eb37798867fd9030", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823976, "uuid": "f8ff25db-ec7f-47d9-8953-95a9cd77631c", "comment": "Malware payload (Formbook)", "value": "ff4f7b5393286be5e2c944baf8c38494796a80a1cbb833be3eaf5133ecc51842", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823976, "uuid": "a795f123-42eb-4c62-b813-e29afb9302fd", "comment": "Malware payload (Formbook)", "value": "5548c8fe4eddf15bc2df7eeafa67a1ad04c9a187", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648823976, "uuid": "86494f1e-95f5-4353-8a74-7d9a66f4737a", "comment": "Malware payload (Formbook)", "value": "26adb317028bc6b3bab06104e9ca45f623ed10796acf08dbcb78266f317c8ccb234db68a30548333b38aa877a0dd88e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823976, "uuid": "102d9750-0d49-4276-9520-7e588dac334e", "value": "T18B3413522BB4C4A1D8E311311F36A7B6DBFE861059EC4B5B3B515BDC34223928F0E75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823976, "uuid": "5d568a7e-2673-4aae-b734-bff601e075c2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823976, "uuid": "7be57a62-d1a8-4f27-b1bf-d80444a48f61", "value": "6144:HNeZmKTrzpiSpTq7tgdxhfYoSIg/9hq0ukZVVbAkUTFo:HNlwrzpiiTq74xdYcg/90jk1bAkCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648823976, "uuid": "a7971f35-021a-48f0-8d9c-a40cd7657863", "value": 244699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648823976, "uuid": "7ff6a4fe-64bf-4698-bfbc-002ed28b69ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648823976, "uuid": "21c1dc23-f7d7-484e-83dc-5b3f82e53399", "value": "e54629bc607849f6eb37798867fd9030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee11fe6f-b1ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648839600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839600, "uuid": "772e6e27-ad98-47d3-90b1-819ff4c78aad", "comment": "Malware payload (Heodo)", "value": "46640a5981b1a62ec19841bb6ef57e41", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839600, "uuid": "8a3ef214-420a-46f0-aada-c59ab1a04fd5", "comment": "Malware payload (Heodo)", "value": "ff8ee64cd72860c39b65e20dcaf8c20bdc76d1fc655ae7639c19b353a853b991", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839600, "uuid": "c4f32bde-c3d6-4f2a-99d9-78fe0a033a9e", "comment": "Malware payload (Heodo)", "value": "887517211d31c1c7fe1142b3cdccff7f5d3e28e1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648839600, "uuid": "10f9b514-cfb7-4974-9ca5-9a6c9e1042ba", "comment": "Malware payload (Heodo)", "value": "21e2f1537b3f6f2fc6666ee51f754da281db5397ea44f5069aa559a9aacc2378e7dbf44f3a8dbc0b7bdf2c96684818e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839600, "uuid": "7ec4e491-3c2f-453c-8ebf-5b73edc8354a", "value": "T1DD94BF1235A3C8B4DEAF133409A39B2466B9F504B971CE176B74CABCED319428D153BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839600, "uuid": "69032179-03f6-44f3-9f0f-e265ba025317", "value": "a1307a412c459cd4896a70dba2051692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839600, "uuid": "1e3f1678-9442-4413-858a-cfb324025539", "value": "6144:fXsg4N8g8NZrrED8R+7pARpzKDLS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKTrsjW+5MDvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648839600, "uuid": "618ec48e-3425-4457-8962-488fd2024ad4", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648839600, "uuid": "75fe96c7-6996-4be8-900b-f5add74e1e0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648839600, "uuid": "51733944-754c-4d27-9d43-c2578c8fa735", "value": "xcah.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1528df07-b1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648819908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819908, "uuid": "d736eec1-78b7-4b58-ab3b-e69b61f87ea9", "comment": "Malware payload", "value": "55b0a6d4dacdb2444196f08e0c523634", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819908, "uuid": "34d9f7f6-3ca4-4d2a-a61a-69e2983da22d", "comment": "Malware payload", "value": "ff928feb699a42fefd718ab4f31e81141712745452f6e77be59ea94ffb87e63b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819908, "uuid": "d566c717-d50e-42e4-beb1-0d6eb800bf0c", "comment": "Malware payload", "value": "13d9818d044226ccf0629630c835c612016dda4f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648819908, "uuid": "c7ca604b-541a-4544-994f-d7f96fc741c1", "comment": "Malware payload", "value": "51b860e2d020102bb186fc5be1f3ecffc1b7bcfbcb71749a07dbfa5a601c17a9e7901c024574d21e4e8ef27f7a967ea0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819908, "uuid": "36c29d2a-46dd-4551-835f-f05d1f097204", "value": "T1B50430D5E686297B5DF702A2AC0F495EBE2360A2221116217F4DE4CC232165FD7F6B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819908, "uuid": "2535926a-d87b-46f3-b43b-7540c826db9c", "value": "3072:ynFkJughJ103pvjOTXhJ103pvjOTXhJ103pvdhJ103pvjOTXhJq:yPghJMjOTXhJMjOTXhJMdhJMjOTXhJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648819908, "uuid": "de1c5ff2-efef-47df-bc88-2b70a688953b", "value": 187871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648819908, "uuid": "7ec559ba-bd19-46aa-8503-276d5b86d417", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648819908, "uuid": "d14d11b4-e654-44c6-a439-31411386c882", "value": "Curriculum Vitae.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }