{ "Event": { "published": true, "date": "2022-02-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-02-23", "timestamp": 1645660981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "515ac36b-0042-4e8b-9cd9-08097e1a32e6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8feda0ee-94d9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645642268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642268, "uuid": "13826e2f-8200-4736-a2ff-cb68898f63c6", "comment": "Malware payload", "value": "e86f3ae4f55385793563c148e3babac9", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642268, "uuid": "19ae7e3c-d859-42c8-84f7-04ded2863e1c", "comment": "Malware payload", "value": "00f0455df7ce95e8e99756877724bfb6a056bf9cc2685535c1d7ee88cf7448cc", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642268, "uuid": "4f939ab6-d1e1-4f4a-a1f7-7661b12d46b8", "comment": "Malware payload", "value": "ae4dcbd4e2c44175454f42c1c2458ddc64327b1b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642268, "uuid": "b169d390-31be-4a1f-94e4-1fd29d48e06b", "comment": "Malware payload", "value": "3e195f8dfd14819cecc79f8f746dd111e1aa3d34c5e239e7f52ebc44625a4645b603852db1177c26fbc442a82e41f077", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642268, "uuid": "e7bd3894-ca94-4fac-9622-5f5850009fd8", "value": "T16944D01AC2117C1EDF1F5ABB114BCBB6FA5291B83631D7091D6E8AC7DDA70A36D08360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642268, "uuid": "a45807b1-de1b-488a-a910-5a11a775677a", "value": "3072:0DUW+KShrLHe/Fnqms3FJ9hQZIiiUEinq7C/9ycZz3V/Pg5fwqqqqqqqqqqqqqqT:iT+Pyqz3/QKlj7C/9/t9g5aVQNJU2cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645642268, "uuid": "43ff2402-ad50-4633-8db0-a1af71d9b025", "value": 271509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645642268, "uuid": "ebb6d6d1-66d2-42b5-989b-63480de616b8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642268, "uuid": "e0f0aaef-1f5d-477a-983d-37c75437c3f4", "value": "192.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810fe218-94ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645628929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628929, "uuid": "612efd97-1474-4055-a1a5-5efa87acd3b4", "comment": "Malware payload", "value": "61c7e7b1480a638a19df68a39c79e3c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628929, "uuid": "9f188dee-92af-4e7e-aa6c-f1b8e66ad570", "comment": "Malware payload", "value": "01f5a4e85ebe96bbb45b00512950e804c476a1722ba04e0716b1a2cb73290747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628929, "uuid": "322b02b0-252b-4e5d-bea7-6632eee26029", "comment": "Malware payload", "value": "79fa3573de15df257e99143ece9a83dcfb2bc8e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628929, "uuid": "07143c63-a19a-486b-84ef-136e4f4a53dc", "comment": "Malware payload", "value": "445240ed2f1fa97f43b4ee6982cf256cb52c6fad4fd7a1ee8330c8ad570655f7dc34f6a21303ed94d7817bc88a52cf77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628929, "uuid": "611b72cf-18e8-40de-a120-5876f1ee7473", "value": "T14FF38E5161C3427FC862A67195EC4690C5EF7E123A798FCBA74C267ECC392A10377E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628929, "uuid": "139dbb22-9e53-48bb-af12-39102969412a", "value": "302c92cfe50e25c860a4b55a375f7422", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628929, "uuid": "21cf77a4-bf5c-4b6d-aee5-c0bc5303a099", "value": "3072:dc4Horf5X/n8eXZHTFGAfU7VKXHGHggYldvULKZK:d3y1/n8YpDCVKXHGAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628929, "uuid": "48b7fc0c-a2e0-4469-9505-1951eb0f190d", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628929, "uuid": "17d41e2e-169c-42bb-8bc5-6dc83a40a642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628929, "uuid": "f165c8ea-6793-4184-837e-34f646c1c3e6", "value": "SecuriteInfo.com.Variant.Fragtor.62229.10104.22002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcb6590-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633832, "uuid": "76479857-1dfd-45b3-98c0-8ce7838d75ea", "comment": "Malware payload (Mirai)", "value": "8a0eb5e9ac30b0705779053c3d94e73e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633832, "uuid": "be67436b-c15d-403a-a1c2-6420f8fe64e1", "comment": "Malware payload (Mirai)", "value": "01fe116cb213f72bd8899ca79452eeefff62e30f6ee90383d35293bf15f4737f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633832, "uuid": "e0c4e718-e104-42a6-8b5a-ecb83f1ba0f3", "comment": "Malware payload (Mirai)", "value": "fcbfd94e4241d41c46f1fe6e140536421d8f55f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633832, "uuid": "e503f50b-9a60-48be-9c56-57b1f393d083", "comment": "Malware payload (Mirai)", "value": "1e312074bc4eca356930f02a091d41e5decd04276b7f31d26bd5a373bfe95a11c25a824bb45685e75ea69548b39566af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633832, "uuid": "ad02553e-b5fd-4212-80e6-7505c51c0ba7", "value": "T163739F62C0E49D79E6944E74B791D83F8313A40C65E32EF6D741CA69900BAEEF0097F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633832, "uuid": "06f921ea-f0e5-425a-9c24-687edb4a4adf", "value": "1536:Ow/dFvXVECaJwtlG2+BE9CsULDGfs3oWzgWqlYxCSq+/9B:V1F9bCs31ULKf+9pqlYxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633832, "uuid": "e781603a-306a-4526-95f9-f252e6262010", "value": 74740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633832, "uuid": "9aa438a0-1d28-4e69-9a63-c39a127e9241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633832, "uuid": "d5d3ea47-2d46-4fc2-a9cc-0842fb81fa9e", "value": "Zeus.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3542eeaa-947b-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645601743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601743, "uuid": "8b6d5fab-bab9-4d41-a7cd-7d3f4d5ad1a1", "comment": "Malware payload (SnakeKeylogger)", "value": "3cdfedf2c17ebc50c91b5e13c36d1198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601743, "uuid": "a953b396-eb87-4c1e-84f6-500608615334", "comment": "Malware payload (SnakeKeylogger)", "value": "0232b52c106759ef134f74f0912abff1704a8c647eb090a94f447b338fe50ddb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601743, "uuid": "027b0e16-5552-463d-9cdc-651ab1627baa", "comment": "Malware payload (SnakeKeylogger)", "value": "37164cf54f7321ad2258317b25d1fb6550b1e0c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601743, "uuid": "2da71d5b-e58c-4139-9a1a-432e7e0be822", "comment": "Malware payload (SnakeKeylogger)", "value": "51a57e3f05edfd24c17e3765cb18d2a7b5235903c04b5d10d587a576f31d684ad3f06acfd5f39ae532711ffd39ed99f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601743, "uuid": "ec8faccf-3464-48b0-9b58-1a2b3fdd1a98", "value": "T17E0561983191F2EEC8A7C875D9681CF4EA903C7AC30B910790673D99B97D897DF160B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601743, "uuid": "f652b7fd-9645-46c1-85c0-3cdf9e0b6a41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601743, "uuid": "4b81730c-1674-4f7a-9eec-dc2ae22532a2", "value": "12288:rCwO/Km9lGQCm3LlL5TZTXnhdB3jq17rwwduAQDsDJHfQqZXKQuWc1OlBEgZhcDC:r9O/TlumblL5Rhr+1Vc804", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601743, "uuid": "c1750280-c11d-44d4-8d97-b9a8dbe78738", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601743, "uuid": "5dbd5e6f-4f30-46e2-8f1d-be8ea782b11e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601743, "uuid": "0d49df77-d8f2-484f-ad48-d663a3a646ea", "value": "Img#0471309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b546b2c7-9486-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645606682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606682, "uuid": "fd52d107-f90f-48d9-8434-22a4109cdd93", "comment": "Malware payload (Formbook)", "value": "b10783626756a5bcd5ed05d03d7fa954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606682, "uuid": "3c2d4a39-2e06-466e-b2ba-b45774fcbedc", "comment": "Malware payload (Formbook)", "value": "02466f10b00992a56b5fbfd4f8117e8572c2f64b27fd7bed8b51acc159004fd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606682, "uuid": "ef9a4d76-2e59-4c36-8d82-0aa280c8ed95", "comment": "Malware payload (Formbook)", "value": "5667b4a546875dea6a2d6bc033f9497e1cd0245f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606682, "uuid": "e47833c7-41bc-4983-b654-b3ec8dd3e97d", "comment": "Malware payload (Formbook)", "value": "0bec2cdc32db7e404ec656224c027ccd6e8a9050f6aac219ebf739071f42004b30db2133c34bfa4b98c274ddf0f62053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606682, "uuid": "98bfd272-7664-4996-be57-24ef6369735f", "value": "T16A259E62F6918833D43319789E1B53549826BDA03938D8863FF47F8C2F3A7453925EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606682, "uuid": "7fc62afa-cf06-4200-94a4-baebcb4f8f42", "value": "fa9012f26f19d2b57997adcc6f3bb5ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606682, "uuid": "8f30209a-fce1-4e74-b681-ba8f4f6591ac", "value": "24576:AulcKxxVbDbzL4bMB8lh/XZ4EuuGKGw5WXd3/jK:AjSbYXqcyLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645606682, "uuid": "3c622843-1218-45e6-b2d9-dc27e009aa86", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645606682, "uuid": "f6b26b34-6141-4ad1-a8de-731c39ddeeb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606682, "uuid": "14f83384-2fbc-4a07-bac9-b7bdd4a2b3d1", "value": "Lista de pedidos adjunta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132865b8-94d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645642059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642059, "uuid": "dd553dba-fc8f-424e-970a-826d5e26450a", "comment": "Malware payload (Heodo)", "value": "b070c3a1c7946a381831343dd33a49f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642059, "uuid": "cd40c2ed-216f-4351-be54-8213ee7b42a4", "comment": "Malware payload (Heodo)", "value": "02c4ab6d0e9f6903c68ad33620a8820c3d018e5cfe08fac334b38968f109d940", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642059, "uuid": "dc57962e-2a23-4901-9121-3589f1ea66ee", "comment": "Malware payload (Heodo)", "value": "d4082ffba4f1777f0c65d7ad136a2c46ef7e5918", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642059, "uuid": "5d25ed0d-cea6-4885-8601-36d1c6e5a26a", "comment": "Malware payload (Heodo)", "value": "2f6b59ced215a243df23e6d56433013156de3bf3c6f0bb971806f5f78c6fb5c9637c823b0dfb1bfd8dec52186eb2b77e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642059, "uuid": "0995387f-2c8f-40cb-a562-b2f800ab8971", "value": "T17193022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642059, "uuid": "9b7dd327-52d0-49f0-9611-202488182fef", "value": "1536:PQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:mDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645642059, "uuid": "ecb2747c-e731-46ba-a15c-1c58114c8291", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645642059, "uuid": "69b07e6d-17c9-44ff-9b2c-03d14f336785", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642059, "uuid": "bc6ee729-137c-4928-bff7-f64aa7e151e8", "value": "MedWin.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6e5451-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "2e3f2975-ea8c-470a-b735-2280e95009ae", "comment": "Malware payload (Heodo)", "value": "bc1a10232090539d9019ebab1cde31d3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "ed964725-4a8e-49df-939a-6869593d5ef6", "comment": "Malware payload (Heodo)", "value": "0317dcb31c629d4a5f3efa4b31699976b13a1cadf24f6ae6d0e2307a0957b8f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "f2f1d4bd-3192-43d8-900c-f07133df5851", "comment": "Malware payload (Heodo)", "value": "a07ee4e2f148692e5c99ecb06ef61d90cb2f485c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "aae79a0e-681a-4ce5-8020-8788fa22e250", "comment": "Malware payload (Heodo)", "value": "1b1a6c03d30b0dabb2dbe523e9e5f4ec7eca3b92ed7d3f558fc61816a0e7470a7cc87c43d95039f240fd309e26074728", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "a7103355-ea64-4a4f-b6d7-59d4615a0a4d", "value": "T180B42902A612F13DC28FA0754D016A65D0AEC8E5277177E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "1e4615b6-5ca5-407f-a179-c2713eba4334", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "807447c6-0b14-4ce9-8740-4edec3518f7d", "value": "12288:IOzyEtBX2ZHq79+V6/G5YgvmgZDa6A9TU:lnmZKR+fYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574964, "uuid": "468e6f59-19ce-4f00-90c5-43d8f6992ae0", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574964, "uuid": "11c2f9b4-6758-45b8-b259-eeacf3185b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "a150583a-e8cb-4238-84d4-14c8e3230585", "value": "emotet_exe_e4_0317dcb31c629d4a5f3efa4b31699976b13a1cadf24f6ae6d0e2307a0957b8f0_2022-02-23__000919.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f4bdc2-9488-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645607643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607643, "uuid": "2ea92ef2-b3c5-4039-8020-4b6920ff3f00", "comment": "Malware payload (Heodo)", "value": "54377bfcfd5a8acf54484fe329702ec8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607643, "uuid": "a6ef6818-2637-4bab-8dc7-95940605e0bf", "comment": "Malware payload (Heodo)", "value": "033150c244539aa057a33d19da21911b4026f450dfb27fc4184db9eb8687956f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607643, "uuid": "127185fc-9aa3-4f3a-b5eb-783d5e779b94", "comment": "Malware payload (Heodo)", "value": "bbfedcab0596676ce3e3508864e9510b39d95904", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607643, "uuid": "896b9479-a35f-46aa-92d0-b1c26daec8dc", "comment": "Malware payload (Heodo)", "value": "d670c0ea7d4427e2ee75e341b75ac525c72ca68f4e0fbab8b2f1825b640ba20749e38fc4b0640fe87aca8ea874b3d101", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607643, "uuid": "ec7966b1-cf71-4007-b468-2aca29ea53a7", "value": "T17335AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607643, "uuid": "75603bf1-d706-4e19-b7f2-89159c8acc7a", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607643, "uuid": "db598096-654e-4b64-84ae-5db6b880b001", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNSTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNST/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645607643, "uuid": "6df0fa2f-03b3-4656-9dde-6b9d9bc942d4", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645607643, "uuid": "f3716988-d992-49e3-85c9-4de84f411a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607643, "uuid": "f143ebe9-351f-4224-9e6c-4f18613a8e10", "value": "mmdX686JoonKb1kDbV.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dac4256-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1645619394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619394, "uuid": "29005ca1-2f13-42a7-8f01-6a0cb917b7fe", "comment": "Malware payload (BitRAT)", "value": "81409f4cbbe4e2467a3f3a6e9e9665aa", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619394, "uuid": "a2a716ff-3c0f-42ae-85fa-044e42703114", "comment": "Malware payload (BitRAT)", "value": "038786dd2d3f200716a57d33ed105614b92c40dfa10a24e499e3f8d96705d696", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619394, "uuid": "52f63cdf-4b85-459a-a161-7af661da3291", "comment": "Malware payload (BitRAT)", "value": "bea0b902f1fd8784660e03fda64c26eaf3ab7f65", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619394, "uuid": "9d5d5b27-b072-4c33-a020-9338c389dfab", "comment": "Malware payload (BitRAT)", "value": "ee4de432e4cd8e2d8b0367074c0a7593221d502f5d6c0e65702d5964c0eaf15434c76bee20b251c0b1e4ed1c361530cc", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619394, "uuid": "bb19ca0c-9f58-4b16-a6d5-b16cf0c80bb1", "value": "T1CBD5F07C266E6E4CF794947CB1798EFF17A2BC2F05A774F7900CA1D70AA8BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619394, "uuid": "afd36c73-19a6-4b04-aefd-e2737828f3ed", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619394, "uuid": "f1455e93-e93f-4392-9f89-6052f263f4d5", "value": "49152:XpEuW1sPapJLiNnscG9EONjeSpsZ5Ruh4c7tPOFlu6JJ2O+AsE+Erh:XpEdtLiNZG93jfpSP1atPI/nRl+Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619394, "uuid": "bb2e291b-f86b-4d78-a439-4ecff654ef3d", "value": 2995176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619394, "uuid": "eeb64539-2531-409e-9e4b-640e1df54805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619394, "uuid": "505d8070-1ec4-4b69-b176-9b04916393f0", "value": "81409f4cbbe4e2467a3f3a6e9e9665aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82452557-9477-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645600154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600154, "uuid": "077397d8-31a6-4061-99a1-500dc58c6cd9", "comment": "Malware payload (Mirai)", "value": "18c2adc98c16e9ad635068445f88bf21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600154, "uuid": "b7195b55-c45b-4154-b56c-685ac63fbc4e", "comment": "Malware payload (Mirai)", "value": "05a961e75b2fc837cc844905df6f4f26c1b1c0c492c063d1dcb6123eb2aa35f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600154, "uuid": "8cf06e3f-0d50-4417-ab67-6ab3856a7385", "comment": "Malware payload (Mirai)", "value": "27a6d704825bf1e4b65336a07f66b3d902b0f256", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600154, "uuid": "8ab5688d-36b5-46bf-ab17-a1cf6bf098b7", "comment": "Malware payload (Mirai)", "value": "5a8e23e0e974aa61e8316f3eb7e3145e05464f8cfdf995d3abcb2388c35813782877a812c0f76851d7bcda72c7ca132a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600154, "uuid": "0b627c93-d46d-4ceb-9263-bccaf2f01b02", "value": "T1B9B2E070F6DC8ED5EDA7B73A19E081C537E0BBA9B71A44C66A06EF64D626B304044CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600154, "uuid": "17501f50-2a65-4572-8b08-390bc095f885", "value": "384:CiBp4/P4BvyXKlBovwq9tagujiZbHGLHWrtp30yFJUJNVymX9f1noHucgM4uVcqX:rBu/P4Z/lBZqdRTWHYt50yPUJNV19G3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600154, "uuid": "2da2c069-bd20-4f96-b569-90e2ae0c0917", "value": 24136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600154, "uuid": "1665dd8a-ca03-4334-bccf-ccebaa077dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600154, "uuid": "e38c41e7-460a-4a12-8c69-db93a089657d", "value": "18c2adc98c16e9ad635068445f88bf21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39797f3-94af-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645624396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624396, "uuid": "38c8167e-08da-425e-88b4-5ea263a16b0f", "comment": "Malware payload (Loki)", "value": "80c3706fa6fa95f7b03cf58de7680391", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624396, "uuid": "b0c96e03-4ad8-47e6-80a7-e7e144cd094d", "comment": "Malware payload (Loki)", "value": "05e9a8f33a8a378d7d2232155b1e41835293f7afcb007d18c9fcc001f61944a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624396, "uuid": "250b0bb4-1ae5-4c77-808d-72d839862abb", "comment": "Malware payload (Loki)", "value": "9ce5a48d90056d4d1af4c82c152bfeed7cf78041", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624396, "uuid": "2c7fd238-a716-4218-996a-fad96739c893", "comment": "Malware payload (Loki)", "value": "ca029472272372a95fe222cd59838d4681c38a29c9666f8f419c00caf59d2186d2416ce0f1c3cda4fdd4c8ad3d4c00e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624396, "uuid": "b8adcad8-4b7c-4efe-aca7-7cae1e4d1b7c", "value": "T11B549D10BB90C035E0B712F8457AD3ADA53EBEB15B2561CB62E46BEA1A347E4DC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624396, "uuid": "8ba96c5d-8d1b-4a8d-b793-0bf0aa7ad86a", "value": "ccd6a4e90a04c24d49f4949717a298d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624396, "uuid": "4dbbb6fd-a6fc-45c1-821a-a1b38a5418f0", "value": "6144:Ju+GAWANC+AWHXk969It5T40kE8wXspJ0KQhqyqz0YnK:0KWAk+R3k969It9kt9QhcPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624396, "uuid": "12e7ce91-14c2-470c-9d9f-78f167457531", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624396, "uuid": "1abfad98-7b3c-4fc4-bd50-b550162766bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624396, "uuid": "33e44dc3-2f41-48a7-bec4-6e572a4acf8a", "value": "80c3706fa6fa95f7b03cf58de7680391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083820b9-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645624431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624431, "uuid": "5038fd7c-61d5-41cd-ae76-bcddbd7b0d8f", "comment": "Malware payload (Formbook)", "value": "7bd21769b4e95e74146168a3148c636c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624431, "uuid": "81c01414-e14f-464b-ae23-076584726f48", "comment": "Malware payload (Formbook)", "value": "070264132f92fc5cb01521385e73bf36954d4093da205c59821e844abed68b5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624431, "uuid": "b84ef539-a779-4c94-b6f6-e0eab8f5f7ad", "comment": "Malware payload (Formbook)", "value": "a48bd656c3f69bf08a4c3c445b446e28828120f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624431, "uuid": "7f1aee91-15eb-4d02-923c-b6e260a73e2f", "comment": "Malware payload (Formbook)", "value": "89cd7566a84689300aed3bac66717b20e993ea6ffb01f9b15e73fda478ae038aa557c334edba82e55750721c085197a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624431, "uuid": "d6c3f572-b603-41f5-b797-63e03a72c364", "value": "T1C2F4CF0439AB5F3DF1B58BB11DC1ECB4BA98FB232C08B3BD74516686C6A1B408953776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624431, "uuid": "aabc4945-13a9-4072-9058-bf03e8398538", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624431, "uuid": "6b6360bb-29ac-467a-a245-78dd0baa871d", "value": "12288:JW0CvYvoah7jYK777777777777p30iJJVto5U3tEEf1YvbOplfMjb43TE/DxdM1r:4K777777777777p2U3+OphMH4kDofFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624431, "uuid": "50c79cbe-6d95-496b-9891-81c3caddd3c6", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624431, "uuid": "39bc6be6-7376-4944-848e-fb03b01eae85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624431, "uuid": "162926f3-abe0-4d1f-b89c-e7e9d8771858", "value": "7bd21769b4e95e74146168a3148c636c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44a7006-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645619539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619539, "uuid": "bc3559c4-350c-4b82-90ac-77e0af0f7f78", "comment": "Malware payload (AgentTesla)", "value": "c25d5005dcca75325dcc03b2643f6330", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619539, "uuid": "f9d55f33-b2b2-4b5b-a1ff-36f8917bd3fb", "comment": "Malware payload (AgentTesla)", "value": "0703de1e7a681eeac51ea409b707c66a2494735fe462e6aabc07972b556056f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619539, "uuid": "b4fe34b9-ee30-4c52-a0b7-0a106f8653c0", "comment": "Malware payload (AgentTesla)", "value": "826f4d0a0c8070b44864b96759fd10fe22b56d74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619539, "uuid": "49f7885f-34eb-498c-9029-37c9ba6c4bef", "comment": "Malware payload (AgentTesla)", "value": "b5584424136b401a4a92a509f04b276539df82a447ff1ddd326c49f25beb2a716c4f6f2c3a47f249862e25cb1181c27a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619539, "uuid": "26f1cc1e-0809-4cb2-8640-3e1216c0e57b", "value": "T19415C00829AB0F3DE5B18BB219C4ECA0BA59EE331C09B37D74517E47E671B848943677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619539, "uuid": "00ee6f22-5142-48cf-8bbb-0f076f66db55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619539, "uuid": "f7b7e5ed-00db-4403-ba24-0c1fdd7d38c3", "value": "24576:2K7777777777773DThp9OzWcMKdppvx+JUztb1r:D7777777777773b9OzxXpGSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619539, "uuid": "6e92fe95-b401-4465-8110-6afce1ab9f0a", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619539, "uuid": "e14e7180-afd7-42ec-b990-462d4e162997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619539, "uuid": "fd16132c-e4a2-4e11-a5f4-a98bce65d494", "value": "c25d5005dcca75325dcc03b2643f6330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93c00f2-94ce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645637693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637693, "uuid": "d4785a57-18ef-4222-8880-ad0bd33fe7a0", "comment": "Malware payload", "value": "7d52edf9d6aa433b0d8840d8da7cd8cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637693, "uuid": "386e7da0-9c67-4bdf-bbf8-19d7e2d30174", "comment": "Malware payload", "value": "0732f65d5b3ee1346b398b0d796eca463c0910fd2b7dc38d8467a2567030faaf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637693, "uuid": "f405bf6c-b6f7-4679-af6b-a4e413bb15a8", "comment": "Malware payload", "value": "ebff6cb4ef27746461d4010ab25a5976c1d36099", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637693, "uuid": "f0a6a58d-bccf-4dba-a55c-9dad9c210184", "comment": "Malware payload", "value": "6e4c61abd245d3d62b854c8b14c3d8eb4f8d8c919dc980a9bf385a1694669f9c16a937a72e878e768c717d7bf915cc3c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637693, "uuid": "e624ebda-6c87-45b5-aa44-1ab2dbae7390", "value": "T1F7748D02F6D2C079C68E11B12E16A75A72F9AB510B39C9C3F7C8DA2F5E356D1E13A350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637693, "uuid": "d303a9ed-3ec5-4351-a5ac-d912abd384a1", "value": "6144:eoz9gvpBvML7M4xwaCxMEV1DxEN/s4tb5fYoR75VhMRmA3z:eEETvW7M4xbC9V1Fj4ttR5bMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645637693, "uuid": "07903d7a-2c79-4636-b4fa-70f99608fab3", "value": 343598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645637693, "uuid": "695621b0-8f04-4d09-b674-7dc17ba45964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637693, "uuid": "6ac99580-005b-4506-a39f-dcac621efe6b", "value": "emotet_exe_e4_0732f65d5b3ee1346b398b0d796eca463c0910fd2b7dc38d8467a2567030faaf_2022-02-23__173447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980fddc4-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645611358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611358, "uuid": "51d34992-9920-40f8-9bda-8832a1c56340", "comment": "Malware payload (Formbook)", "value": "8b66f63584a27de7aff05add1af04865", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611358, "uuid": "3a855684-eccb-4943-831e-4fa52a24be00", "comment": "Malware payload (Formbook)", "value": "07440b7e4624bac70db5015389bf051e6f1e2ba86dd69b055139cf52845daf71", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611358, "uuid": "b073931d-814e-40d4-a457-d8b5ef7cc6ac", "comment": "Malware payload (Formbook)", "value": "6b72d63d77774ae9a4eb9bcfa2754d9b7f7c7f1f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611358, "uuid": "3f1427f7-d321-417c-b5f0-3f5ba499a30a", "comment": "Malware payload (Formbook)", "value": "68e5ef01990febb1e364acd7403edf5f0d13adabe1ec84f03d701081e48494ad034612bfb6efffacdffb13987f51dd3b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611358, "uuid": "a30b3d8f-3862-49cc-ac48-9975e4b22015", "value": "T1981412772F955D98F9F20AFA949665493EB1EE9ED2E4C103100132EF067AADDF1304B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611358, "uuid": "521b0a0b-ed2b-4e34-83ba-722c0c131ad3", "value": "3072:jY7XP0vAL4R5d3zNUqgodyUyT1VtdiPZq3BpN/U3j7GQThiYmLI9r7dkLFuSiDK:MLP2AL4RBUqjZyT15PTJU3jBtZm01RWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611358, "uuid": "fec1f176-7047-4317-9f68-d18a6b39fefc", "value": 191160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611358, "uuid": "045a6229-8f6f-4b03-93df-88d2f0395159", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611358, "uuid": "44eceb18-fc89-427a-9ab8-d795d3cb0e83", "value": "Fax_KM_C28721111709030.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40339ea3-949c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645615935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615935, "uuid": "1750cea1-b2b2-439b-8b41-89922e5c7f55", "comment": "Malware payload (AgentTesla)", "value": "eea4c283de6b2e6952c921fa95c37ead", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615935, "uuid": "0fa876a2-ca08-4375-88d1-588715dafb8f", "comment": "Malware payload (AgentTesla)", "value": "07c2c2d2751f4fcd404bb9e7d039ee30b379f2979ba43572b463a7f54f6a1478", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615935, "uuid": "9c6df644-ecc3-442d-b4dd-cdb79aeea137", "comment": "Malware payload (AgentTesla)", "value": "49c87aa0fc04e7253ba792f5ad8abc02280c670d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615935, "uuid": "ffbccacf-98c0-43cd-ae63-ec6ffe35f3f2", "comment": "Malware payload (AgentTesla)", "value": "68f6328029e8c01f100c64bf59b16be699a3d065f350446f51a4829e39135d0bc6d01295d4db60b8e90f18a059eb1c6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615935, "uuid": "0ccfa87c-54e7-4e3d-a0e6-56a2de58e039", "value": "T16A14021E3B5158F8E1B3A4B2163CC35D6349BC935836C5B82C63BFA99B3391A5C61339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615935, "uuid": "9609edc2-0fc5-46c9-a340-4931d939fe9e", "value": "3072:kztOHVMHelKXL7355hcHoFd2WT8jAB9JfGqs7DCoyA/JfF1XLAJ43BAHko:Wt0yH0KXfhvzjgABnfnsPCod/JfF1XLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615935, "uuid": "69542ccd-9163-46cc-8078-e10056bee287", "value": 191880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615935, "uuid": "bdfc655f-9b04-45f4-89ae-82b9057f3e78", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615935, "uuid": "bfb47977-1166-4910-ae9e-a9448eeb2053", "value": "New Order PO 19917.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a69d8b7-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645610932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610932, "uuid": "b3e6b707-05de-4a7f-845e-5b546aec250e", "comment": "Malware payload (Loki)", "value": "d5cc89031899c4a8a6083f9a330b9182", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610932, "uuid": "74fcdb35-b160-429c-9127-3461707724a3", "comment": "Malware payload (Loki)", "value": "07d5c00953c32f710eb06e1836ad154018ed96bfaa7397a3acf78d6b7306898e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610932, "uuid": "ffb52778-833e-40a6-ad4d-5019b8d2b719", "comment": "Malware payload (Loki)", "value": "ced52fa4c54c5d5bed8333a2745e13cfd8b82298", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610932, "uuid": "029321a4-951b-4365-92b2-f7ed875b3044", "comment": "Malware payload (Loki)", "value": "ceabdfe6b535fc8f18fb57d17cad0358a3fd2a3b58fd41a6eb98b2857d2effdecf7562b85c41baedfcc532b43952d80b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610932, "uuid": "7720c9f0-41bc-4c3c-a9e9-a9cd8ece0b10", "value": "T1E514120FEC6EED08DA760A75AEF2B72B725DDC1E783180503A5238EE5D7167548EC260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610932, "uuid": "c685a3ee-7a57-4265-aa06-902aec74e4ed", "value": "3072:m0Wlzk/hh7HJpXF8I5NvWErZC0mCIPO1gpXIqURZYFPv/nGj5bb1KjK8:kzoT7ppDNTrg8OBU3e05f1EK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610932, "uuid": "df3df58b-e4c5-4567-a7b9-9f25121fc3fa", "value": 190408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610932, "uuid": "a64bd48a-40ea-4ec8-a5b6-cea9f6d725c6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610932, "uuid": "2b49273c-92d4-4538-a971-54d8355e7a19", "value": "RFQ \u2013 022322.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc783d95-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645624760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624760, "uuid": "8198802c-0dca-4e71-912f-257fe0f2f96e", "comment": "Malware payload (Loki)", "value": "dab91c6fa81cb100d171fc3f9483249b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624760, "uuid": "aa2e52d5-c72e-4814-ba75-b7697e9798b4", "comment": "Malware payload (Loki)", "value": "07e147c939569b3ef7b4cde44a89f9a8f9fab4dbeb6c3943d430c127d88cce96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624760, "uuid": "df330663-1ddd-4d6a-a9ae-cc86ece0e0aa", "comment": "Malware payload (Loki)", "value": "a90f3e90542b902023c07221281599a9cdcff9e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624760, "uuid": "1e3bbb00-a3a2-40eb-8ca9-5a3565b2b4ea", "comment": "Malware payload (Loki)", "value": "9c1a3a260c79eb7dc063c0a2b9fe312217c2fa3b3426fa3470388b140ce5e280ffe4cff374557dce81a0b3c944c7a97b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624760, "uuid": "5ee7546e-80b4-4c8a-90d5-a37eb94ad3f5", "value": "T19464120E38E18167D08504345FB7A93ECB7BD3EA0232508FD7865FAEBB651B2D4256C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624760, "uuid": "df5a9f66-6bdf-4b40-bcfa-287cf96070ef", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624760, "uuid": "1ee482ea-371b-4c98-8e9a-f546775b4094", "value": "6144:TxDJiRECcJXk54GYBvzb5+sC+9Hrn/+yIajnHL6zGnyN2:nCSkJYVxCErZnHLryY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624760, "uuid": "ff247101-ae55-4840-9134-b2d99f50482d", "value": 312668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624760, "uuid": "45586529-d8d5-4e67-9857-eb5567e43c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624760, "uuid": "665b9a26-cd14-4a1e-af76-3dd0dc68306a", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6cf675-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620306, "uuid": "01c22651-a330-42d3-bb69-a2cb83696150", "comment": "Malware payload (Heodo)", "value": "df49b673de5693ebbb4eb179744c9c44", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620306, "uuid": "99010b2e-c5e7-4415-b5b0-4dfdd507c664", "comment": "Malware payload (Heodo)", "value": "07f0487c73ddc911bad7d4d0f593d6d5305a7cf5885c9ba3723626e40056c9f0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620306, "uuid": "79f3aea5-4b58-4672-987e-b8028a88836d", "comment": "Malware payload (Heodo)", "value": "8849a2ad34ebf22c36b7ec3223af8a9270fe52fe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620306, "uuid": "348ad3dc-8603-4649-aeb1-f69e2deea2aa", "comment": "Malware payload (Heodo)", "value": "f83a7ace83a75b33d5cdddeaa2b0a3407266f6e6b53adac591d0b87abe07af875efdf31ddfcd2be04cfccb58c5494adc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620306, "uuid": "bc5e4cda-b298-496d-9f5d-30b7e851227c", "value": "T10A24AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620306, "uuid": "e0119157-afd7-46a8-8f6b-b090995e2c5a", "value": "6144:WMyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:NyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620306, "uuid": "4f26776c-8e0e-4efc-989c-f184a393f095", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620306, "uuid": "d27f19c1-9c1b-4c7b-8107-aa507c055649", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620306, "uuid": "dd711674-ef37-405b-b4c4-0313522d1d44", "value": "imedpub.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a6189b-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1645630124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630124, "uuid": "a8dd1226-3715-4f96-b79b-2a0fcc72378f", "comment": "Malware payload (RaccoonStealer)", "value": "310a2b89168904f4976dc2505762c3af", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630124, "uuid": "9e744306-1327-4654-a6f4-c798b5fdfd91", "comment": "Malware payload (RaccoonStealer)", "value": "0838b673be73014ff6e29d784247ad3b44a794dd2134301bb25c8dd0a3f5b0ae", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630124, "uuid": "11530641-c409-4bad-b70a-5ce55f5b8597", "comment": "Malware payload (RaccoonStealer)", "value": "280c07c3157e28d3c0b2b452815b30191a367181", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630124, "uuid": "cadf2e41-6fcb-4fd8-95f0-b0603e8e5710", "comment": "Malware payload (RaccoonStealer)", "value": "42e63258aa88fd9689efe5b264d2c17a8a9fdaf32f4944c8afe03acbcb930d6dbe95fb5a8cc4b24ab087ef1ce6dc4b3c", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630124, "uuid": "7d7c8bd3-92a8-4005-81c0-dbb2b12bd215", "value": "T10CC48E57F7DBFAB0E6BE827A86F1851C527774620260A78F664072886D23392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630124, "uuid": "720514c8-c2f6-4584-b029-838c63b9a828", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630124, "uuid": "148493d7-fe8f-4e3e-959b-146d8c8593cf", "value": "12288:Qn/zDvGHAykH8vLW/4+8bzbBSreMdHBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqw:CzbGHAzHKjX1IBY4ZyrE7K3yl8PeVoo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630124, "uuid": "edbacbc3-198f-4e89-ad42-1642738befff", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630124, "uuid": "d602f3f3-3574-4436-b580-c71e28d683bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630124, "uuid": "70d62274-a60b-4eb6-997c-5b68e6f07440", "value": "Scan2022-02-18_132844-64.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e6a314-94a7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620622, "uuid": "a2ef9091-613a-41af-a411-4f699938e90e", "comment": "Malware payload (Heodo)", "value": "f5e7d2c7e4568efb55d999bfd3e5e0ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620622, "uuid": "6ba96550-d7f3-4f30-9378-e2be48f0adc5", "comment": "Malware payload (Heodo)", "value": "089abcc8f91b6bdf7cfe98e38168209957d97115a597fe14f44545c7636d8052", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620622, "uuid": "0788941f-04b6-49d7-8ac6-2019bc1ecfc3", "comment": "Malware payload (Heodo)", "value": "587f8e5baf0b345957b5f45cd6d8f8b17238f46d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620622, "uuid": "eecd755e-9b19-4544-bbc6-4f17ac8a038e", "comment": "Malware payload (Heodo)", "value": "7a1521dc4550f50aa3bf5ee8e405951069a923e7f3fcae933566dba1ec1e64290884165642050dbc53851949f7188e02", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620622, "uuid": "569d1d33-6d2d-481a-86fe-cc96d89c1638", "value": "T14A448D56B7C581B7E6D724B24A21722F73F2EB2807379AC357D01E04AA785E78738247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620622, "uuid": "2b5fa279-e398-4855-902a-6ad75090e098", "value": "6144:O42gtjrkcDk2KDn4J/+CHL0h+vWLEdxSrelS3DXoan0JFc:hxhQ0pWageSXJ0JFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620622, "uuid": "3bec9900-df84-4531-85c9-fda79f7b74ea", "value": 278078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620622, "uuid": "fce03ce5-5849-4cba-a4d0-6e69e1babec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620622, "uuid": "29d76f0d-c47e-48ac-968d-2d28d82c6e31", "value": "emotet_exe_e4_089abcc8f91b6bdf7cfe98e38168209957d97115a597fe14f44545c7636d8052_2022-02-23__125017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fae843-9488-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645607648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607648, "uuid": "760ebc9a-768d-4330-994b-ec47e559c483", "comment": "Malware payload (Heodo)", "value": "93d0e09439c48676befc53fa073ca3cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607648, "uuid": "9bc2415a-3e5d-4180-bcc9-f4ab6e94df52", "comment": "Malware payload (Heodo)", "value": "092aceefc6f3365c2e05551256796c9e0cae5799e7b2792872bb1cccf838b975", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607648, "uuid": "4e96b47f-ede1-4af9-8156-907d42cd538e", "comment": "Malware payload (Heodo)", "value": "84c3267d6c5a3ede435f61d775803bbe5a986670", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607648, "uuid": "2d27387c-6013-4130-8d78-af601d259621", "comment": "Malware payload (Heodo)", "value": "2307211e16d31d1c4dd7f0ea68e6419feb32127eb41626cdab4be144b7ee79e60ef13a7d371681baf2a2012ef07690e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607648, "uuid": "1be704e9-7fd0-4b82-886e-c8d2ff9b252c", "value": "T1AC35AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607648, "uuid": "4ceb8c2b-6ba7-49f6-b06b-692129f8a6e7", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607648, "uuid": "893d793c-139b-46af-adfc-07ba0a74d705", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdN3TEMJdHuN3LafJSrN:hDQhXJ1Td2CpdN3T/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645607648, "uuid": "3bb2690a-71d2-4512-9712-70acc4853fcb", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645607648, "uuid": "ce1c25c3-dd63-4db2-8a94-301d10720287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607648, "uuid": "6d241a9d-ef27-4f3b-9995-cfcaaccedc08", "value": "O2M6gFtHIkmn1DxwF.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8ab636-94fd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645657615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657615, "uuid": "fbf77002-af98-4ab8-a68b-dd428651d5ef", "comment": "Malware payload (RedLineStealer)", "value": "f9d5b194c4658e14dec775bf315cda84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657615, "uuid": "e16156ec-0752-42c1-8525-266e403d38e7", "comment": "Malware payload (RedLineStealer)", "value": "0934128a7f51c074eeba05be2f0cfc99a1968d703c1780ed00a2f64c5d7c4a91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657615, "uuid": "84a80486-b4bf-46b4-ad5c-b17279fac0ab", "comment": "Malware payload (RedLineStealer)", "value": "9d7ed52e48e62f7cdfeb2571ae01db4e27e21e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657615, "uuid": "6adc3bda-4ad8-48f6-8fc5-905295d03027", "comment": "Malware payload (RedLineStealer)", "value": "881054b3937930479db43c3b0ddab5471054910d278eb99e8481b4bea8202acb72d0758e2628318af9bd5fecb2028864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657615, "uuid": "6a21fab8-9676-49df-99cd-d8519bf76f1f", "value": "T16CD3C6436A049B05CAAC343A83FF293C63E6F5CB17B1495EDF0076B71CC52A6A9CD646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657615, "uuid": "449928fe-20ca-4d0a-8b20-9bcdcff3bdcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657615, "uuid": "3ae0ed36-cf17-4ac1-9923-f671a6c12b9e", "value": "1536:4MZQZqvH2YszEgKh3OHeOVM0SAb8A4VZKfO1+9RBz7rBQbzdbN2LFDufCnEy:4Uv4e1Ab8zBc9RBTOXdbcRDQMEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645657615, "uuid": "2c5c7df4-3b36-4ffb-a98d-6546d3773a4a", "value": 133280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645657615, "uuid": "19dbbf62-bc41-4d2f-9936-c6495f4893a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657615, "uuid": "6f7fcdfe-0f1c-4020-a9db-1237b304dde6", "value": "f9d5b194c4658e14dec775bf315cda84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30b7a74-949c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645616181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616181, "uuid": "7d469613-1451-42b1-8642-a5c973905230", "comment": "Malware payload", "value": "8cf8a1a0c89ec221f0c9b9d7ac611efa", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616181, "uuid": "1fcbdbce-339c-4ebd-b163-08981f1a11d7", "comment": "Malware payload", "value": "094dfa15dcc49cf2c2cc2f460e1d31ac4ac2a0f3e2c505662dcb08eef937b320", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616181, "uuid": "885f9521-1ea4-47a2-9c34-e29bb4ca9cf5", "comment": "Malware payload", "value": "cafb30ffb90f10f12f28426dcf491a95f2622743", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616181, "uuid": "74ca8961-3e7d-4b0e-a8e6-2bd653125b41", "comment": "Malware payload", "value": "803e138f5358f3e69feee069845814fc4bc64f4681c35cb3e2ecd3bbce7e6ae22e380e0d6c11ca239c92352741a5af46", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616181, "uuid": "98406457-1c1a-4583-aa7e-5040ab492707", "value": "T1AF23CF28C542565BC6631A3ED07994E219578C17A11444CFE4EE7A8F07A8ECB3B8F7CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616181, "uuid": "7717999c-a04f-4336-8fba-67f68c919b6c", "value": "768:n+YERD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnu:n+JJqHt7NJECQFfqAfuxO/DNB1/K8NyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616181, "uuid": "71e090dc-9afa-48f9-bed8-7b454e564462", "value": 48016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616181, "uuid": "bbba0ddb-9727-47a4-8ae6-e5486bf12d9c", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616181, "uuid": "a5caa029-8d75-443b-af24-8b92902c6241", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812fcd1f-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645610461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610461, "uuid": "b2d54363-6c33-498b-9940-0d38030afc07", "comment": "Malware payload (SnakeKeylogger)", "value": "c3e05dec34d7e1120f9ea77a27630366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610461, "uuid": "96b66994-6c03-4786-b995-526397a32bf5", "comment": "Malware payload (SnakeKeylogger)", "value": "09d389e90c44a7191e493abd4e14b20bd1945307da55ae1a0cc98b02001afb23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610461, "uuid": "e3d7c61a-5596-4a13-bbe5-ee19b258a177", "comment": "Malware payload (SnakeKeylogger)", "value": "3b2fdfaebc3cb3a2e2b2b880391344e60cc5f41d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610461, "uuid": "f528cd20-282a-4f68-ae55-746353773960", "comment": "Malware payload (SnakeKeylogger)", "value": "bbacda244e150b0856150ce3e1913e07b3998e979234c7b2c95981d34e040418f39cc1640f6010baf491479b6effac79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610461, "uuid": "7a8f2ab5-c474-4145-ae93-2d1752e6751b", "value": "T19D057C47B9DF0FBEE5708A720AF4DCF2BA59EA231D24637C78D0624DC66175848422F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610461, "uuid": "3b026f37-ff85-4816-bc19-2e6503df52ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610461, "uuid": "7959e204-64b1-4fea-81e2-314a80636b23", "value": "24576:KK777777777777jNmGRc/VcDWl2/aXJEFovw3250eSEDa:f777777777777QGOcWxty250eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610461, "uuid": "384309ec-1a58-42b2-83e3-7fc3a3265b73", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610461, "uuid": "099fca15-43d4-4e42-8afa-7025b1d63fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610461, "uuid": "498186be-76c2-4d72-881b-3894dab02ff2", "value": "Halkbank_Ekstre_20222501_073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e51f20a-94ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628817, "uuid": "84895077-a9be-4e06-acf3-3311488a1682", "comment": "Malware payload (Heodo)", "value": "fc354b05915dc44935bb8cd1f6af20dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628817, "uuid": "821349fc-7997-4762-891a-9c913b2c50bb", "comment": "Malware payload (Heodo)", "value": "09e17e06a69a22b08558066a92b2747102a9423d375d03c51a00b54a1a1dc7aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628817, "uuid": "7a2d527c-af84-4651-a9c9-e0438700a5a6", "comment": "Malware payload (Heodo)", "value": "18ea61a17896e24108812bc006692a96e8ecb06a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628817, "uuid": "239f6a40-388c-4640-95b3-fd25bd4ef068", "comment": "Malware payload (Heodo)", "value": "5fb666aeb95e22ac0f2eb3575082168aef7e6b505e049decda11f2bf745bddfe98da9fe24e20c3167081b0f18f356155", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628817, "uuid": "1ed8a491-51e4-4ff6-9ab7-913e98629374", "value": "T19035BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628817, "uuid": "befda34d-e221-46fb-afb4-9cd032a8b1bb", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628817, "uuid": "d0b51e79-056d-4074-a7e4-889eda3aaa62", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/YTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/YTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628817, "uuid": "7c526e7d-7f79-4a2e-9e50-a0011885e6bd", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628817, "uuid": "fa463510-2edd-40fe-967f-9b71f027117d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628817, "uuid": "866fed9e-4a31-4357-a527-47ffdda0385e", "value": "fc354b05915dc44935bb8cd1f6af20dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bcc7a2-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645610597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610597, "uuid": "f605746a-7654-486c-bac0-db7e1515c97c", "comment": "Malware payload (Heodo)", "value": "5b0e8296329d28594005df386b03b622", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610597, "uuid": "996bf140-0715-42d5-8d9d-6827cc7711ab", "comment": "Malware payload (Heodo)", "value": "0a334271955f9072ed01d8f9d4ef9e5d0604be3768b6292cc2e7b8229261d89e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610597, "uuid": "0b9a2ed4-4c0e-4235-90e9-d70ce3cca2d8", "comment": "Malware payload (Heodo)", "value": "5e32612e0149f7b427d7b5e99f1ecaaba4e1fa63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610597, "uuid": "88a9a671-e3ae-4044-a2b0-99e95bdb6c52", "comment": "Malware payload (Heodo)", "value": "5abe184ff6fa2be8f10ef200caa1fe7456712380f3ecdba73c7be2e1791daaf32dec2b06c4df69e17bec6a3464808e0d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610597, "uuid": "d37492b5-37a8-4269-9828-68ad916a4153", "value": "T1F435AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610597, "uuid": "3149e30d-d5e3-43a9-9bcd-7e46628b7ace", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610597, "uuid": "5f7e8b89-a489-40e2-a979-c730c2d0b015", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNNTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNNT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610597, "uuid": "49382e7e-901e-401e-a5ce-3e5ce6af8b84", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610597, "uuid": "a9f219d5-8db2-4317-8981-c16dc2a116e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610597, "uuid": "d49e5b27-ac80-46b6-85a0-805dd934b4f0", "value": "5b0e8296329d28594005df386b03b622.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2597aeae-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645630064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630064, "uuid": "ee0cb434-78e1-46db-9164-a7216626bea0", "comment": "Malware payload", "value": "297f2a6c25b4c13f447ee0b502c92307", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630064, "uuid": "2e3feeee-a098-47a9-a6d1-75a310b70243", "comment": "Malware payload", "value": "0a54a8d984829ac82911e3cc3fe5c98e0698f9447692aba551fbb4aceaad2bd8", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630064, "uuid": "58a17ec5-3914-4241-b664-0cc36eaae89c", "comment": "Malware payload", "value": "cdf1ba55cc3f219bc96bb1da96c1f40332cb54b1", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630064, "uuid": "cc08aa71-4368-4495-9380-bd7a6397f832", "comment": "Malware payload", "value": "a64fab342fdf300b5fcbae3b5acb4f3ab08e8cc5292860a2eb13b3fbc156100932b4f24704e97a12e16e5e71486e94bd", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630064, "uuid": "9b7c30c8-aee9-4edb-b503-bc88df419c45", "value": "T13A1412A076D8A25CE86135FD3EAD325428ECCFE673284D42F2D73E4D5B768890A5F940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630064, "uuid": "a743b84a-0532-4427-8c6e-5f2199ba19bc", "value": "3072:WRc03aCUPxf3ESyvYdJgmRkpdtYBDmCE65JXTeo+1oI9alcDn43UhJ1ukZHHhoae:/0qjZcRRmRSK5Jeo+uIycD4EkkhBoHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630064, "uuid": "35d30573-d161-4120-9362-2cd13e56a6d5", "value": 190680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630064, "uuid": "0bf507c1-a136-4424-94b3-c7f3bfcdbbb3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630064, "uuid": "62d4d167-9dda-4c68-9d62-5b5595819fa0", "value": "Justi_41859345673267.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782500c6-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574797, "uuid": "c78d46c7-ced1-426a-9b19-6e4a90e09be9", "comment": "Malware payload (Heodo)", "value": "cc953bc20f77851c5bb71b21c368d433", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574797, "uuid": "4177f5ac-a701-489c-9aca-368b0d16f82e", "comment": "Malware payload (Heodo)", "value": "0a6cc07cc95a950b578c410624775ee30347947f1972a1e415b394ffbd022779", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574797, "uuid": "9c66b475-c7e9-433f-9917-8faa06350f7d", "comment": "Malware payload (Heodo)", "value": "a8c006abec1a6adc1d1aad154a650811e4b7dc1e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574797, "uuid": "2b81d58b-5838-45ef-bbd6-d0121f2d7f85", "comment": "Malware payload (Heodo)", "value": "65e9db51d365ed8d4801aef77a7942fbe7a34410e1d978f0b440368b8726c9635b61a15424a7790bef23247abfa442fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574797, "uuid": "6edbcd22-43da-4bd2-9054-a19d1a0ceda7", "value": "T1FFB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574797, "uuid": "f8737e46-e3d0-4f07-879b-261d09a49f89", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574797, "uuid": "cc7a551d-cdcf-436b-8a90-1f4f9c211309", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wfIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWwzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574797, "uuid": "93c51ddd-b39a-486e-845a-2ed61b62d3f7", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574797, "uuid": "a0205ed2-ac54-4dc7-aff6-3b570ecae72c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574797, "uuid": "b2e293c4-8391-4d0e-91e7-d41e75e2347c", "value": "emotet_exe_e5_0a6cc07cc95a950b578c410624775ee30347947f1972a1e415b394ffbd022779_2022-02-23__000632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61289cee-94c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633170, "uuid": "7cfde28d-9794-4bc5-9e54-dd1cc27304d1", "comment": "Malware payload (Mirai)", "value": "81d97e9aafa03754ced1c17481a8f696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633170, "uuid": "0f5de9e8-4bff-4d9c-9c5c-b3d592926e40", "comment": "Malware payload (Mirai)", "value": "0ab7592e76a84ef19e4e17bd1fc31e6b2571abac3711f7b8b08bd9b74e56594e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633170, "uuid": "ec582785-1f94-48dc-8bd6-6a2029df34cc", "comment": "Malware payload (Mirai)", "value": "435ca68c66858c3298e109cdc8e2cc9f9c828f92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633170, "uuid": "863d732d-62c9-4545-a94e-071f7ab44c30", "comment": "Malware payload (Mirai)", "value": "8ba77f97a2a7df109abe699d58f3fd6795247f40d668e09c65c0b22090b30270f3ec5b623953c08d1e147ad8bc751a13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633170, "uuid": "429a90b3-0310-4da7-9757-31739d98463f", "value": "T1B5633ACCB183E8F6DC50057E346EAF729EF3E63EA176998BC3E4553B9501202910766E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633170, "uuid": "3fee953f-210e-4dd2-be01-322c1c87bebe", "value": "1536:lm1gZVASriHNJ64LG40WH9SW5/0l6Xt/ruT9zzn/GZ:lm1gvitJ64LG40WH9SW5/0l6Vrux/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633170, "uuid": "5822ffe9-4244-4b91-a294-5f821736d8a0", "value": 71345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633170, "uuid": "7b009924-4f84-4405-95f8-427f6af8c37a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633170, "uuid": "f84ecebd-3a75-411e-8b95-3178f1dfa7d8", "value": "0ab7592e76a84ef19e4e17bd1fc31e6b2571abac3711f7b8b08bd9b74e56594e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc875fb-9478-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645600660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600660, "uuid": "416e168c-354f-4091-9344-77e022f89e8d", "comment": "Malware payload (Mirai)", "value": "df6f72ea312fedde935ad221b03b64b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600660, "uuid": "2be1dbb5-196a-49a9-942b-b140cf220ea6", "comment": "Malware payload (Mirai)", "value": "0b1f8b3a7265e2329f8fb6d88398f9ba6accfaa7932be12c63b15fcc6f4f65b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600660, "uuid": "db2470ef-f0af-403a-8f86-535a8a364769", "comment": "Malware payload (Mirai)", "value": "b62e62c094cce8d96ce6529df191e7dcbbc96099", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600660, "uuid": "368fdc4d-da7a-4543-9083-d032108fb803", "comment": "Malware payload (Mirai)", "value": "0c61b78a58ff7a0f8ace5250ce58a31ee38334dea7e5f2bdfe996ce767a84008ad64bc98fec085614765171576bfc418", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600660, "uuid": "b7cc890a-0b18-46a1-8f67-4b2430a70f43", "value": "T18DB2E1A0EC6138B1C4F12935F8F7D78ABA11126AB48E751657341238DF878E1ABFE503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600660, "uuid": "ca33f70a-1370-4d49-936a-d606cfd394ae", "value": "768:1F5jgF9Tayw/SV4u8dMTCXi1LzvCBhPY3Ub:cdP4D+CXMGFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600660, "uuid": "35622a09-0e34-4723-b267-f87a068fcdef", "value": 24688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600660, "uuid": "ef4b27db-035a-4300-a7fd-30993d3a7b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600660, "uuid": "90ef9241-56fe-4bc8-8436-5bc950ab21a7", "value": "df6f72ea312fedde935ad221b03b64b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee8ab2d-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645622912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622912, "uuid": "7426fa48-5c61-4ab4-b70c-08ada56c7982", "comment": "Malware payload (Heodo)", "value": "1deefc100a084dc8a74a950189fa7342", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622912, "uuid": "e2b0b227-d491-4428-b878-4649bbd6cc98", "comment": "Malware payload (Heodo)", "value": "0b2fc2badf398a09b7d1a1a318dc98b166aa45dff41a4f650d671d6080b7d7f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622912, "uuid": "a3c5bec1-abc6-4b3a-8390-61fd9c665f88", "comment": "Malware payload (Heodo)", "value": "167f6d59f275c8cb1b535a6c42db774db9137da9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622912, "uuid": "c633b963-feab-4171-888e-70c461ca1c30", "comment": "Malware payload (Heodo)", "value": "cc90a02c01dd3a96713c5ea61935a9ee44879c951be29bad90cc5a6b6406904037769af6d5f30d7e0295dbf50101da21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622912, "uuid": "4540b815-ee5b-4c54-9a13-2775af4c9a1c", "value": "T12535AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622912, "uuid": "4cd572b1-c2e7-4ebe-be59-c0ee59cd9058", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622912, "uuid": "ea0f62e4-bd62-4e38-a7f7-f17e7478f187", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNeTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNeT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622912, "uuid": "8e532797-b682-4cb0-a6af-7c2c74272f89", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622912, "uuid": "931fe77f-6394-4a95-858b-e3437aaf2ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622912, "uuid": "d07f1db3-167e-4306-93e3-b9f86dd7d11d", "value": "1deefc100a084dc8a74a950189fa7342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0f8825-94d4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645640305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645640305, "uuid": "4a827e6d-1144-4370-910c-1d42d2b18321", "comment": "Malware payload (SilentBuilder)", "value": "1e1de65c08679ace3a779afa27fda727", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645640305, "uuid": "26a515ad-77dc-4371-8c5c-448f020a0c6b", "comment": "Malware payload (SilentBuilder)", "value": "0b3341eb9ee59cfceaf68614e2d9f00c4818aaeea7152f5a54fc46a38f1a5772", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645640305, "uuid": "73f498c3-e8f9-4ca6-af58-c9e8f76dac32", "comment": "Malware payload (SilentBuilder)", "value": "95aa7b5bdd4bea547b06887014688d098519eee6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645640305, "uuid": "9b8e08d8-f7f2-4d98-bb3b-b3cb4e752c0d", "comment": "Malware payload (SilentBuilder)", "value": "fa3c3544bf2072536995a9c19365e5afe4c465c6b652226cc59b03444c7563f5306f71a2c91d06b8e4e587f64d401513", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645640305, "uuid": "424cd09a-fbe0-47b3-b187-020c04510439", "value": "T1DB44C04AB84A5C35FD45C3BC8983C7CD84E5AD3A6B5B815E4D28332396B3EF416025EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645640305, "uuid": "e8f04b1a-e2e2-49a1-87bf-bd8eddeaa7c0", "value": "6144:EKpbdrHYrMue8q7QPX+5xtFEdi8/dgUThvsiKIjvl5fd1Xh8rsoX/w/0J:UhEXs5fXR8rsNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645640305, "uuid": "cc0b2319-1cf3-4107-9abf-7c8577f1c50a", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645640305, "uuid": "f4e32e0a-c786-4b92-8cde-1d488563d0d4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645640305, "uuid": "4fdb5c76-f75e-4bfb-8c09-cebd5fe9412b", "value": "858X_23022022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f596ee-9486-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645606679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606679, "uuid": "ec2cefbf-dc1c-4c39-b7d6-739d6ab04cc8", "comment": "Malware payload (Heodo)", "value": "663dad019e7719c70209ee5caff50db3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606679, "uuid": "c5d57c1a-00ad-4629-9da6-e0b06842c3e2", "comment": "Malware payload (Heodo)", "value": "0b564ff5c20ebc43cf8606b6428cb4d73d9903969ddd4073a1647dfa28db5d05", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606679, "uuid": "7784d5cd-c65c-4fd6-9df3-40f5f72e3bde", "comment": "Malware payload (Heodo)", "value": "a736029306d4d8ff11b4f14d4b32f2d442431fdd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606679, "uuid": "887744a2-1e34-4bad-ad7f-b45398949f09", "comment": "Malware payload (Heodo)", "value": "85b9e9b4315dfd3b8839e7269bb380d1a211e6fb13150fe95cc07705e399516a0ada4a17d2c70113931aaf76bea828d9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606679, "uuid": "2bfed7cd-5e10-486b-a6b9-43f6fb0ae031", "value": "T10E24AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606679, "uuid": "5ce492bd-420b-4927-b52f-051df076c465", "value": "6144:GMyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:9yrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645606679, "uuid": "942ef630-bc3c-40e0-aee8-1b01f85c99cc", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645606679, "uuid": "0328be1a-b61b-4b92-bba9-46bc622eba0c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606679, "uuid": "1fc2e153-101b-43b7-a555-48c78ec3f6ab", "value": "20220223_52033_003.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874ccd2e-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645622926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622926, "uuid": "bd1321d7-c89d-482b-8314-39442d73e3be", "comment": "Malware payload (Formbook)", "value": "b7f7eb3dcb8576e7d58face98e44cdd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622926, "uuid": "644e4a88-9cf7-4784-82ec-ff0be59e367c", "comment": "Malware payload (Formbook)", "value": "0b7b92e40a75e7c96676e65733f2babfdf0c37529c130619510b2b0b7879a697", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622926, "uuid": "1059dd3c-f26e-423b-9392-f9b1cca03744", "comment": "Malware payload (Formbook)", "value": "9011dd974482601ba804a992a46eee17e223c845", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622926, "uuid": "e495dd42-6039-4b5f-ae9a-4ab544687cb3", "comment": "Malware payload (Formbook)", "value": "42aa2b22fad9108fa4b894b8b4b41a9d0ff4a61a59d27f2f7abd1eabe179416e9b84d9d52ff29e89fca1e729cc530528", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622926, "uuid": "50cdf5ad-af66-4f92-847e-2fddb2e65188", "value": "T12A059E49EB8519C5ECAA627A94F063013370FA749CCF8A0FB5AD587DC5EB3647E601C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622926, "uuid": "21734956-895a-4e1a-917b-3368a09145d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622926, "uuid": "cc9bca29-b84a-4a00-8984-bea309e5c7fb", "value": "12288:fyDENclx88QASlH22qla5w/yXbxY3kB7P/jcRmIks6u8:K8cffYH0MW/Ibxyy3jcRmC6u8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622926, "uuid": "945f1f67-7a2a-41e1-beb9-11f0a725ee27", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622926, "uuid": "0fdbc72b-7b4a-4799-a3f9-91c29655eab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622926, "uuid": "0044d57c-2194-42f0-a3bf-6cc486b59951", "value": "b7f7eb3dcb8576e7d58face98e44cdd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da30d62-9462-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645591100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591100, "uuid": "1021fce8-1386-44bf-bc00-f57bd57e676e", "comment": "Malware payload (Heodo)", "value": "37ad533459875767b019f4270c19a760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591100, "uuid": "59679a59-1bb0-4412-b50a-863dc2e0e9eb", "comment": "Malware payload (Heodo)", "value": "0c199c60267245e04925a49bd2ba3f7041c62de775ae5bcd7ad1618f9aee5857", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591100, "uuid": "4cd05e09-f8d2-44aa-a651-032ddafa1ee4", "comment": "Malware payload (Heodo)", "value": "eefd1ebd5239d8bfd15940bcb19e6ed20142c265", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591100, "uuid": "380045af-a838-4249-a2e1-50e18b2d2fdf", "comment": "Malware payload (Heodo)", "value": "362ce200ef7da75f25ba4a604a093b00ce5cad602c592c93b36a3e3d1f877461b878884d80244262e04d0d198d914944", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591100, "uuid": "0e178cf8-c969-46b2-b1c7-b7aeedf02eca", "value": "T196B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591100, "uuid": "b7cc61a8-a79e-4255-ab32-49181551a6eb", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591100, "uuid": "a4e2c7f1-20a3-4ce6-9d6c-c1ad9d72f0cb", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wGIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWxzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591100, "uuid": "20f91fee-92fe-42ff-a06e-67736c7d86c7", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591100, "uuid": "df0a0335-2125-42ba-a586-e4adb425946b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591100, "uuid": "71efc11b-58c2-48ca-a14f-6d7fac3b988a", "value": "37ad533459875767b019f4270c19a760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b9af10-94ec-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645650390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645650390, "uuid": "3e52b5e1-f3ac-483f-af19-4a4240e30280", "comment": "Malware payload (RedLineStealer)", "value": "f4785e3e8330fabc38910c61c6584a6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645650390, "uuid": "034f9ecd-7770-403a-9294-7a3bf5c7d25d", "comment": "Malware payload (RedLineStealer)", "value": "0cba0f9dafbb15b07c0e8b87ccd3ea7c306198b67dd480c42aa822c0e51ad2e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645650390, "uuid": "ab603ec4-47ec-44b0-8f3c-7270562358db", "comment": "Malware payload (RedLineStealer)", "value": "d536676d3adbdd1399c3d41a68508b6a42651709", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645650390, "uuid": "593a9c2b-1a34-437a-8980-d769c483965d", "comment": "Malware payload (RedLineStealer)", "value": "0a68a71e858d93386f02731eec45835896e81cb78dfb1457ea7a0402a9debd64272e65a466246a33d636e4d1fb70da81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645650390, "uuid": "e16a5e8b-d10e-40db-bd45-61c1a951c0cd", "value": "T10FD36B167AD1C072E66111323A64DBF0896DFD304BA19A9773805BBF4F302F26965F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645650390, "uuid": "f4b37c9f-4c2c-4571-936f-461bb9911915", "value": "bc4b6b8e37d12faf6676bc241503669a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645650390, "uuid": "4bcabcfd-76db-4820-b663-e4d8f6d8685e", "value": "3072:atlP/1sZ0F+fR9OJh1wdcbWU4gaQ3Nu5U0zvTH9/zqZqVQgE:Mh2Wq9OjXj4gt3Nu5UcWoRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645650390, "uuid": "205e1de5-088e-428d-88ce-65ca05e76f25", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645650390, "uuid": "3aa72ac6-6e4c-4bb3-8be1-d6ad377f046b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645650390, "uuid": "e007b4e2-2a54-4a91-9c08-d9b09edf84d6", "value": "0CBA0F9DAFBB15B07C0E8B87CCD3EA7C306198B67DD48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28114a53-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645624484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624484, "uuid": "8e75e520-d289-469e-b558-308f620eb51a", "comment": "Malware payload (Loki)", "value": "23d0ceb0e04e2b29909cb8dd15ac3cbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624484, "uuid": "9b06a22c-e170-4629-9ac5-35f509566fac", "comment": "Malware payload (Loki)", "value": "0cd9de7fee952994367b5dbdf4593be74d0926b262e6ed8bd45d0205923ffc07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624484, "uuid": "97795518-4b97-4796-a382-14680e6c3729", "comment": "Malware payload (Loki)", "value": "194c29bb5b4c65cac1dee5abb8f46af283c686c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624484, "uuid": "8de9dbda-38d5-4535-8f39-779e34e8c637", "comment": "Malware payload (Loki)", "value": "87f6b7acf6c1fc86e1105a58a9aebf3a2001860d470c2fd7ac632483cd2725f46bd6e959e39737665aefe7a7d37ecea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624484, "uuid": "cf8e444b-6b40-467c-9aa5-80bf8c94643b", "value": "T1835423EA19C88477E52B6634687B77EBC732E7243B790BDBB7210F6524026436B007D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624484, "uuid": "86d2672f-eaee-4340-9d42-b18dbd193eba", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624484, "uuid": "a2f9868a-a5a9-4a9e-9e2d-89b16a6ebf7c", "value": "6144:TxDJTR64JJ+3ptX9auLbTwS95fVlaIqcB92oLXlduYZAjZ:164GHD3aIz2o4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624484, "uuid": "c2ebc4d2-9d6f-4162-a86f-1e773abf08d0", "value": 285016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624484, "uuid": "b056ebc7-73b9-4918-8462-32092ed115f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624484, "uuid": "2ac114ed-9bbd-4fec-9f85-e53583b85403", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977000fb-9480-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645604055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604055, "uuid": "a92654ff-d543-4dbb-b3ad-d5322bdde108", "comment": "Malware payload (AgentTesla)", "value": "d0b82e115d1873195aa63ee67cbde3d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604055, "uuid": "e9da47a9-b5be-422e-b61b-52824d362403", "comment": "Malware payload (AgentTesla)", "value": "0e020cb9ae6696c1372107ceacf9268e36edb969ec3cdeceb30c6826c56470f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604055, "uuid": "fcc598b4-f875-4b50-82af-f558f887b27e", "comment": "Malware payload (AgentTesla)", "value": "7ceb2e8a29afcd6798cac915bcdfb6a088695f52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604055, "uuid": "fdd0470f-8e96-4422-ad77-6b6d9e50887b", "comment": "Malware payload (AgentTesla)", "value": "9f053ae75d512cb4dad5b2b78342b903c995e52a7d98c16dffbb807ae28017de0fd3251c3d8145d70d5e3c7e8ed49273", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604055, "uuid": "b3d136bd-0aae-42d4-a1f6-aebf7c20cc89", "value": "T12315BE9D325076DFC957C836DAA81C60EA5038BB930BD203A05326AD9E5DADBDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604055, "uuid": "16b12545-d113-4c31-bc59-d5e6c73f4dc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604055, "uuid": "f49d8899-7fb4-4e98-84a2-d8253f592d84", "value": "24576:BnyTK777777777777zcHGy6AxL3DyQCb+kC6gNEWRkN:Y+777777777777zwjL3Of1BLIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645604055, "uuid": "d337d2c2-26af-4a3a-b060-d1dc279935b3", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645604055, "uuid": "b616c759-7f48-4fd4-bfb2-89e2fd987deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604055, "uuid": "db07d8d1-7dd6-45c8-a4dc-552c087968dd", "value": "Purchase Order 762AHT2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d569c430-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633795, "uuid": "f7f6e4be-439b-4c7e-a9d5-a64a24867b84", "comment": "Malware payload (Mirai)", "value": "22233e57cd029888a311cd70fce59dc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633795, "uuid": "e2528b4d-9d7b-4773-8f77-e5bff6701a3c", "comment": "Malware payload (Mirai)", "value": "0e42dbe5171d2f0ca04c7ef28f2c5a982a19038a4cddbd0b1bb465454d27ba49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633795, "uuid": "265c12fa-18c3-4d7f-9602-50db54d3a371", "comment": "Malware payload (Mirai)", "value": "c53cbf02460a5d0a5edb8afa36880d2ba6120ec0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633795, "uuid": "25ce86c2-f507-497d-bb19-0ccf875bdf9b", "comment": "Malware payload (Mirai)", "value": "65b7166d950daa858745661bdf3b115e60b103472ff7af529ce49d8e1a17c224e0add3d3cf21d5541737a097a6399c64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633795, "uuid": "d5a0dbdd-5a89-4966-b6d0-3b837fd68ae6", "value": "T10B732981B8809A26C7C01777FB5F118E331597DCE1EA72439D155FA9B6CE80F0D2BA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633795, "uuid": "8dca9235-7e14-402c-ad9e-e723f9f5f711", "value": "1536:M0H5bKHSwhkqljtlgxwkVPoTJV9r+N05XgxpJeZWe9IIM5/9j:zVKfhkqlj3gFotw09gxTwz9IfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633795, "uuid": "1b79338a-35ee-4701-a421-c71e9c2062cd", "value": 78840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633795, "uuid": "8f692568-f19f-47fc-aa29-1f03cfa07cc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633795, "uuid": "3825dd48-f13c-443a-90bf-d4f32587c336", "value": "Zeus.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c179b9-9471-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645597691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597691, "uuid": "9cf9d1bd-ac7f-48d9-a8fc-535f3018b9f5", "comment": "Malware payload (Formbook)", "value": "9fed539b0ae589ec279b231f54f9446c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597691, "uuid": "201b570b-6487-4342-9138-92e47c10f40e", "comment": "Malware payload (Formbook)", "value": "0f747089baa42b24b7e45c97b6482f6a5f9f0da859ba0db2d7e366bb8199ca11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597691, "uuid": "05d3afe7-e229-4fc5-95a3-181552a791d1", "comment": "Malware payload (Formbook)", "value": "79958093e3f7a735895d2d738b7026e9aa6c435b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597691, "uuid": "7f0d7fbe-0400-49fe-92c9-e94ff69c65c5", "comment": "Malware payload (Formbook)", "value": "cdec05cd951bdda477180d2bcb3d5f9841cea32bbc86f2de3a0d8a8fd371d6080d5f204033dbbf59bb8ef95762325e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597691, "uuid": "bc760d9f-0b76-44ca-96d4-1747b008e109", "value": "T12064CF5BB1C324DAC8224D3B1D81795EB33BFA1DAA8F267733617B999B35246C841243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597691, "uuid": "ea319422-695c-466a-8cf3-1363d5ecd1e1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597691, "uuid": "0f50a0e3-7364-46ba-8804-4262c289f53e", "value": "6144:1xDNXvMWI/o3AsC3f+yFUOWS1nb0NB6sCi+sCK1sJwm2Nnt7z:xXEabyF+XTALK1sgNnZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645597691, "uuid": "86f8e5e4-dd5d-4417-9dde-de2109975abb", "value": 311576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645597691, "uuid": "7d1ac255-fd2c-40a4-b157-ff175466c842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597691, "uuid": "652805d8-ea3b-47dc-b624-565e72f9376d", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7025145c-9467-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645593252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645593252, "uuid": "94c9339d-b752-4fc7-ada6-b6371e918011", "comment": "Malware payload (Heodo)", "value": "59471a083fd1ba0b2664b0673a1824a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645593252, "uuid": "4a9c8323-38fc-4426-ba99-9681aa802200", "comment": "Malware payload (Heodo)", "value": "1003d62cff0e0cfeeef8648237bba68c807481f5ece5793f46dd325f9350fa5d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645593252, "uuid": "b4f19111-e473-428d-8009-3b1ff606339c", "comment": "Malware payload (Heodo)", "value": "47cb84a99a8147f1c6f6ecd5f644083e50d79e1e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645593252, "uuid": "990d9c80-53e8-4148-8bc6-e3d618cab8b4", "comment": "Malware payload (Heodo)", "value": "57c2f31c6751af1864d8c818eec2f63b2d366d751bab3fea9abe790ffa54f3b1c02284fbe9c29d7a1ec612bf76843ec7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645593252, "uuid": "a99fadcf-eacd-4fa3-843e-917c778e6ccf", "value": "T10AB49D117781C076C26F31709506D6B976E9A9B09DF9930BFFC84A3F6F745C28A2C24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645593252, "uuid": "d719dca8-be53-437d-86d3-7f7d0384f3d7", "value": "d7550206da3051d1cc941927ae3a1f09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645593252, "uuid": "32257d37-9831-4a04-9530-d9939c1574b1", "value": "12288:dOzFuk7dA19ZCOo6AI/2NLaQLvkMZR+TTI:0hn7dA19ZCOyDaQbkqkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645593252, "uuid": "e07d6a9d-eec3-4435-8c22-41628f9fd22c", "value": 494264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645593252, "uuid": "2cc90ec9-70bd-45cf-9b7f-0fae4802a5f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645593252, "uuid": "3ed2e924-334c-4ea7-b4e1-e9bb6ecf8de2", "value": "emotet_exe_e4_1003d62cff0e0cfeeef8648237bba68c807481f5ece5793f46dd325f9350fa5d_2022-02-23__051407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e1678b-94c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645634577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634577, "uuid": "733ec1b3-0f31-45e5-8551-1a8bd4e5aa4f", "comment": "Malware payload (Heodo)", "value": "4014333649b5c8a189ec8308cfdb54d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634577, "uuid": "395b513e-2c2f-4483-8ce1-783898d557bd", "comment": "Malware payload (Heodo)", "value": "10397d855883a73ff1d598f9c30b1758192059a242081f3caf28f6d9a65ad68e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634577, "uuid": "7788a79f-f2ca-48f6-bfa1-bd8fb369e08d", "comment": "Malware payload (Heodo)", "value": "6745b65720f8790edf018a7ce0d18dbd9391b4f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634577, "uuid": "7e8f0e35-18b6-46b1-98f2-04c3e2a66165", "comment": "Malware payload (Heodo)", "value": "58389e618d792ac7efbb1fc06b3c37613869bb9a8d436f223e85c1822b8c76b70ee181b562c8ccce516c7488dce2bc9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634577, "uuid": "b3869f2c-be85-4dae-9e59-bcf280cf260f", "value": "T15835BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634577, "uuid": "782934b7-82e8-4fc2-8e41-56278729bfb0", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634577, "uuid": "30c47a72-5581-40de-b658-66330e7612b2", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/BTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/BTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645634577, "uuid": "6f7818a3-25ef-4ed2-9926-b947eac7f662", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645634577, "uuid": "69198162-d812-4811-8b04-89e5c0bc5cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634577, "uuid": "3a0f12ea-acde-42df-8315-de481ff70123", "value": "4014333649b5c8a189ec8308cfdb54d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b557e830-94e5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645647485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645647485, "uuid": "5604e554-429e-4caf-99a8-3d026b9a4d94", "comment": "Malware payload", "value": "960bf6b33fda6e2dd8e214dfa3a2a7f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645647485, "uuid": "6c0270f6-19b8-43e2-a137-62a837d83584", "comment": "Malware payload", "value": "109abf7547839fa36a7a0bbd48990fa6a4cb908de7229908267354cde52f5501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645647485, "uuid": "a566cad2-ce5d-4f08-8a4e-03b2034adb9a", "comment": "Malware payload", "value": "66ea6fd62c71e1e685f1c3a0d28ac25584be7075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645647485, "uuid": "aecdc2ea-8073-4002-bfd3-d4221c3d8ebb", "comment": "Malware payload", "value": "bab294e68d372744a090110c7297fb101afeb3014b6d948984e0d0f0355a89b3d4cc8b3c6cf40ed68423b09047b445f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645647485, "uuid": "32d90a39-abd7-444d-a066-5149e74ced19", "value": "T18A678D1373A50196E4B7D2388AA74203E773B8575731CACF326D06152FBBAD09A7B760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645647485, "uuid": "27e32776-c54c-45ec-a92f-f6a9817fc7a7", "value": "47e33b9538febdf64d5eec782cbecf5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645647485, "uuid": "c0896b72-f76d-4c30-bcf3-57a59b25d0d2", "value": "393216:9EG4nnDhRe0ZWrwcjO/7EFAsLc8XRLWC4qvVrzpuJcXUgTkWclcJFBeH:9E9D5wLjFkWcmJP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645647485, "uuid": "ffc137be-4ee2-4f12-bc9b-4ff11ffaaa9a", "value": 30388499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645647485, "uuid": "b277a47b-ce04-45b4-b43a-e08ea68b094a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645647485, "uuid": "4749d50b-ef6c-4e86-a312-b334edc7b8b9", "value": "AzoroGames1.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c992083-94a7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620814, "uuid": "77166776-334a-480b-8b15-6e59dfa9b865", "comment": "Malware payload (Heodo)", "value": "cf7cf3ede98680f39519010b247ff6e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620814, "uuid": "fdca0218-bdf6-40aa-a557-7d5219a50d9c", "comment": "Malware payload (Heodo)", "value": "118fc4d6a79148e2dd9efa87004880cbddd730178eeb9e783e104e965043a30e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620814, "uuid": "81ea623d-081d-43e2-896f-b08258472b12", "comment": "Malware payload (Heodo)", "value": "5b02a5dafca5b927d2c0419b3a8ee80d833e70a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620814, "uuid": "bb43e0c5-1f78-4e72-b353-149a324417f4", "comment": "Malware payload (Heodo)", "value": "c6a72405e66724cc14cf26d1cdb3e71c73c89739a5b44ecdb6c38065e0ab25aa18f24349d8888092b8153fb41f3c1fcd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620814, "uuid": "49d21dd2-cc4a-4465-9d06-17a2a089a4be", "value": "T17635BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620814, "uuid": "017c3601-6636-4c3e-8455-362f605d9ae3", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620814, "uuid": "3736ff62-8ab0-454f-9626-691909a58830", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/JTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/JTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620814, "uuid": "97fa8889-d24b-4a7d-8edb-ed42a2a3ae8c", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620814, "uuid": "f35ed9ca-307d-4421-b7b4-8b5e3180c06c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620814, "uuid": "0d4b38e8-e1d6-4b9c-8f4e-686c10142bca", "value": "xqCIVxFYBddh9Zn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c788ffc-94ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628787, "uuid": "fa18026a-b580-4d9b-8898-08b9560a6fd9", "comment": "Malware payload (Heodo)", "value": "e5254d43c8ff6018e804669bcadce383", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628787, "uuid": "0cb8d898-29b3-43e6-9255-67be273c0685", "comment": "Malware payload (Heodo)", "value": "121a45242760699effdee2bd8838e774b77764710fc8499df1c744e0b93ef881", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628787, "uuid": "4189b9b1-e40a-4875-90b4-9d49225afe43", "comment": "Malware payload (Heodo)", "value": "6675af8154494ad6048aed090783b73846bc3ddc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628787, "uuid": "089795da-caff-421e-a073-4258cb216b27", "comment": "Malware payload (Heodo)", "value": "5cb93f88a8c52ae6d36b510d12694ba1ac9be16bd10543709de4c3b94d8d1e9769457827feb1c274fca2c344a4480c10", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628787, "uuid": "c7956af9-bf06-4333-a012-acc804710a51", "value": "T1E335BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628787, "uuid": "cdf73797-0097-4c72-8ff7-45faafb99f58", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628787, "uuid": "92e88af6-609b-4374-9bc1-f854ed82c593", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/pTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/pTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628787, "uuid": "7510105b-896b-433d-9a92-ab513ad2518f", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628787, "uuid": "acf64335-809b-4817-a58b-889674500ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628787, "uuid": "c98e777f-942f-43a7-a8d4-644b56d859ec", "value": "qYFyEYDp22WaWGS3o.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1840428b-94d4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645639920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639920, "uuid": "1789724d-32a7-4c87-85f9-36ee2ab95c53", "comment": "Malware payload (RedLineStealer)", "value": "fd5330bf2594cf71b8792e04c91ebe31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639920, "uuid": "72a26b70-238d-4b6c-8be3-8ae5df4afb8d", "comment": "Malware payload (RedLineStealer)", "value": "133c3f5b52a44b898658535cd20d2cb1b202753da6ae8663d765a15584974d39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639920, "uuid": "52db1fc2-ec2b-42b2-8330-d45513b0f4f6", "comment": "Malware payload (RedLineStealer)", "value": "872987b90e1b5c99cd30ea890789d1970865d662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639920, "uuid": "e5fe004c-27a3-401e-a429-99a58fe36a71", "comment": "Malware payload (RedLineStealer)", "value": "b16b12828b37931aee2c378e30b9fe2a3cdcb901d0858700bd4b6538c28f2d2ce1fd4478521da768c4dfeec9d042b296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639920, "uuid": "96e43ad9-8bb5-4d35-b198-b9399fd75167", "value": "T11C555C0137F5506EF7F2DA395637411C8F227CAD29B5891A9FE0A92F1475B048B3AF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639920, "uuid": "38aca852-bf3c-4ba0-8904-cef679034e4b", "value": "9838e8adedd3fc42018b85b2e944540c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639920, "uuid": "d7c01074-d69a-40ed-bb16-48aac5d08205", "value": "24576:7uWIIHKg5x0ZKBn/TliaSAcs1ixf8yeXp3aJlkdsJ+Qun:MzaxZLlxDccXZaJmdTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645639920, "uuid": "96c8d7c1-9591-4622-b05c-4d549a828cec", "value": 1295472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645639920, "uuid": "76ba86ee-c9c1-473d-8274-7d7167fdcfd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639920, "uuid": "3cf5a705-ca18-4fb3-bfd4-97a3025753b4", "value": "133c3f5b52a44b898658535cd20d2cb1b202753da6ae8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7e9378-9443-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645577655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645577655, "uuid": "0ebafd24-7f12-4a71-931b-b3873e64fa82", "comment": "Malware payload (Heodo)", "value": "8fc29883fff8f1300638e56f0ea6f9d5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645577655, "uuid": "fbec51ff-3bd3-4d5b-9eba-9beddb52fd44", "comment": "Malware payload (Heodo)", "value": "13409d08493c925e5f930da7bc15bf6c120e6cfda1f4201ce5b3ec39244257c3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645577655, "uuid": "e4675a92-0270-41c2-9489-070f4ab195d0", "comment": "Malware payload (Heodo)", "value": "e1e270cd07d08fdd519218ec14f9062bb701bba9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645577655, "uuid": "4897675e-8d7b-4702-aae1-305e0640a6b9", "comment": "Malware payload (Heodo)", "value": "b13f7c1795f968e1304b316085fad8cfa52532811b08e24e0bde64374a3dadbba82ed571cd8e9e4bb3c549849d5f4945", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645577655, "uuid": "1ed56a80-b3ae-445d-bc0a-461393024335", "value": "T11435AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645577655, "uuid": "82457989-8318-42fe-beb4-d28deb96c767", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645577655, "uuid": "1963e5cd-98c5-45d0-9031-1b82cfe29dd8", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTyFIIm2m40:wfv1GVFF+765nFvFf6dlzzSGFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645577655, "uuid": "f0af442b-4f2a-47fe-b206-be4b18f7ae7b", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645577655, "uuid": "0cbf569a-57f0-45b8-99e5-b67bcdc6dd58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645577655, "uuid": "3d332c9c-0b0c-4cfd-855f-81a00e4b1d5d", "value": "T6FUgAB.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2ac5b7-945e-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645589489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645589489, "uuid": "aa482766-a773-410e-b4ca-8735211254fd", "comment": "Malware payload (AsyncRAT)", "value": "c283f196f12bc4f87bdcaa9c8cd303c7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645589489, "uuid": "a1266b5a-4e7f-4851-a005-8524ae45308f", "comment": "Malware payload (AsyncRAT)", "value": "138e4b08af539fdc47ff40449381b27148bafd952fac788604fe0412cf98b2b1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645589489, "uuid": "d6d8cf13-ebc7-4c4b-ba1d-e945b46a87af", "comment": "Malware payload (AsyncRAT)", "value": "047d556fd716378670f3ea5311669316e0a9f15a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645589489, "uuid": "ccfca5fc-a91e-4a54-9511-43d2a002530e", "comment": "Malware payload (AsyncRAT)", "value": "d63746de3029d16607c26a563cb8498878c51860e960fb041964d4c24654fb639e0a4508f1533c9377d3dc87f8443eba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645589489, "uuid": "c1d34073-6952-4203-a402-ea7c06a06634", "value": "T16FD4D22551E3D87CCC5745BAA95087882E60ED2A7002EDF9B4C3F4BEDC7C79A874252B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645589489, "uuid": "d73ba25d-398c-4cb9-aca4-c641566362c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645589489, "uuid": "f346caa3-31b2-4cb8-ac85-9d51f69fd345", "value": "6144:gSLXEnZasZHvlOSkQBIH1CW1QYETlbvQvF9kdfHTe7i0V5kMjm8n:T7easVlvV0X1ETlbHdfzn0VG6zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645589489, "uuid": "27fd8eba-322e-48f7-a041-b77d05aa79bb", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645589489, "uuid": "c04ff400-838a-4cf4-a0a5-d991955eaca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645589489, "uuid": "29312de2-784c-4288-a9cf-8fe2e1d7c7a5", "value": "c283f196f12bc4f87bdcaa9c8cd303c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7c4a01-94c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645631369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631369, "uuid": "48c80ee8-0b9a-4b2d-be93-617329cddca4", "comment": "Malware payload (Heodo)", "value": "57595f82e73bed372c669e907d4db642", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631369, "uuid": "83611d11-1601-4bce-8613-6e95b005b90d", "comment": "Malware payload (Heodo)", "value": "14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631369, "uuid": "843d1b9a-8331-43eb-b880-10e232f06849", "comment": "Malware payload (Heodo)", "value": "78f18ab091be74f0cf4002d5f452d1856ae33790", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631369, "uuid": "c13d9c8c-dde4-4e79-a32e-e8015be06dd4", "comment": "Malware payload (Heodo)", "value": "6ecb6735bea105470f75ed6939232696797d13efd465b8a207ae9a6c7b1c74d066ba3f495bc928ad4b636fdc6a4eee24", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631369, "uuid": "7e3a2c42-4cd4-4e74-861e-90922e54238f", "value": "T1FAC4BF12F7D1C07AC24E01742E17A75A62FDAE900B29CAC3F788EB6F5E356C19536316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631369, "uuid": "ae15d32b-b5ce-422e-b7f0-110f5a32939c", "value": "eab923583aa648aa09e329638e8354af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631369, "uuid": "1fff019c-3324-401d-823b-1f3fa135c328", "value": "12288:eEETvW7M4xbC9V1Fj4ttR5bMzlTkPKO0kZ:eEEi7Myb4V34rXMpo0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645631369, "uuid": "be5c30b0-111a-4387-b291-feac783603e0", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645631369, "uuid": "fd9a16e8-03da-4c7d-94ff-875648a54413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631369, "uuid": "c01b0a86-505f-4a06-920b-7aab3d3f02ef", "value": "emotet_exe_e4_14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3_2022-02-23__154923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939fc3db-9492-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645611780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611780, "uuid": "a9e4c2b8-1c80-4c2e-8211-8a80be8246fe", "comment": "Malware payload (Formbook)", "value": "3d7faec42329ed463e1480c9701db034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611780, "uuid": "8712e611-4bdf-4b56-a675-f2f7725be4b2", "comment": "Malware payload (Formbook)", "value": "14ebc63874f323687783e368f0ec9f497d767055a97f536b3950c1232cf6cd92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611780, "uuid": "6330b3f7-0503-4068-9255-23480799f440", "comment": "Malware payload (Formbook)", "value": "7fc37106399d5168044b765bdeadf68ca6d8ab92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611780, "uuid": "c9748c40-1f33-46fe-92a6-31b93fad9bb7", "comment": "Malware payload (Formbook)", "value": "b770c1ae16001b8c3a06262804bf0b3b67ccd187ab557372bec97d68b70e9be393ff2e86ca349c115a4fae2065d556a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611780, "uuid": "6045dd3c-725b-4c4a-ad3d-45ff81880164", "value": "T1C194D025094232CFF8AA9539EFAACAE0D7683E6425311563D7517C6FB1BC8F1C9B2311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611780, "uuid": "e87a03a4-7b46-49c1-8b3e-f2c38b6f3d7a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611780, "uuid": "2f253627-4979-47a8-9451-72cb2ac6100a", "value": "6144:ixDXiAe4r46D6BR0mhZ0DxcaPVevyWRKvDevFC9VkBll8/5jncI9XarhQHC1:eiAed6D6BR0mhudevzR7ByJ9XkQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611780, "uuid": "32cba5aa-1c42-4139-bce1-5bcdf301b508", "value": 443877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611780, "uuid": "e277395b-919a-49b6-bb47-4e1fb9161460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611780, "uuid": "9c353a72-26b3-404b-a1b4-f6169799678b", "value": "RFQ#1000012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71884d3f-947d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645602703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602703, "uuid": "80cc011b-079f-447c-9279-a8dcf6df9b27", "comment": "Malware payload (Formbook)", "value": "42d0d53263cd0d757870fc6c847dc066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602703, "uuid": "a3e4f42f-d684-4d07-a376-e49ab62d11a7", "comment": "Malware payload (Formbook)", "value": "156b5c448e30912d7d21ca87fbb01a5c9006a3093c236e05809a4b4ecacd7400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602703, "uuid": "21ff3edd-8f07-44d2-8ba4-1302db351031", "comment": "Malware payload (Formbook)", "value": "2f91f9b7d2cfe4b4fb9fd0844122367c5e5e43e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602703, "uuid": "49e5aaf0-8fca-4c99-ba14-6adfa07acdd3", "comment": "Malware payload (Formbook)", "value": "5f4c6459d75ec128d4c421d2c8f850c1a12cf90a7abc29f0ee0e8cfef6684ac6d3123ac1ac219b0145412e22bf95ec0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602703, "uuid": "fe2517be-fa6f-4560-824a-84a7b56708d0", "value": "T1B3A48FD0A261C5E7FAE645F15C2E682215B21D6DECE4110E54BB332979B33A220DFB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602703, "uuid": "3e9056fa-e038-46c3-b8ff-bc61fda05c57", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602703, "uuid": "ed2074cf-b349-4ce0-bdf4-6c57eda1f79f", "value": "12288:YdZzbE0t7XKpy+E0d4uMZhkrHQoadh3GU:KXk4HUHQNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645602703, "uuid": "a8d198ba-d467-47b4-94c3-127cf51a640d", "value": 455653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645602703, "uuid": "c9489c08-395b-4e74-9697-1f58e57e0b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602703, "uuid": "05f0cac8-47d5-41b8-867f-14075071543e", "value": "IRQ2107798_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a987728-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645619308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619308, "uuid": "58320d68-4f00-458a-9329-d458001a8586", "comment": "Malware payload (ArkeiStealer)", "value": "32ca838b61faaab25284af34b2f3fbad", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619308, "uuid": "1bf9f6f7-6ccc-41a9-a8a3-fe3ca1a5a4c0", "comment": "Malware payload (ArkeiStealer)", "value": "1599b6b02cc8daf21d26a5bd03cab1162a620f8402cf6d4c06ecf759e1b68bf3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619308, "uuid": "73d2d19e-051c-4324-8252-9de959ec3516", "comment": "Malware payload (ArkeiStealer)", "value": "738091eaf1d504143bf57f0fe7524eb60849539c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619308, "uuid": "1ee50901-3151-460e-9a1a-70de4900e12f", "comment": "Malware payload (ArkeiStealer)", "value": "265f9135f53250fd4e8edfc16f522ae77210589bbed98a5354fae438d0897d826abe20dfff8058f22e3e644fd3548762", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619308, "uuid": "a487bce2-36bb-43ea-9ef9-ae3e8077896f", "value": "T1C844CF11BAB0C83BD5A20D304864C6F1763FB8615B64A54BF658BF1F1E323D19E6A34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619308, "uuid": "0f746d25-fde4-48e3-baf9-b123afa5a729", "value": "ea3548dfc690687ffb93a7d9a19ce093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619308, "uuid": "f63e19b0-ed1b-4a14-a8e0-f9648d9cf6d0", "value": "3072:jV744209aGM2AWWa+X0MiDDtN58OnS4q9mseyEssxkgaBCh7GqwXme:hjM2ArabMiDDtN5PqwsoigaLGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619308, "uuid": "f014bf01-8473-4567-b43c-228cc92a4ecf", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619308, "uuid": "52ef4e48-ffad-4fb5-87a6-9da2667ef596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619308, "uuid": "a595df94-d600-4061-9559-752ccf25cde3", "value": "32ca838b61faaab25284af34b2f3fbad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30c8137-9499-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645614947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645614947, "uuid": "ee28eadf-54f3-4973-a8b2-e0f07b82fa75", "comment": "Malware payload (Heodo)", "value": "6f0394cbcea3500ea972040c60c53df1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645614947, "uuid": "ff0ce71e-d433-43ed-996f-fa5667424db1", "comment": "Malware payload (Heodo)", "value": "15c365c0de7aa4340bfe6c7aa3fc2e6c6e55cc9b5b6ee1c32d775ee5a5b4da97", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645614947, "uuid": "4ede7599-a2dc-48a7-9916-75edf4fac4cf", "comment": "Malware payload (Heodo)", "value": "adf3e53ba9ed0d32f046aed79285c8b52d840a3b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645614947, "uuid": "0593d00e-1741-4160-87b9-c134754de38c", "comment": "Malware payload (Heodo)", "value": "b40b04277ed4b3492a51aa1f04258d73972aad6e5e632c52906e3978ab81e6ccca71ef6437f4c1210e3e2d009df03374", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645614947, "uuid": "894c47fa-2352-4f86-b023-5c9a06b2ae5a", "value": "T13B24AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645614947, "uuid": "b6601a41-f276-4e3f-bf81-2966da6aac2f", "value": "6144:2MyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:tyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645614947, "uuid": "d9dd90d8-1be8-4db9-83ba-d060cc55d857", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645614947, "uuid": "77135e54-2d5d-4cef-8c73-26c7c5fb5b14", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645614947, "uuid": "9ab9eb81-7c94-48af-ac7b-b1206894ade7", "value": "EQ73308279689450637084.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc61cec-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645623712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623712, "uuid": "ff43a296-9e16-4282-9bed-1873c045d1ca", "comment": "Malware payload (Heodo)", "value": "f3187ba2a2a75f2752412825486c1cc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623712, "uuid": "c32d28ea-a568-45c8-9c79-d49dadf1fe0f", "comment": "Malware payload (Heodo)", "value": "160729f89c6b80dbebd0a2cd4e72ddedcc452214968b66950a6d877af1767440", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623712, "uuid": "13a9a639-50d4-43df-807b-7e81ea611798", "comment": "Malware payload (Heodo)", "value": "3140dc722b1dcb926a9ef64622c3748ab61cd3ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623712, "uuid": "2d22633b-c118-4848-9429-ad32b050e7dc", "comment": "Malware payload (Heodo)", "value": "40fcda34ff9062932d00b14c40a4d274b31bb019e49260702eb1d5ff6c6810babdf37717dde32fb0dbdaee300d604092", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623712, "uuid": "6baebffe-76bb-4cd3-b160-84bdf144c199", "value": "T11835AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623712, "uuid": "c97c756c-69f3-42ed-93c8-bde53e81fd8f", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623712, "uuid": "dff87c4b-54f3-4ade-94e8-fb0ec5bea74e", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNTTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNTT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623712, "uuid": "91c11cb6-4c3b-45e3-97c4-4a15ea81bfed", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623712, "uuid": "879f64d8-2a53-4467-9803-2dd348a96a02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623712, "uuid": "fadbec08-ab0b-4cdd-8243-430a59fc335c", "value": "f3187ba2a2a75f2752412825486c1cc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86a66fe-947a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645601614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601614, "uuid": "05ea57e4-df36-4064-aaf1-ff8078f8edc6", "comment": "Malware payload (Formbook)", "value": "ef3d052181f60d2ca2cf5bd87ca8aff0", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601614, "uuid": "8c574abe-0b4f-42d8-bcb3-1d741279bac0", "comment": "Malware payload (Formbook)", "value": "16dad2c6579a0d2158b7f836f3b11035e10afa60ccfb08506f08b1e2c72b66fa", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601614, "uuid": "1e70a74e-273f-4579-8580-3ec3a968ca89", "comment": "Malware payload (Formbook)", "value": "11a94e7c28cf964d4414188e5338f6fdd177cf8d", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601614, "uuid": "0f789b6b-7711-420c-92a4-66a227062181", "comment": "Malware payload (Formbook)", "value": "4adef5bb6021f3e547379920ad3755817955cf2be71541184dba1da73a1817362d45e54babf60d7d24a48e209a5f4f14", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601614, "uuid": "0198a066-aae2-4013-8da3-e4aca1b23821", "value": "T102E423898429D47D56D3C950EEFF8F18C38ECA537746519E9F9269ADF3C0A20C42782E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601614, "uuid": "a1cbf925-1740-4dd1-9188-79b8edea9740", "value": "12288:HnVZmIRORvU2GNvHqpPXV+hBdZrMnJU355UYqzqwe51TzLn4p1apPFKI82UZnxKj:HnVZ1OR0fqptmBd6mTF51AcpPEMKVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601614, "uuid": "53934e42-4f39-463d-a3e0-8ffc1993753b", "value": 693949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601614, "uuid": "81859033-6aa5-44aa-b2bc-90804f26df1f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601614, "uuid": "4f67bd73-d266-47d3-a1fc-0ba7aeeb8ad1", "value": "NatwestXBankXPaymentXSlip.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f291dc-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645624420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624420, "uuid": "ea0b231c-57ba-4d51-ae51-4776255c3526", "comment": "Malware payload (Heodo)", "value": "0adc61c65d26a003bb988d7fe147b322", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624420, "uuid": "bd1046e3-6e9a-4d5d-b5ac-15bd3f881f32", "comment": "Malware payload (Heodo)", "value": "1718f96fef4b7d8c0a3c7b08bea910ece856a476f4008d1739b07ee02159487e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624420, "uuid": "d4e95243-f4ea-4b08-9140-88a2a16255d0", "comment": "Malware payload (Heodo)", "value": "4bec9fc6e33c8ff9ff12cfe239b3d740d120ade3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624420, "uuid": "46abe3f9-20a5-4be2-9c6f-e33430fdb601", "comment": "Malware payload (Heodo)", "value": "44bf8847c5e5443b0d722a9f8b2faaf7a2060fb7b2d635ad576773d38dfe06b3b240cdbf78c9ccfea792e1cb41bcd714", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624420, "uuid": "7ce77bf8-f4b2-42fc-9449-484ac6bd1ade", "value": "T1E135BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624420, "uuid": "d850f890-8c9d-4d50-b515-bc942fa18d16", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624420, "uuid": "64895cab-e6c1-4401-b13c-5a9a809198f5", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/tTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/tTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624420, "uuid": "39d92ed6-1457-402a-b768-ae268216a9f1", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624420, "uuid": "9c907abe-86bb-4c21-9923-88a28bd31f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624420, "uuid": "652f5392-3ec0-44f4-8f98-71d84c5e6755", "value": "0adc61c65d26a003bb988d7fe147b322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec9b9da-94b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645626294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626294, "uuid": "95ed5863-6601-48d0-b9df-81d19eb11c4d", "comment": "Malware payload (Heodo)", "value": "b0280f8cf791c7c2a16b6929dba49e8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626294, "uuid": "ac791a32-00f7-427c-9c2d-c7e5bb13d749", "comment": "Malware payload (Heodo)", "value": "18332c70971f036647e097455eb00e823c7df83e8b6e5692f0c1695f5dd8bc43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626294, "uuid": "fa838191-c765-4043-a821-e6c70d44489d", "comment": "Malware payload (Heodo)", "value": "fd8edd2cd85c5a66a3d9d8b37612ecd5549ae05b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626294, "uuid": "25be61d6-a179-4247-a01d-0146e641f5b1", "comment": "Malware payload (Heodo)", "value": "c44ea9a7df06a9892f90cd65acff4e0e4a571298e7f9ff6b41275193ffbe39df43211b2041021434efb624786132bc0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626294, "uuid": "12e3b69b-7b18-47fd-8826-d3a2fcb71ff4", "value": "T16B35AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626294, "uuid": "0f14248c-4bab-4caa-ab7a-9007ecd2d40b", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626294, "uuid": "43493491-1dae-4426-9121-29f7a32beae3", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNlTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNlT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626294, "uuid": "6b9cf786-aaa3-4010-bc20-2f3d096c1de2", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626294, "uuid": "09f0a192-a181-41ee-bdd2-ff77d6d01c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626294, "uuid": "e6465895-3377-4c55-a19a-77a35b69201f", "value": "b0280f8cf791c7c2a16b6929dba49e8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc6f3e8-949d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645616545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616545, "uuid": "55472203-3ca8-48d5-94aa-d10db3083f59", "comment": "Malware payload (Heodo)", "value": "a68bf4ecc607a094017e940c302a94d2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616545, "uuid": "22884620-d7b5-4687-9d02-390e647c7888", "comment": "Malware payload (Heodo)", "value": "1837a59ce674b780f1d660cba268741f2155812b10871ed11038db2b574a7b13", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616545, "uuid": "456d797b-19fa-4f08-a4b5-bdda6b51ab83", "comment": "Malware payload (Heodo)", "value": "2c4b540eab8d400ae980c6fac83454141a1d0cab", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616545, "uuid": "372cce4a-9472-4d2a-baa4-4178d6269937", "comment": "Malware payload (Heodo)", "value": "e90ee5b7c7a181dd3c4f1599f785f4bfb5b7663ef954f7a4d2a5171e9ceb728088dd7943c93ea1b7d573cbb4d422c476", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616545, "uuid": "8b3ebd72-c155-4e86-8bd1-31cc8f371202", "value": "T15E24AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616545, "uuid": "6af09037-f4fb-4fa0-a5ff-dbb50c86ec3c", "value": "6144:mMyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:dyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616545, "uuid": "28745c60-e4e1-4d61-b14d-c2422ba8a2af", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616545, "uuid": "d9a87703-833a-48b7-952b-3295c6a08a0f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616545, "uuid": "24fcf466-7458-4328-bd26-26c050847bf7", "value": "2022N000001206.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48253ab-9479-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645601098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601098, "uuid": "df83231c-904e-461f-9cce-581980cbfa92", "comment": "Malware payload (Heodo)", "value": "d87359db58997582eb067be39526da9c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601098, "uuid": "d9b77210-a42a-4b3e-96a2-00dcf9b54bbc", "comment": "Malware payload (Heodo)", "value": "18abdf8510e687419caa7f7e7c05ed8a22b45fae8f743798e5a5302db1c44ab6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601098, "uuid": "e0129b14-a98d-468c-896a-ba1580f31d38", "comment": "Malware payload (Heodo)", "value": "3eacd5a04e18fbf75d56cf5ddf9ff40ca444238c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601098, "uuid": "f51b4824-53b9-41fd-bf1c-4027ed6c4af7", "comment": "Malware payload (Heodo)", "value": "d3135dba7a7329815b5cb92753431bf7ff5ac8f5b1c4c2e2ab78739b5817b6f3ce7d1ba646fda2cfa534c1da7ccb6e93", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601098, "uuid": "180a0a94-88f6-424f-bfb1-f5bb1b9dc924", "value": "T1CB35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601098, "uuid": "67d7979c-010e-4c82-bd96-31b36ff18d86", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601098, "uuid": "2a8dc135-94ee-468c-a2dc-7d97b9fde863", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/xTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/xTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601098, "uuid": "46a16677-4dde-47aa-97d2-2b9f2f5b0755", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601098, "uuid": "721f791c-df20-4ac7-8295-d64342af5896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601098, "uuid": "dbc4f72f-f7e0-4c0a-90dd-2459fe6e0baf", "value": "emotet_exe_e5_18abdf8510e687419caa7f7e7c05ed8a22b45fae8f743798e5a5302db1c44ab6_2022-02-23__072453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb9f085-94a9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645621625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621625, "uuid": "9bca22b7-fdad-44b1-a14e-f2ee10ad9c2b", "comment": "Malware payload (Loki)", "value": "33e915c5057bbb6481b2d492d1bde0ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621625, "uuid": "c95b13cb-c824-40e0-863d-58141fd1251b", "comment": "Malware payload (Loki)", "value": "1960cdd2c85eb563f15831012f4afe994ed4da25091b6d89b81563d5217a4484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621625, "uuid": "116e0764-76e1-4a6a-8b0f-f2ec18d01ee3", "comment": "Malware payload (Loki)", "value": "61c5cb98ab708ad84cb367db83df804ff651918e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621625, "uuid": "947af5b6-dc96-4e13-b5dc-875af0d4ba3f", "comment": "Malware payload (Loki)", "value": "a60b723b33a76429413e53c2c516614fb193b56def2d882fefcca8c58ba7116b9724c9e69516cf0c55790a4e18431643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621625, "uuid": "e9914ea5-ae24-4d6f-b5bd-b8563ef42c6a", "value": "T12A54236FB5D449ABC6C819740BBFDB6BE73079182778AA472B550FB02D91388B00E167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621625, "uuid": "f2e94167-ccf9-40e1-97e2-a786c4dd05a7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621625, "uuid": "528c097e-ecb2-4e29-976d-3d33b71d0ace", "value": "6144:TxDuTT5+X1XKPJDhG2Xvu6c5+lzDwby4ZGyCzAyW/OCs1WTh:4qXqDnFOyUq6/OBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645621625, "uuid": "56f84890-5155-4c9c-b23c-26a63b9bdd2c", "value": 288353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645621625, "uuid": "2d2607f0-9771-426d-9348-0d53c6854b84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621625, "uuid": "d75b1727-8d1d-430a-9311-76bb1a854be2", "value": "33e915c5057bbb6481b2d492d1bde0ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53cc54c5-949e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645616827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616827, "uuid": "15cb35b7-56b0-43f4-8f86-916c9d30eb8b", "comment": "Malware payload", "value": "69a09d4d02e9e376b8c34730e73db5ac", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616827, "uuid": "26845c78-d551-4605-ab0b-0967d8e91d43", "comment": "Malware payload", "value": "1a31b1a45f4549fca08fa4a8ae0f4ee1120dae090cb624d203058093f8b6d0d2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616827, "uuid": "62c9d08d-400d-4741-9c69-b106c0e377ae", "comment": "Malware payload", "value": "b6393edab8ad863fbdbc82927036dfab598c5bda", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616827, "uuid": "cf4b17e8-602e-4758-bd3d-41e184521db7", "comment": "Malware payload", "value": "29640eeb077c39a9ef3422a47ec90c40f52e032824026d9e549cd97027cc10f5e88e41bc31fa5568d449eafb8beabb9c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616827, "uuid": "8a0c1849-f1b5-484c-b0aa-24e14ad511df", "value": "T11F547D0277D2427EE5DB4732274BA362DA72EC749662412A520AB90D3DF0568F7F32F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616827, "uuid": "a3c4ac19-29cf-46be-b12f-997f8f96b67c", "value": "3072:4B97NIA+/WQx5TYD9yOePnA5S75wgz88ereWn/7w05g0a9oYU3DaAw7OyNGR+ao9:4ep708er1nzTxYU3DaAw7OyNGR+aoxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616827, "uuid": "4f11c975-8850-46bc-9234-8a910f1c6000", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616827, "uuid": "66eb9261-aa2d-4e59-8452-9ed0d67a2fc6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616827, "uuid": "2721c770-d499-4c01-9944-1f302f9f51cd", "value": "_+Cota\u00e7\u00e3o de Pre\u00e7os fxyx574174H6fxyx.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5e9d5a-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645620255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620255, "uuid": "e46c458e-0862-4d85-bd94-04eee6866845", "comment": "Malware payload", "value": "aaf9fc54daaf431711c46c583d6be933", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VBScript", "colour": "#1A34B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620255, "uuid": "23bcbc7c-9aea-4a9a-959e-55d979262f9f", "comment": "Malware payload", "value": "1b01211177248bd9ad25959da4f7dadd5ae46dee24ec82625777aa14ff63eb66", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VBScript", "colour": "#1A34B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620255, "uuid": "e4773610-9816-4bc4-a710-4bef8e087e7d", "comment": "Malware payload", "value": "fddca186b5becf1c8f8bd351aa8412d01bc1c369", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VBScript", "colour": "#1A34B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620255, "uuid": "7c69e698-7e13-4be1-8c59-df15f3b142b0", "comment": "Malware payload", "value": "52fc50c14ae6840be44cb780a327dbae57ecff5dfdb8b65b6c6a7b96ea1125ec3c098c28e738ee46f14027e336e9a1f2", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VBScript", "colour": "#1A34B8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620255, "uuid": "027d4004-7448-4ac7-91d8-ac0d0421f56c", "value": "T15092ED24684DDBFA3453DD8FAFCD65A088C408E39939B3B8B4B9D1CD45A095C7A9E703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620255, "uuid": "957e634c-373b-496a-84c0-dc9a9ae38728", "value": "192:fgVwLjUJpJf0t59KLKnVlxiuc6Xsn4XwS85O:YVwLjmpJfC59KLKnVlxiucusn4XwS85O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620255, "uuid": "39a44008-b3e0-4dec-a4ef-c32edb0a43d9", "value": 20633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620255, "uuid": "023074be-0730-4b08-931d-af5f077709be", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620255, "uuid": "c4f143c4-8bec-456d-a2f2-ef832c0ca3dc", "value": "evil.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6447d126-94ee-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645651214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645651214, "uuid": "cc8eb7c4-7c6c-40d0-af7c-e6da72471543", "comment": "Malware payload", "value": "3f4a16b29f2f0532b7ce3e7656799125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645651214, "uuid": "6f8aba22-fa08-4bbe-b4e6-547aa6dec98f", "comment": "Malware payload", "value": "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645651214, "uuid": "9dcc949d-59cf-4653-b15d-c96c70e399ad", "comment": "Malware payload", "value": "61b25d11392172e587d8da3045812a66c3385451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645651214, "uuid": "99f1d222-4ae4-46cc-93ff-09fbbb96f9cb", "comment": "Malware payload", "value": "11331dcad0780d2ba57a5ad73ea3d1d1058e357af448cc3b70762fbf34dd8d55c2671203205d7594c80ec892eb19b77b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645651214, "uuid": "a749097d-f8cb-4431-8615-170502a0ff38", "value": "T172B326539AEC3CC6D43813B137BFA7E5D72EECA46A90C09E96D01182D57C9533A227E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645651214, "uuid": "75542730-103d-4edf-946a-f43909d9930a", "value": "fe4a2284122da348258c83ef437fbd7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645651214, "uuid": "8c788f4d-5829-447b-94f7-b417cccdc059", "value": "1536:sBOoa7Nn52wurilmw9BgjKu1sPPxaSLyqC:sBOoa7P2wxlPwV1qPkSuqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645651214, "uuid": "4fe9fb26-3416-4963-829b-4db39da2c33c", "value": 117000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645651214, "uuid": "90a57143-702e-40ee-bc30-cda6233fc478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645651214, "uuid": "b4b5d5cc-0352-47e4-99c2-33135ac35687", "value": "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00af90f2-94a2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645618405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618405, "uuid": "6fa06c7c-ebf7-4589-b2d9-022286b37d06", "comment": "Malware payload (AgentTesla)", "value": "e205473b2a5ed8723df77ce6db31d73c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618405, "uuid": "037603cf-80c6-4620-bf15-2285e5918484", "comment": "Malware payload (AgentTesla)", "value": "1bf8c12c3dadffb6d0b9dfbebd78a15bed670640830c0f41369ea6137c2aeb1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618405, "uuid": "1548d2f6-6fad-4c9b-8e91-b5817005d66c", "comment": "Malware payload (AgentTesla)", "value": "ae25d0e1f8f066f95e156f2e9918dc1b5ff907ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618405, "uuid": "85c22e6b-b92a-4e8b-99ea-733ef8a27869", "comment": "Malware payload (AgentTesla)", "value": "2b555d25644c5682d5ef9370944bf1e7bcb3aa9060e0d1d6850592e16cfce96c0c759aea10835bd2edc4421974a0b29d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618405, "uuid": "c734225d-1fe5-4b46-ab4d-e92ba9190438", "value": "T1C8D46D51BECA6EA1EFBF47B78361DA2D1126736D03A0A6CF6643019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618405, "uuid": "d074c1f6-dbb4-4684-80a3-360568b516c6", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618405, "uuid": "db313d86-e164-418c-ad9b-c7afb8ab60df", "value": "12288:g0Ws7IMsR4yVld8bzbBSreSBY4ZyrE7K3yl8PeVooA/AB2LEJZuAQPUqjK:g0bskX1CBY4ZyrE7K3yl8PeVooA/AB2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618405, "uuid": "1c1791be-2cc3-4a18-a8dc-729e1e61c5c5", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618405, "uuid": "54ad5a06-6970-4ccf-ab25-1d4f31ce9165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618405, "uuid": "01da649a-7cbf-4664-97f0-f6a33697c4fb", "value": "Quotes.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a628ad03-949a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645615247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615247, "uuid": "a9f7cb46-0cbd-4939-babf-b9552503de5b", "comment": "Malware payload (Heodo)", "value": "10eac87217549f3fad3181d6cecf490a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615247, "uuid": "2083e4cb-389f-4a5d-aa06-b94ba021d7d5", "comment": "Malware payload (Heodo)", "value": "1c152ecac622162caf2625989d7d12f41220fde1a051ebbf6d35ceee66793028", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615247, "uuid": "f43ee3d1-5ccc-4b2b-976d-17fc6d01e8d6", "comment": "Malware payload (Heodo)", "value": "6653ed6de8326b74bd2c14bf09a8c79f7ef9103d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615247, "uuid": "c51cafc9-dc2d-4173-8256-ebe3a8cafa97", "comment": "Malware payload (Heodo)", "value": "42a375e0edccf590eed4ffdb97f8211bf7b076a64286c1a311f0eeecc2396a0a8da5ff055c5d0c6965383aa51e453a05", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615247, "uuid": "e8807ae1-28c5-4adc-83b4-43b77ae03d66", "value": "T17635BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615247, "uuid": "aae50172-a544-4236-bcf7-c65ddb96b380", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615247, "uuid": "81451a31-68d4-48e3-b1ac-3b0d7561ef1f", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/jTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/jTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615247, "uuid": "4c708468-ab83-4270-8366-2f32a41caf25", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615247, "uuid": "e28b313b-1f45-4b12-9822-57bd8bdb8b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615247, "uuid": "1c3f4b71-4ee9-4125-92de-fcb5b6366138", "value": "rnX9EOp8KWqyzl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020d29ba-94da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645642459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642459, "uuid": "8ea8e231-f376-4cde-ae27-bd02dff6bf2c", "comment": "Malware payload (Heodo)", "value": "a6e083aefecf8a7369e4921ab7cee116", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642459, "uuid": "6cabd1b1-b827-46e1-b7c8-6e71dbeba1ec", "comment": "Malware payload (Heodo)", "value": "1c3b98c99e9e3c868a4d139f1c8f1ec3e912535aa77f8266f07bddea00cd6ac6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642459, "uuid": "fed7c384-6fdb-4e26-a766-061b01499a48", "comment": "Malware payload (Heodo)", "value": "df1a993001a95ac8b39277ba95e6f7b5cb27e70c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642459, "uuid": "3dd4732d-7521-42b0-9371-6987c8b6cfb7", "comment": "Malware payload (Heodo)", "value": "de47d7f50333f9d08f1d5fb6aacf8dbd0faacdaf5324789e9a5e97ecdd3f705858e897c906f09b1917d5c14ce832fb9b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642459, "uuid": "ccec00f6-b7bf-4f22-b71f-1a0b4c24c306", "value": "T1FAC4CF02F691C07AC24F01752A57A75AB3FDAE500B29CAC3F788EB5F5E326C19235716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642459, "uuid": "9c19a5e5-976b-4c0d-935f-00fd037fc05b", "value": "eab923583aa648aa09e329638e8354af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642459, "uuid": "4b4e35fe-1c1d-4552-9d4c-bddf5a9e3dbe", "value": "12288:Djhn0h2iub22/tqdbP0EJRZvtkNUqqa/6COkep030t:Hh0hDubBtu4ElKeja/l+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645642459, "uuid": "38b4d870-1664-45c2-a19c-b9287bf830b3", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645642459, "uuid": "5471ef9f-b616-4928-b0bd-115a9b333cba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642459, "uuid": "1734d0d9-a22a-4ab7-b4db-2e521229509d", "value": "emotet_exe_e5_1c3b98c99e9e3c868a4d139f1c8f1ec3e912535aa77f8266f07bddea00cd6ac6_2022-02-23__185412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d7b11c-94be-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645630812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630812, "uuid": "8531ded4-2c26-41ef-8896-68efba3e133c", "comment": "Malware payload (Loki)", "value": "ee924d20eb33ab5e8b993e6da73dbf0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630812, "uuid": "5ef9dbb5-a552-41c2-bc88-cfd1a433ef94", "comment": "Malware payload (Loki)", "value": "1c550728ac5d6b95493a0c61c1ba9451b5993e20c9dc3ec1185dfa25ae4f78c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630812, "uuid": "8374a9c4-9683-4577-92f0-e1340eec0afe", "comment": "Malware payload (Loki)", "value": "b9f6253c490099e526ebc0c08c5c81679f4b8bc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630812, "uuid": "e0827d48-80db-4df2-aa75-ff5009db292c", "comment": "Malware payload (Loki)", "value": "c3ebd6bdda0aa76285a6a7ba4316e84bfd5bf8c383964c3d50b50ff27d5f001b7240cb7c0c26ae291721a7ac6b40f316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630812, "uuid": "6de6595c-a33f-4d21-b766-5d8dff4ca314", "value": "T15925299C365072EFC857C972CAA81C64EA60747B930FD243A05712EDAE0DA9BDF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630812, "uuid": "cfa97875-924d-440a-9673-68482fa4b7eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630812, "uuid": "620ea10b-cd8f-4cc1-b7c2-7b3f9976c538", "value": "12288:me4vXSFSAOoPdzJ2/2YM0guDz3ZQtuvy0R9HfA8o80+fl8pE9o3MHLClOxtqwfb2:me6cS8VHcB3kuaco8Jflguo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630812, "uuid": "5590d0fe-fb03-453c-9b09-9438cb3961f7", "value": 997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630812, "uuid": "7ebba559-fd46-49fa-8c49-219304d2457a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630812, "uuid": "8759a581-f7f5-4abd-9e25-f2ff62646b78", "value": "ee924d20eb33ab5e8b993e6da73dbf0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea681d18-94b5-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645626958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626958, "uuid": "f5bc05b5-c597-45d5-84b3-ad0f1243e6cb", "comment": "Malware payload (SnakeKeylogger)", "value": "bed770a8c9103a16b1e0d035d466c698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626958, "uuid": "a9f310d5-0e91-4369-a6c7-bb914a060482", "comment": "Malware payload (SnakeKeylogger)", "value": "1c6ed697f4ab3f72e7d0cbf509dc52500c7999a198ac9edfa926eada3ccfcf7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626958, "uuid": "ba24eebb-7a81-43b8-aa17-55ac1279f588", "comment": "Malware payload (SnakeKeylogger)", "value": "fc8b972e4190ad97d1e91ffe5411e53d49f2849a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626958, "uuid": "8edfa49a-3425-42e1-b8cb-6309378f66af", "comment": "Malware payload (SnakeKeylogger)", "value": "e042fb7c417565dedbfba58246e6299ae6d5f15c8a09da60425d724a14030022065b44bdb556dc130192f49163294cf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626958, "uuid": "058cc7cf-88b6-46ea-88a2-bd8ca16faa91", "value": "T19583C3A1BE48F625D1295C36CA42D9F5C267BD1BCE218917BEC43F1F3933682D50172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626958, "uuid": "0965bbf3-ac54-4ea5-9f6d-5cc726a867fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626958, "uuid": "4a744fe3-a23d-4272-9099-5c66b2a1097e", "value": "1536:s3UGLbT2cz0QU+iopiA+bHq0R4Co0s7yj7c0q1R:ELLbFzIYzCo8/c0q1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626958, "uuid": "8a33f708-d2f4-41a2-b98f-9a7a4a483e83", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626958, "uuid": "13a346e1-46f5-402c-bd5f-d6c453258aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626958, "uuid": "5e875559-5fe6-413f-ace5-58326fa913dc", "value": "JHY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f325fb67-94e2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645646300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645646300, "uuid": "3c358dbd-f613-44db-82ca-e8edac8d9122", "comment": "Malware payload", "value": "b1bbbea9ac6472925d3fa03502b46186", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645646300, "uuid": "88d88ada-002a-4251-8259-ff2a5411981d", "comment": "Malware payload", "value": "1c933e0e700ec3213076a40d08e32195c2d1cb3fed623d6907010e4f069e9cd0", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645646300, "uuid": "e9aded3c-b5dd-4caa-bcf4-34c37b5710e2", "comment": "Malware payload", "value": "c25bdfb4f4b33c3326eaad4f3f3da4154f157e33", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645646300, "uuid": "1be33058-3e1a-49c6-ba6a-8c60fabd78d9", "comment": "Malware payload", "value": "4696a2cd1fefe6c38ca602dca090f286f18c1bcf5392571c49ab2c2f6d9e02df29769d16174279e8644a5bba44d70fdc", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645646300, "uuid": "c2bb3786-7a33-4b01-95fe-43f16cc43c8b", "value": "T19244D01AC2117C1EDF1F5ABB114BCBB6FA5291B83631D7091D6E8AC7DDA70A36D08360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645646300, "uuid": "f21eda19-b1f6-4600-8d20-a4b4745797dc", "value": "3072:EDUW+KShrLHe/Fnqms3FJ9hQZIiiUEinq7C/9ycZz3V/Pg5fwqqqqqqqqqqqqqqT:ST+Pyqz3/QKlj7C/9/t9g5aVQNJU2cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645646300, "uuid": "e0892c7f-8a6c-4953-85fb-009adf6868e0", "value": 271509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645646300, "uuid": "6414f607-34bd-4def-8ccf-de73d704dc4e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645646300, "uuid": "bb07f6ca-4a85-47ff-91b1-de81d2e642b9", "value": "63.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c50e261-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645622961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622961, "uuid": "db2c5b60-c801-4662-81ee-f0c3b248b07a", "comment": "Malware payload (Heodo)", "value": "6d6fd7a05973f9939e51556798d79021", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622961, "uuid": "ce76441f-1cc5-44ab-a470-478b91ba0594", "comment": "Malware payload (Heodo)", "value": "1d11e8ea6e9de5e14b1dc43d6035f5d636b5708d57f226c79bcc481fc3e790ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622961, "uuid": "810ed231-4656-4865-8f8d-4c1cb3b464fe", "comment": "Malware payload (Heodo)", "value": "9afccc77162838f260e8bb63ded287edd9b26007", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622961, "uuid": "b3e4066f-4f16-437b-b0d8-194729105d74", "comment": "Malware payload (Heodo)", "value": "4f42bcf6b228e22411e9a0350a1271ba135f4be148e5e60e51123f649c36abeb8c74fa68c75e22d34dc83209c526743c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622961, "uuid": "5a037de6-a293-4b49-9615-ec90a9c58822", "value": "T10F35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622961, "uuid": "516a18d5-236c-47af-a31e-fd2f8dbd37d0", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622961, "uuid": "40d748a4-4784-4e2f-bc65-e4b281035e1a", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/oTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/oTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622961, "uuid": "58ac41c8-f2ea-4be5-9574-f3e1486737b9", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622961, "uuid": "5afe25ba-b3fb-43da-b5bc-380f84f182c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622961, "uuid": "b3b13256-f5aa-40a4-a1ac-ea2679fdfaff", "value": "6d6fd7a05973f9939e51556798d79021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9d4219-949e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645616842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616842, "uuid": "e44c9ddf-91a5-4727-8063-dc7b354adaa0", "comment": "Malware payload", "value": "d52cd06c595fe336424dad34ce69172d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616842, "uuid": "ad091bad-fbe1-4581-928a-71f9f2c7b82f", "comment": "Malware payload", "value": "1dc5c4d45bddb494f88e347f3edcd53d23ccbdbe7209de6d5f2a34b34f3f4e20", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616842, "uuid": "5df966ae-c6c1-42a8-8499-e9bca80454a6", "comment": "Malware payload", "value": "c39255fe78a3ccb6f0db21ae92a848996f0be085", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616842, "uuid": "a50a788f-23d4-4d5a-8f38-991aa7f31d3d", "comment": "Malware payload", "value": "cbaa532c4fc6e0731046003b631945eb21fc6d759615826510a7e5ae9e504e89dbe84e3a69a46a4f7d50cad3df71b3b8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616842, "uuid": "0c02b95b-b739-43ef-9535-c997f682fc75", "value": "T1E2547C06B3D2427AE5D70771275FA3A2DA32EC789662412B4245B90D3EF11A4F7E32F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616842, "uuid": "b20d5fd6-7179-451a-abfc-7452eb07ef61", "value": "3072:UB97NIA+/WQx5TYD9yOePnAF+75wgz88ereWn/7w05g0a9oYp3DaAw8fMzxdygKq:Uel708er1nzTxYp3DaAw8fMzxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616842, "uuid": "ba0ddd2c-2c7c-4a21-9e6d-11fb06dfa96d", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616842, "uuid": "e33240f8-c978-46de-a826-21bd4856d2e4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616842, "uuid": "bea36e44-14d8-4302-84db-86f7fbdf6e1c", "value": "DOC N\u00ba 0536721657986767009xutyt56.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b5dadf-946f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645596917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645596917, "uuid": "f4d1842c-ff60-4053-841b-e8bc725da16b", "comment": "Malware payload (RedLineStealer)", "value": "d01eb44bfb02e03a9280ba7e348be710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645596917, "uuid": "d2e1bd61-4c6a-4fa9-9975-a66c4e6534a9", "comment": "Malware payload (RedLineStealer)", "value": "1ddbe4b8bd2199ba2b52ddae006365a191e380b52196ad950018f53db5ea5c0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645596917, "uuid": "f0b74f77-3ccc-476b-a718-f4cd18619a47", "comment": "Malware payload (RedLineStealer)", "value": "c5080e509671da18767632788c4a7bb34295c093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645596917, "uuid": "08bda8da-ed51-4739-9417-b5341d2985e0", "comment": "Malware payload (RedLineStealer)", "value": "0d87d103a07f0b0b174f5bf90609c97ed8b4ec101f1f36b13b845b4f274dec32c682a171f6c174ef2a770a2a7d3c11f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645596917, "uuid": "a90a2185-4f4a-4b96-b722-fc91f164e6e2", "value": "T1553633850B613057EAAA6974F34C53CBF941707CD1F3EE0F73BE342A9380695A46A399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645596917, "uuid": "ef2d76b8-da86-4bff-b072-238d7fdb62a1", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645596917, "uuid": "3ab39da8-ed37-47a7-a992-5b47c4990424", "value": "98304:Hmrri2WO1gw+aSNgsxMq701BL7fQSrKZsRiXhcQWdND:8i9Oaw+PZxM2KZYOO8ch3Wd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645596917, "uuid": "8047e180-904b-4208-bbad-b4a6351f6df2", "value": 4867888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645596917, "uuid": "be6f085c-37dd-482c-976b-3d39cae17c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645596917, "uuid": "d84a2030-77b3-4c04-a8af-f3874a9f212b", "value": "MBSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04126567-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645630007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630007, "uuid": "ca7828cd-41d1-4e61-9fdf-23f6f2c4bb9f", "comment": "Malware payload (AsyncRAT)", "value": "b05bf67b8b2bf8f784d43aa9b51f5336", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630007, "uuid": "927659a2-064b-4d5a-8841-f67050aa262d", "comment": "Malware payload (AsyncRAT)", "value": "1e2fdb811fe57821ee77f20c66996c8a52c64cd819326bf92f94976ed190d811", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630007, "uuid": "b1606d0a-99b3-4672-842c-dd2aaab6fa6c", "comment": "Malware payload (AsyncRAT)", "value": "720e2c6b17b784db0a1424f998c5b9e698628dcf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630007, "uuid": "5dbfcefe-f488-4c8e-bef7-4a7a08e34f21", "comment": "Malware payload (AsyncRAT)", "value": "f5347bdd904f5a6b0ab06d169beb7df70bbaaacfe300967444e5472ddf40213f56304a3fcb7ab66c641e2bca0743219c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630007, "uuid": "10b7edc4-a1f6-457b-a829-6dd1ed0915cf", "value": "T13D42AE34EEECA8D9EC078086F9BDFE264DD7B15408D80666724CE23187DA7702BA6446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630007, "uuid": "23b413b1-2b66-4075-b8e4-53ab3ee08aa6", "value": "384:J+Vz31YZOAioBRmS6QoYjmCInrA7ET1D60LDwPRAH/k:GzFHoe7QzmlrAy1DtLU5AH/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630007, "uuid": "acb618ce-6dc1-44c8-9aa4-c86c63193c3b", "value": 12375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630007, "uuid": "308c63f3-f3bd-45eb-835e-7cfebe93baee", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630007, "uuid": "e2131920-72b0-45af-bcc9-40f1847d7841", "value": "Pratka Econt 5300133634052.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38042cbe-949c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645615921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615921, "uuid": "57ef0c29-5985-47c9-b71b-bfba3ebe092f", "comment": "Malware payload", "value": "e8d7014eb51bad3d343c29e862ac2c13", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615921, "uuid": "96d5e7c1-11e4-4ff7-bbf5-4cf9f04fb176", "comment": "Malware payload", "value": "1e6d7e8857028df306e9f3a19186e94a56688a40087127d5d75bbc3908f244d0", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615921, "uuid": "e7f82e10-1725-4ab0-bc74-63088e805482", "comment": "Malware payload", "value": "df9ddb9c8582f2678cfbc6d415bda2f035f041ae", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615921, "uuid": "5153a080-27bf-44da-85c8-a8d914d4f0a0", "comment": "Malware payload", "value": "0b85d3de236e309a119e15aaa2b66055f670f7a11df9d8e013abe66f2f124482f5c73404aa66aa87e2eddf8e6f2ea99a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615921, "uuid": "88ceaf09-0244-498b-baaf-43fbc3d6ba24", "value": "T11714023C7A4BF786C976993804B1C8914AA8FF0370D6B6A60468F1F635799C6357A333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615921, "uuid": "8dc7c37a-b1d9-45a7-b7bb-98c80c95da17", "value": "3072:T85161x6trZqaXJHKC4xW3wiiJFgY8ue3k6X1i6aFpOi0mZDyrX07/jboYW4i3jp:I5161x6dZqa5HyxWjiJFgY81VXw0mywM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615921, "uuid": "4d3e5352-34a9-4960-8551-2a8c73f2c355", "value": 190680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615921, "uuid": "4aa8abda-c2e6-4531-8c12-d5c2ec2803ea", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615921, "uuid": "b971839d-5f8b-46c2-90fa-901dadff527d", "value": "AIM Players Presentation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf2af1a-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574966, "uuid": "dbddcd56-3fca-4d85-b3c8-c4c80199cb9f", "comment": "Malware payload (Heodo)", "value": "f86e4eed083343e151e62a486c5c60ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574966, "uuid": "00a3e6d1-e65d-4ad5-bf02-1d8f73296daa", "comment": "Malware payload (Heodo)", "value": "1f62b32d5991c1873c8f6ace0279f537b5e6de1977bfc77e5d3e3543350f9a38", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574966, "uuid": "2182f47b-4b0f-4efc-a9bb-fd500fe2e55c", "comment": "Malware payload (Heodo)", "value": "4bac80ddc8ed3b2db7cb924028c41cf87e710590", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574966, "uuid": "bb7f3eb8-ce7b-4f0a-a66a-9de6d9cf0ff4", "comment": "Malware payload (Heodo)", "value": "d496d903ac8c87ef9a42fa56f35b5a7482bb2ffe25c184b6ec25a2e7aa587e081322c055daa08e48e2f9bf891fad5523", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574966, "uuid": "f975ec98-2b70-4a6f-8166-1cdbab8fe99b", "value": "T1F6B42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574966, "uuid": "ccd50814-6d3c-45f7-a346-a77558635fbf", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574966, "uuid": "c5fa99c6-ec69-4c7d-84ab-6c2605d63731", "value": "12288:IOzyEtBX2ZHq79+r6/G5YgvmgZDa6A9TU:lnmZKR+lYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574966, "uuid": "cd6c7c51-3c69-4c8c-b448-925ea03fa0c7", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574966, "uuid": "44fedbed-334c-4db9-926c-b582c1ed002b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574966, "uuid": "aeb4de29-d927-41c9-a143-87a9575d4818", "value": "emotet_exe_e4_1f62b32d5991c1873c8f6ace0279f537b5e6de1977bfc77e5d3e3543350f9a38_2022-02-23__000921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cb425c-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645619515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619515, "uuid": "7722d3eb-78c4-441f-a1f6-6f096909d554", "comment": "Malware payload (Loki)", "value": "881f5ec8744a1e7dd65fc9df24b4064f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619515, "uuid": "167c747f-beb0-4830-a835-3701c932ab28", "comment": "Malware payload (Loki)", "value": "2024f1fa838a66961a3f06028f7a2ab078f30d97033a63469c750637d7ce19df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619515, "uuid": "0435a702-a72a-4656-b057-fca762e2097d", "comment": "Malware payload (Loki)", "value": "48c2da1e224fc569ad31fc0f1dda81bf88c7ef03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619515, "uuid": "b5edb4fe-ad74-451f-93a2-18aa256b9eca", "comment": "Malware payload (Loki)", "value": "82a7fe04027c71e662ca5520efb367668347344fd54ae69ff5232c5e6dccc2bb6eb9e48d47dd9724b4f4d17f12ca9a11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619515, "uuid": "fe9bb984-86ab-4ce2-a957-66c05048d9e0", "value": "T1FF641286A7E0615BCD52B33141B39A3BFBFA97017B6246D717184F3A2A267C7244C3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619515, "uuid": "2c3d4a6c-e875-40a0-9ec6-37e2e1a09a69", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619515, "uuid": "e0055461-bcf3-470d-8f92-93518c44d115", "value": "6144:TxDDa2UOLeruAzdPwi7G+I+KLKziiLUgNSA3GbadtwyXEZrg2L3oT:BurnzFvpIKNQgNQmdtwLnL3oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619515, "uuid": "da0d29ce-4a74-4184-9264-f6d858f3b9df", "value": 314097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619515, "uuid": "20445488-0536-41bb-a23f-c0178d909b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619515, "uuid": "fedcb057-077f-44aa-8a8c-8c58a43de1fa", "value": "881f5ec8744a1e7dd65fc9df24b4064f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5211b065-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645611240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611240, "uuid": "65c33419-82f0-4d5b-8619-c73fd240854c", "comment": "Malware payload (Formbook)", "value": "582f7535a49abadea3bcedf6f814e0c8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611240, "uuid": "c7d9b299-dd94-4f49-986f-a251db29c87f", "comment": "Malware payload (Formbook)", "value": "20417b5c778f4dc3e7e646970ae4f2c7eb7a771982acfedfc9bd546e964d1c06", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611240, "uuid": "79898ce6-b8aa-4947-a341-a08954581df0", "comment": "Malware payload (Formbook)", "value": "0abbda07479aa82edcd805cf3259c2a530671ac7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611240, "uuid": "0f19b6a4-d647-485e-8d77-45fe70598dab", "comment": "Malware payload (Formbook)", "value": "33e4d500f19788231ab50f2607b150a5f73f0ccc58e6120f39cc0955909f13955d5306e33be84103899a008bac85aab3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611240, "uuid": "6a0dd383-4330-4366-bddc-743f34f265b3", "value": "T117141203F3BF2982E1D42871B543CA9AD4FAAD3F57934127201E7EC4647A875661933B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611240, "uuid": "692efa86-91ef-4535-bba8-d4bc9252e140", "value": "3072:bMoyoKTssehk98JCiroNtlxLyqFijtWJIwYMakpwcYe8k8QUfCE2GwWUIFv8h/:o4KshAWCiENvxLxJILccbE1IFv8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611240, "uuid": "f23319da-d450-4643-b059-2c579926f49c", "value": 191992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611240, "uuid": "5d02eb7b-a7e2-4593-9019-3aed33ec410e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611240, "uuid": "512b8ebd-7074-4660-adae-f39334d758f1", "value": "po#20220074.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9276fee9-9463-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1645591592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591592, "uuid": "9c4aad46-6303-43d5-8983-7399ca621e1a", "comment": "Malware payload (DCRat)", "value": "c2f1b651fe6444afd373bbf63d146220", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591592, "uuid": "6a7da7b1-e3e9-4210-a575-f3ff19f89888", "comment": "Malware payload (DCRat)", "value": "2088291b2ed5a684927fdf881ecaa17e9144cd572ee208f4af4c23ca97335a7a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591592, "uuid": "697fbdad-340c-4bb5-86e2-22b68feb8eb0", "comment": "Malware payload (DCRat)", "value": "f381fb1a5dd4896cafc202715d07e2f41ae2bebd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591592, "uuid": "3efb8d70-f516-48f4-a453-07a8000796de", "comment": "Malware payload (DCRat)", "value": "e911483f2773ab2d4b1fd7faff5fed025e21f239f004d7ffa0c9ef95930a2ba0b2af40095a4348ac3a0ccbdd1f43bf5a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591592, "uuid": "0b22ca6a-3e03-400e-870e-e76d3e2f285b", "value": "T15CE58B177A44DE01D8AE1637CDEF402543E8A9497A62DB1A7E9F339D22613A70E0D1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591592, "uuid": "f363df2c-71f9-4385-90a8-1bdeba2d5e61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591592, "uuid": "dcf9ff5c-5dcb-40e8-aa15-35fc71ca1ca0", "value": "49152:i5XXJ0P+WiDim70OwH5kcB5XXJ0P+WiDim70OwH5kc:i5/57mZkcB5/57mZkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591592, "uuid": "26cc107e-aa59-47be-832f-4f7441578f4f", "value": 3062784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591592, "uuid": "6dfe789c-081f-4aff-98cd-76261d125266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591592, "uuid": "dfb0eb30-f977-42ff-b19a-6d8d42f72eff", "value": "c2f1b651fe6444afd373bbf63d146220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a0cbc6-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645620294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620294, "uuid": "9a227673-e055-45fa-a115-3b19063004c4", "comment": "Malware payload (SilentBuilder)", "value": "8c1291da91ed9af5fb6f2d8a544a1c00", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620294, "uuid": "acf61280-57b7-46ba-8eab-6d14c9654c09", "comment": "Malware payload (SilentBuilder)", "value": "20a6cc4fc5bef1f877f0e93ada6ab979a5a5a0777869f50efc9eae0563fd9fcb", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620294, "uuid": "11426008-daac-4cad-90cc-6fec7ab24ef2", "comment": "Malware payload (SilentBuilder)", "value": "7c9d5ed9bb78592f07bf019df537ae004faeffba", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620294, "uuid": "8f55463d-92d1-4ea7-af26-315ed688cd44", "comment": "Malware payload (SilentBuilder)", "value": "25e8cd9460ec8b3cb1341e7d0ca53a260c0fb13df6ca4f7590b34c5e64d65da5f02225d00eff883fb3bfd240ddfd69c8", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620294, "uuid": "b34c9d1d-b56e-4089-97bf-5319d4d71834", "value": "T1F253184ABA4A991DE51587358CE747E96732FC104FAB0B873A49F3257FF99D04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620294, "uuid": "0ca24211-db75-4892-b992-86677fde1011", "value": "1536:sp+KpbdrHYrMue8q7QPX+5xtekEdi8/dgJ5+4kKF3XOCmGanK8oWI2:sIKpbdrHYrMue8q7QPX+5xtekEdi8/dT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620294, "uuid": "aad8018a-c292-49f9-9175-f4bcf2a5c053", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620294, "uuid": "ac0cbdb9-52d5-4416-a191-9801b9496b5b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620294, "uuid": "cd7816d5-98d9-4961-abc7-badf6597fed0", "value": "details_2302.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5f06aa-94ad-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645623228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623228, "uuid": "2069de61-8992-458f-9b23-aa001d7fc56e", "comment": "Malware payload (AgentTesla)", "value": "2a72fe4099aa862417d931decb1e0e3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623228, "uuid": "d69357ac-5235-426c-b36e-cf1699dbdcf6", "comment": "Malware payload (AgentTesla)", "value": "21614cfec6d1e5b0319d7ede5c3ff2bdd0e28f76ba8c9cf79056a5a61e2e5a9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623228, "uuid": "cbba2154-b51b-4c26-b5f8-10af352d666b", "comment": "Malware payload (AgentTesla)", "value": "40c920a04e41e5a317d26b4822be6ced3ecf13f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623228, "uuid": "622e571a-9377-4340-8946-5dcf8afb6889", "comment": "Malware payload (AgentTesla)", "value": "58193e426461fab5af4aea44acd4be46bd81215c38fa98ac8a468c9f930ff4a0786be3215f42ecf7519951a823bf7387", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623228, "uuid": "0e488a7e-5734-4d1c-853e-7ea1faeb0218", "value": "T171A4BFC550774772DE688BFCF46165883FE57E6DE206E27EEC88B08A00E1B854BD2563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623228, "uuid": "3c19f609-e8f2-4b31-bb3b-801ec57276e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623228, "uuid": "ebf80970-6826-4fb0-833d-fb564aa62640", "value": "12288:V9CMTpz2K777777777777e/w8OrXH0t5ROex6ouUbq:V8M92K777777777777q8rXH0rio7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623228, "uuid": "d7f064a6-d21e-4ea5-b500-0b3dd398aa17", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623228, "uuid": "06168db5-2a25-45d5-b5c4-9156c630dc9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623228, "uuid": "589f56b1-d237-48c6-a7b8-f85893354ef7", "value": "Order Confirmation 10095313226 02182020_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a202601-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645618931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618931, "uuid": "6148d5a9-68b5-4bad-8802-f456b8d7b01c", "comment": "Malware payload (Heodo)", "value": "18cb9cffc72079d5858ad99868e7c4bb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618931, "uuid": "6930816a-0530-4b4a-9de2-616109e1a171", "comment": "Malware payload (Heodo)", "value": "2180dc8cb0d5b66bf6192c0fd00e79ca99c631d728eae03238ce83b13de06edb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618931, "uuid": "48f048af-4427-492b-af53-edf1e37c0e77", "comment": "Malware payload (Heodo)", "value": "597aa187b0ccf6eeb476c62a26ff3e571685dba3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618931, "uuid": "8ae0c9f8-99e8-4482-b014-4c58dc83cc64", "comment": "Malware payload (Heodo)", "value": "4a771a151694648b83b677986838f777e96aafbfc3416776f98c7c19fc911d9551b652f308932b9dfa420326274f83d6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618931, "uuid": "e7c72292-f261-4342-95b1-0250876c0ac9", "value": "T1AC24AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618931, "uuid": "de13c626-dc51-44f8-959d-6927ef3c22b2", "value": "6144:CMyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:RyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618931, "uuid": "feeb67aa-2a20-428d-8b81-f255426e9558", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618931, "uuid": "b83922da-e887-4a40-8fed-ce0abdcb0704", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618931, "uuid": "c21786b7-6887-4441-a43e-6e3a5a82a8fa", "value": "2022MQ00009895.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661e432d-94b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645626306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626306, "uuid": "e13ab5db-82d7-4ad3-8499-b7d7a7704271", "comment": "Malware payload (Mirai)", "value": "2ccc1ce4912862a35a09b399772a8910", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626306, "uuid": "99b8c146-a868-4b94-bb28-e58b9981ce67", "comment": "Malware payload (Mirai)", "value": "225edc812714ed22766146e8ac0fbe8438245e54f2f24674b262a5d3978931ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626306, "uuid": "ebea64c6-3c0e-44f8-ba75-306ee469fa3a", "comment": "Malware payload (Mirai)", "value": "fd62ba2531e165ca6d7182030be57ad814101cc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626306, "uuid": "57b093eb-debc-4cd7-8402-7ec5d2feb467", "comment": "Malware payload (Mirai)", "value": "7d5f32105d90c910fffcbc2f0fed2c31743d7b805137dd508bab0d834dfd6e2e2e851a9d19e4dd9232a78484ec6e70a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626306, "uuid": "bebdc440-7495-400b-a6fb-69de23dc36ea", "value": "T1CD934B26BD651D27C1D4917B22F74326F6F6534B20F8861A7DB10E4CBF64A403227BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626306, "uuid": "b3021a8f-1b2b-43ac-b3be-cab04f1c9746", "value": "1536:yJJOrh0yJB+vq6rUZwuDGbNSFA+tij5KrtTWBphaXLF:yglz+y6QwugNSm+MdKwpha7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626306, "uuid": "4a849ed3-2a9d-4b44-98ce-8d8031d95326", "value": 96632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626306, "uuid": "c55f972a-ced8-47ae-bef1-9c4bc39155d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626306, "uuid": "898169a7-e122-4231-bbcf-f2c11a2e6d1b", "value": "2ccc1ce4912862a35a09b399772a8910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0aedf98-949b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645615694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615694, "uuid": "8cb04942-4a23-484a-a268-6f0aa662bfad", "comment": "Malware payload (Loki)", "value": "b157289edda9f79b8be09a30b8c0251f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615694, "uuid": "c555be3c-6741-40ba-bfc5-a1e6f9382b00", "comment": "Malware payload (Loki)", "value": "2316b977747ed2e721cfb9e34035b5405036625e19ec4959efa2e9bfb68de74e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615694, "uuid": "a90a27b3-d33a-4fd1-9b84-9ae79e9465f3", "comment": "Malware payload (Loki)", "value": "cac745769f58e1fecbe07875850de06621d50f4c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615694, "uuid": "d3539265-19d9-4969-a89b-eec9ae73ced4", "comment": "Malware payload (Loki)", "value": "d1edfffd2e15ce8948ac31d5d8433c1ab906b8addcd74863b1404e7afd288e5344beb524c7bf16897e7928f4e4db465d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615694, "uuid": "864a906d-1e06-423b-a7c9-c193e9a594b2", "value": "T19D141282BB640588E27847B71144A11DF0B7CD775E7654CBC895F8BE2E7A8AEC33C618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615694, "uuid": "e2fe0c8f-945d-44cc-af5e-ec290ae83ef9", "value": "3072:3/2PxR99smQy4DW+aBcbgccnfD8dwnXuXFScOLEzhJ9IXCC3+Wk747Gj3W:PkxR9mmMq+gcOa8XuXUNFXb33kd3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615694, "uuid": "79b3e8c0-fa59-4066-85c1-5ed5d68e6597", "value": 190520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615694, "uuid": "de22148e-89dd-4594-bd0a-cc2fc126a296", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615694, "uuid": "53fbc32a-1861-457b-be9b-b25af4b81da8", "value": "_YCH909237_PreAlert_.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a897ed-9476-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645599704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599704, "uuid": "b28ad6bf-c872-4961-bef3-01b1867b4fe2", "comment": "Malware payload (Loki)", "value": "ca98e4443f243ee3a23a93a3eac06a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599704, "uuid": "9ceda173-c057-4856-be81-e3d0f681eea0", "comment": "Malware payload (Loki)", "value": "23ebe8ce49e895139f26f190d36a37ec52e924db63a995901948f30111efe6fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599704, "uuid": "9b05683f-e04c-4d17-9baf-8d800f43d870", "comment": "Malware payload (Loki)", "value": "27ce6d9006b9bef595abadf33c3807a28d781ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599704, "uuid": "70d3a098-7843-4bab-9f82-7b6be49519a1", "comment": "Malware payload (Loki)", "value": "c827550007abc644f078e4cb25f300588a9f70c51fc9dadcd6bcb232e6c6ca6e366f91d28ab14b8a4a4aed389980917a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599704, "uuid": "48a85b1d-5cef-4cd7-b3fb-1acdc763ded3", "value": "T1EDE49E12F1E18933D06B55385D4A52A8691A7DF0393CF8461FE43F487E3A78A3A1BD87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599704, "uuid": "b5e35378-c5a6-4189-98cf-a1b5183f5a11", "value": "9a208a82f2ac1ed3524405196188a65f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599704, "uuid": "2736925b-48bf-4e90-bdb5-087728476311", "value": "12288:wqPCYSx1alrmI6WvcmOEgJCegF63A5WrS2x3pxjsf:wqaVIiI6WvcykBzw5Wrd3/j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645599704, "uuid": "4a7e7f1a-5b9d-498b-b9f7-8a583a072228", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645599704, "uuid": "851aa750-b0c4-409d-bfff-274760bf9de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599704, "uuid": "3da1983f-ff90-4bd3-8e49-4836668d3405", "value": "Odemeimg30998676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b4e4e3-94cd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645637171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637171, "uuid": "9fa0aedc-9ebe-4360-a8b4-0d9665a41531", "comment": "Malware payload (Heodo)", "value": "a7f7aef892b99248f072d55802e657a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637171, "uuid": "a7d64b96-1446-4a98-866e-b9bb629566c5", "comment": "Malware payload (Heodo)", "value": "24768fac4f4863bf5c7c38b93fbbb768c9e33623b6433994bb2307629511d7fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637171, "uuid": "4d57b23e-c342-47b0-9c17-e2526902151b", "comment": "Malware payload (Heodo)", "value": "9df1a59219776c36058b3841cfeee174c36f9c91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637171, "uuid": "32d1354b-072b-4cd6-96b6-2fd2061ddaf6", "comment": "Malware payload (Heodo)", "value": "4081397d97905bc9a160fb06d6757f113aae03cfdc3b5b70f4a07b9c3550c03eb0b38fef137d265008168d05fdecf0c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637171, "uuid": "94cccbcb-2d4d-4721-b3f6-a8a5d8c366b5", "value": "T15435BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637171, "uuid": "c7f733b6-a90a-4f9d-9ed9-c7a691dc1aad", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637171, "uuid": "92a10d5b-7044-4fb7-900d-1471559a7fc1", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/eTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/eTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645637171, "uuid": "49ee7b8f-ff76-4eec-a047-3d190a1dac8d", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645637171, "uuid": "317027ac-53d4-4c12-b187-058dc77f30bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637171, "uuid": "26f7f71c-06ba-44b9-9c0d-fe70dac34c40", "value": "a7f7aef892b99248f072d55802e657a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5051c4e1-94b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645626270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626270, "uuid": "89c6a671-ac7b-442d-a1b7-262dae966fb0", "comment": "Malware payload (Formbook)", "value": "f8391a575fe6ee058583475279454639", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626270, "uuid": "8af070d4-2ae2-4825-957f-3db943624865", "comment": "Malware payload (Formbook)", "value": "25c2cea54ad6c1b93026807e6a34e7278f4dbdb85fdd635cbcc83e7f247e3f19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626270, "uuid": "10a9737d-13be-4951-b8a7-e642f5a0d962", "comment": "Malware payload (Formbook)", "value": "0ba781217ce07a026a080426371f1eb11914b4f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626270, "uuid": "e779464b-7182-493f-933f-fb5757c8c851", "comment": "Malware payload (Formbook)", "value": "0c2cc2d976df28d551990ba214a898f5b1cbd1387383dda163ba36f3260eb2735a176ca82b0d5e5330b8e49178d600c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626270, "uuid": "d08dfc0d-c69e-4405-94b3-bd66582a97a9", "value": "T1E2354B9C365072EFC857C976DAA81C64EA60747B930FD203A06312ED9E0DA9BDF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626270, "uuid": "cf4c4cbb-5683-454b-9f14-3a89d1fcc22a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626270, "uuid": "854fe538-79db-4705-afaa-9dfc416e4890", "value": "12288:S5xCsIwC+tOw+suDI47v96xqcn6g4T6l9IWlpH5KGa1qZRqzwuEdLla6gYfPNbcF:Ndzw1uHS6g4TaIg2Ga1qZks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626270, "uuid": "50fa6a28-ba36-4bda-9eca-3efac124d758", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626270, "uuid": "251a70fa-50f5-4435-9a3a-0ba86ee4db61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626270, "uuid": "cef4c3b4-aae7-4206-a53d-ff86c1333bbc", "value": "f8391a575fe6ee058583475279454639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9262f4-94a5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620012, "uuid": "eea7ce2d-82f1-47d8-b1ac-4c9cbaa91d8e", "comment": "Malware payload (Heodo)", "value": "3a3bfc5e4f8573b0ef10ac5693d76d78", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620012, "uuid": "bd72e124-58b7-41a4-a884-f6cbad9e6003", "comment": "Malware payload (Heodo)", "value": "26039c8a0b54cb479fe40cdf8bec3f3f6861b440522a13ce8f82605dd56897d1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620012, "uuid": "80f64475-074b-4ca4-b075-c02e846ae5c6", "comment": "Malware payload (Heodo)", "value": "e01d2d9feb13003c430fbd5899324fea86e6ad94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620012, "uuid": "eea049df-8207-470a-a0b9-a2401c32f5eb", "comment": "Malware payload (Heodo)", "value": "b049755c9bfb0b938a6f0861bf8ac4cd9c5dd8380cff9b5f989609699e29a38607c3bf36607120847c06571daa5555c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620012, "uuid": "23f1b59b-1566-4b66-8331-3a0cc4cf76a3", "value": "T19C158D2136C4C0B6D6AF11B24516E65E72F2A9614B37CAC36BD0DF1E6E385E3CB35242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620012, "uuid": "ef67e879-3c9d-411d-ab88-44e6efe0020b", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620012, "uuid": "e3f79d2b-6039-46fe-86aa-02fce0050068", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNgTEMJdE:hDQhXJ1Td2CpdNgTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620012, "uuid": "9d1ee0b1-1f09-4919-ba7d-8d6ef27adc26", "value": 902409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620012, "uuid": "ead87ee9-689e-4363-a12d-d6873529232d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620012, "uuid": "f6b04d4b-e195-444a-8b6e-14b974ad729a", "value": "emotet_exe_e4_26039c8a0b54cb479fe40cdf8bec3f3f6861b440522a13ce8f82605dd56897d1_2022-02-23__124007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bcf5f7-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645630280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630280, "uuid": "f4ea308f-8c26-42f7-826e-00d6e4f86118", "comment": "Malware payload (Heodo)", "value": "6df575e25cc88a6e3a9306dbf2efe39c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630280, "uuid": "0fea5026-df45-4f10-bebf-a8a05489fce7", "comment": "Malware payload (Heodo)", "value": "274cb4f754d77cb7113c049a0354c449d08107507793de44a7f7e6f2bd292f52", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630280, "uuid": "986a5277-995a-4d78-b78c-d22005479076", "comment": "Malware payload (Heodo)", "value": "fdce25cb87ff3377edf436b112f77d1f2b284b70", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630280, "uuid": "e2e84a11-4cdc-4845-8912-1eef445ec3f4", "comment": "Malware payload (Heodo)", "value": "13f67786ac2bd66176b58c169f5e32303897357863b77baa7e338246434ed701ab2fb48aa9b16e3ce0c54e4d0fc7aa85", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630280, "uuid": "9151ec22-6439-413b-a6d1-ab14a64107b4", "value": "T18693022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630280, "uuid": "3b2fdd70-6327-4d22-a92b-66393ce54b75", "value": "1536:DQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:qDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630280, "uuid": "ba5e98f7-45b3-4a19-a4c7-1c39e0e45925", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630280, "uuid": "83045e5d-e2e6-4725-a51d-ba92bdca0d8b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630280, "uuid": "6ff0151c-98ea-48c6-9a0c-c7182f8e41ae", "value": "Form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ececed5e-94c2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645632546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645632546, "uuid": "bc4f2bba-acc9-4e47-8a32-2f159e10118a", "comment": "Malware payload", "value": "428a01dd15e979d4b55b83a78a224ec8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645632546, "uuid": "34b40edb-3318-4eb3-a29d-a00f230babdd", "comment": "Malware payload", "value": "284289e77cfab4bbedb6b5b8571fbb350c5014878b2bb47d9d1f749dd3aad4c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645632546, "uuid": "7c339630-d22f-4097-aad1-436b0cd68786", "comment": "Malware payload", "value": "9e7c47d050a0d562c13068304fe78eaf858ff143", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645632546, "uuid": "6f9b4206-6f87-4ae8-9a3c-586d7555d61b", "comment": "Malware payload", "value": "d9492f44ae5d03e0fa79feea47d11e08490f86024d675138ca7197de84ee89e870f5716ee87e0f06bb50f137b6591c81", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645632546, "uuid": "61b85181-fe4c-429a-ac78-dda29be9d6fc", "value": "T12375F1611EDA8E5AE7E9473F90F29A008F34D1245817DB1FAC9C32B838777A6704AD71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645632546, "uuid": "e983fee5-7f81-4603-b1b9-599c097e4b02", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645632546, "uuid": "91691ca2-7f8a-4592-b843-2155bc4f9012", "value": "24576:LfD8e+7NXiGQsRx2N/MdlWJGLmC5L8lNpFaCk7S3D9rOt/4M2LTV+jSYz3Q1km8C:LQhXUijlZiC5L+NGCgk9A4x+jVgeZZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645632546, "uuid": "f63fc72b-97dd-43d1-aa80-721631cbb47e", "value": 1691136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645632546, "uuid": "8b84032c-5955-4520-a8d9-619cfd51f49e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645632546, "uuid": "820b4f99-d940-42e7-b6b3-cb7a1f8f8699", "value": "Wrtujmagvrnztygh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a81bc64-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645623710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623710, "uuid": "2c1139e7-de52-4bcf-b4c2-350df75c2001", "comment": "Malware payload", "value": "e39505e65aec6835f680c902e1c8f7d8", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623710, "uuid": "16c37ce3-dad5-412a-88e9-579d57aff379", "comment": "Malware payload", "value": "2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623710, "uuid": "0f07d793-a477-4422-ad42-39e8e7ee2640", "comment": "Malware payload", "value": "8b2984b8838067903ee3ff95d8a6823106216296", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623710, "uuid": "efd3f6a4-974b-4558-943c-e2afbe685623", "comment": "Malware payload", "value": "f2a8a628b6616dedc1bd353a52413dec69a2680ff46762da79595f454e848e739d072ea6bd828f0c4624992d26602584", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623710, "uuid": "96751168-a499-406f-8ba0-0265ae666b6b", "value": "T148B533D2B9108628E837B1F5D143C20A7D64DB05B216F90F60D7A9A5BFD2C54E182FBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623710, "uuid": "8da61ce1-33e4-4a47-a78f-0ad1427098bd", "value": "49152:+HpPPxxWmN+ib5RSmaCX3YVcVHl6lrylbQlDaf5rMrEji:+JXxxpUmaAFHl6lK6OferEji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623710, "uuid": "bd761878-5054-4130-aeb1-4b9e76d00665", "value": 2491866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623710, "uuid": "476fb7de-7895-4607-a9aa-e0b20ede8a2e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623710, "uuid": "dde3e9f8-c525-4e5e-8d0b-44ba16365a78", "value": "Xenomorph", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7913f6-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620304, "uuid": "829d2263-a8b4-4f33-bead-6ef144df4160", "comment": "Malware payload (Heodo)", "value": "8a970df1926e1b1cc350fed10f1bc666", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620304, "uuid": "16413395-efce-4d2f-8764-c21b2e9bd789", "comment": "Malware payload (Heodo)", "value": "28c30ab190bd68cb0647dd50eefe2cec4528aa61e9be750e0a724d1374871c69", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620304, "uuid": "4dab316f-1c8a-4d8b-a243-cb82531bed97", "comment": "Malware payload (Heodo)", "value": "71322383e296272708b50778250bc684b89450b1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620304, "uuid": "8d4c9c57-ca2b-44bb-bd88-ab9899556c1a", "comment": "Malware payload (Heodo)", "value": "90b6361ee973748d4c41a9c14b710a8b11dbeb6520dc836af3a051aa1b30940a541c45e588f9124a5c0f711fc4a8b046", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620304, "uuid": "557cdbef-d7e1-47ed-94df-7809d188220e", "value": "T1D924AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620304, "uuid": "170b340f-44ec-41da-b41c-8edb4b65e629", "value": "6144:iMyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:xyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620304, "uuid": "3fceedf5-0e03-41c1-b7fc-ecddec6cfe91", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620304, "uuid": "30d2ad9c-2638-4077-9d05-9831b830abf0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620304, "uuid": "62f3baa4-cebb-4de5-a4e7-78c273a691e3", "value": "imedpub.com.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d259e97-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645610454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610454, "uuid": "9cf7e057-12ad-4a23-ba68-45a23a48cb31", "comment": "Malware payload (SnakeKeylogger)", "value": "2fd322793d47a08a178e7ff01ff49e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610454, "uuid": "726a9b0b-71fb-431b-ac40-93152bab53ee", "comment": "Malware payload (SnakeKeylogger)", "value": "29c58c8fc59149755612ed5bb9db32efa07425bd26512fc5e95515c2cbf633e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610454, "uuid": "8fdf3b8a-a9f0-497d-868b-dc8fb04e33ec", "comment": "Malware payload (SnakeKeylogger)", "value": "fe035eaba8b19886e1e82db97db9f26e2af3ff4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610454, "uuid": "5d773de5-57ae-4646-9798-2ef2bc96dc47", "comment": "Malware payload (SnakeKeylogger)", "value": "98ab7aa3d8aef5385132ed33f3cc1d850ee8534f14761a55437d4ca349e1ba7f9f398fd6d7222273213746c64e1070b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610454, "uuid": "7a67a862-fa1a-44dc-83bd-e8db52fd30d0", "value": "T16975014839AB5F3DF0B18B7219C5ECB4FA58F6331C08B3BD78516686C6A1B849943277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610454, "uuid": "fa8cc58d-e5e5-4ee1-a4dd-24ca0416b585", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610454, "uuid": "1e930bba-2a5d-4fab-90fa-3e4f1415c7f8", "value": "24576:GkK777777777777ICLKSa03h8ROCdxWwHkYdhgxN4ulc7xDzDSrCcIjpVr0K+izv:Q7777777777776Sa03iRAwHFcfvUEr+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610454, "uuid": "db6d8e41-b410-48fc-87ff-4e24b26168d7", "value": 1556992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610454, "uuid": "123c2e4b-f9cf-4e92-8c59-f2fbd0195bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610454, "uuid": "cf82456b-14be-4a2b-a1ce-76ac2a38a2cb", "value": "Halkbank_Ekstre_20222501_073653_270424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b2a932-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "2c04cfe3-283f-456c-96c3-0aae66ced36c", "comment": "Malware payload (Heodo)", "value": "212a2bc32482e91c0088020e632e192a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "5e63df0f-4738-41c8-afa4-badcaa632e33", "comment": "Malware payload (Heodo)", "value": "2a0fed889941b47db987781252c1e4d4c844af60d0ed5a3a392455410e84d806", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "db7e427d-5795-4f44-b2a8-8cd14768ae8b", "comment": "Malware payload (Heodo)", "value": "f83a40ba53978f6d9928e4eb0c27e4352c823258", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "8958e2ff-bfe9-48ec-bb1b-31954e7d1729", "comment": "Malware payload (Heodo)", "value": "020bff6344802e288552000a034a8ad723504463cc0a08e1816b3ab0992ade07290cdbedb55baed3b06bd8fba2f218d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "ebcb4aa2-ef70-48ea-aaf3-7a383f6b75b1", "value": "T1C8B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "fe61e2f3-89e8-4900-945b-d54a44743c15", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "45e497dc-da2a-444f-8029-79bcd4d0671b", "value": "6144:mv51rwubH3Z/C8N7u+kzL1w8IfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWbzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574798, "uuid": "ef8eb44f-4abd-4a25-a8e6-c360d1ca79bd", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574798, "uuid": "1e3277e0-aa06-4faf-9bf3-eece75851faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "0415094c-9ff7-4070-871b-5137768b52be", "value": "emotet_exe_e5_2a0fed889941b47db987781252c1e4d4c844af60d0ed5a3a392455410e84d806_2022-02-23__000632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3340def6-949b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645615484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615484, "uuid": "f266c725-0d10-4567-83ce-36deb5d18ecf", "comment": "Malware payload", "value": "5eef8989eeea79e2964ce6b9507120ee", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615484, "uuid": "1802d9e6-1d7f-40f9-adaf-6f8f45dd4f57", "comment": "Malware payload", "value": "2acccf1614126c99f15150cb7ea1ab9fd180f899d49e89cf1f23bdc228a6db04", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615484, "uuid": "2076a53d-c4ac-47f4-9548-16f463161aea", "comment": "Malware payload", "value": "c248ef05065e39252c35ec51a420f971c0fcd08f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615484, "uuid": "abbda56f-dd97-4909-b2ae-def4d26c3db7", "comment": "Malware payload", "value": "610c6a6036c57da884f2954b70bbf148e44c51b6767082a5029dce6ca3e0b9109efbfc8015b567881fe88d1f9a7c8989", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615484, "uuid": "a5079a76-3c21-4a54-b0fd-c2523566807b", "value": "T1D5D5330C13ABBCFDF99E052837238DE1C5AD51F0B98251A39A6819985C3F5BE13CF961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615484, "uuid": "b83d49c4-ef77-4bc8-91a6-ab4611a0ba6d", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4S:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615484, "uuid": "06518f7e-5cff-488c-9fbd-eb97a5d4f76a", "value": 2813952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615484, "uuid": "95b11660-3125-4b3f-9f99-1865652e50a1", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615484, "uuid": "caaff9d6-953c-4bbe-a9e0-5bbf255b807f", "value": "2acccf1614126c99f15150cb7ea1ab9fd180f899d49e89cf1f23bdc228a6db04.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55b88a1-9488-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645607622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607622, "uuid": "a0092576-b1ee-4d3d-84d4-131c42c5a463", "comment": "Malware payload (Heodo)", "value": "4a154295872f41734d3ca83beb2be64b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607622, "uuid": "7ceb97be-5f7c-4fd9-8c38-29a36636719e", "comment": "Malware payload (Heodo)", "value": "2af984ae33b4d169f74839cbece44ee3aa0d36eba04aeec66591780e3ceab657", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607622, "uuid": "da757fcc-3d0c-4d1c-93f4-658417bfeb65", "comment": "Malware payload (Heodo)", "value": "5bd27d8cccf2a580e105540341c7216f181280ec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607622, "uuid": "c9ab9527-801f-4a24-9fb3-e7f00af16482", "comment": "Malware payload (Heodo)", "value": "cf5ad5418aba8d5b6b1684f2601853fea2bbd26869ff52ae8a8a976ce213039a793f5f0dcf7126f9748c11bf7392e159", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607622, "uuid": "a4d54fc9-6353-4d20-926e-573cd4054065", "value": "T12D35AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607622, "uuid": "d894cf7e-358e-418d-9dc1-8c477c5ec179", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607622, "uuid": "03f86685-7754-4e91-a55a-2813d81c7064", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdN2TEMJdHuN3LafJSrN:hDQhXJ1Td2CpdN2T/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645607622, "uuid": "b27e0ddb-1a65-4c64-8906-c65b872b39fa", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645607622, "uuid": "d62cb4cf-796a-4eb6-9a0e-38148c3807d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607622, "uuid": "1c9bf7e1-cab6-413b-b45a-fd24a1cba0b3", "value": "KbX4LQ0G.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c99e27-949b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645615428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615428, "uuid": "09809c58-5df7-4f70-94f2-d871aa38cbb5", "comment": "Malware payload (Heodo)", "value": "273601917f9b319ec55b71c0b92913fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615428, "uuid": "a393ba6c-686a-455a-9d30-fed0478e2c8e", "comment": "Malware payload (Heodo)", "value": "2bef8f032de7d11d5ec80e53f417f61842fd4f2f9e98f6578653b3bcaf359940", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615428, "uuid": "d280421f-ab43-4c15-a50e-c82cf1d27703", "comment": "Malware payload (Heodo)", "value": "ec09fa2aed9631dd2d975a666a80601e7f1dd0b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615428, "uuid": "03ce91c0-450f-4ef5-967f-1591a2bf020f", "comment": "Malware payload (Heodo)", "value": "a7c9a63e898261bf16111eb93dc91833e172855e7c62b2b6aee6d880122e39563af25429cfa88b0bb85ced1b21764996", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615428, "uuid": "3d2f99cb-776b-4170-b9be-7bd04dd6b402", "value": "T1F935BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615428, "uuid": "3f2eaa38-4d95-4947-98a2-1271df375b0c", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615428, "uuid": "af835674-abc8-4c6c-a268-dc8dd00470dd", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/UTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/UTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615428, "uuid": "0daca4f6-8367-4e82-8b05-e62fb373854a", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615428, "uuid": "6e171b67-7e73-42d4-89f3-14cfc4ed097a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615428, "uuid": "1e9eb5e4-0d00-4f74-9eae-a546ffb851d7", "value": "hLMeeBc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed37d19-94ab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645622348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622348, "uuid": "63379f21-a23f-43d3-af75-a50146e1c250", "comment": "Malware payload (Heodo)", "value": "50b11391816c50ffc3e76606a2345053", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622348, "uuid": "7aa33a2d-68c5-4af1-9589-869f670caf84", "comment": "Malware payload (Heodo)", "value": "2bf3b97c464f901f84b6eb3d4942a0cbb8bcafe99e0d8456239ed700854f3ade", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622348, "uuid": "c71ba9f0-b573-4ea6-a098-132929087d05", "comment": "Malware payload (Heodo)", "value": "5734bf7ccb0cf7f42df12bdc3f0032775fec4671", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622348, "uuid": "6394f6b1-239a-4ab8-9143-14e5236fdc38", "comment": "Malware payload (Heodo)", "value": "0d0e6171475040fe3cbbab00cd010f334f2db25836b1f8bd932fa1d9746ce1cfaaccc2955b9ffa31d87bed539fef0214", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622348, "uuid": "e4be6a94-ef49-4679-a996-cce9aeb245ec", "value": "T11C35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622348, "uuid": "afba5b69-a9f6-4b19-86c0-e6227db75a94", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622348, "uuid": "74f00175-47d8-4d23-97e8-f56386b486ea", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/ETewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/ETeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622348, "uuid": "117a55f7-0984-4b7b-89b0-58b9a52dbcf5", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622348, "uuid": "9df760c5-739e-42d9-8f87-12da887255e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622348, "uuid": "86716669-c154-4ef4-bb34-e43a3bf836ac", "value": "9IBuA4SpHBBgX5bzW6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea98ded-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645630133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630133, "uuid": "1130e683-e77b-4b64-96e2-8b6b29e150c5", "comment": "Malware payload (SnakeKeylogger)", "value": "fc91c1dccf7a1bb16575e7a507e6af7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630133, "uuid": "56e2ce4c-ba9d-4703-b0c2-ca0878dc7c89", "comment": "Malware payload (SnakeKeylogger)", "value": "2d730d934005487c7212ceae4744613016fb79be027f149d6be884d327fc4c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630133, "uuid": "cc1c51cf-5b9d-42bd-8bcf-db7afdd0b33f", "comment": "Malware payload (SnakeKeylogger)", "value": "95281e52ad7c6b3523d4f286950a0a0356472fba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630133, "uuid": "b38d2d74-efc8-4da5-864f-97333ec86eea", "comment": "Malware payload (SnakeKeylogger)", "value": "41285632cd1ab0bef2c50d85aa5ea2162ad68cf12f84260ef27020eb86a37aa5a6e383a204c4783f568735aa4ce1756d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630133, "uuid": "e899d4fa-774e-4d7e-89c0-da4e5e297619", "value": "T1DF05C04439A75F3DF1B19B720DC5EC74BA9DFB231C09B37D78952246C6A1B8088436B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630133, "uuid": "e82142c8-33c3-404e-bc40-4549dd6006ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630133, "uuid": "c2c1a342-0047-40e9-9a30-367fa0b3fff8", "value": "24576:tjcHuK777777777777p8jb8JsCWuq4IRwB/4D4Z:+777777777777KmBWulIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630133, "uuid": "695fa03b-1a62-465b-82f9-b59f39887863", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630133, "uuid": "2967f0a5-b231-4e92-bd93-03efdda610b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630133, "uuid": "aa550aad-c7a5-4a47-8564-263ca3e96790", "value": "Halkbank_Ekstre_20221502_073653_270424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256738f9-9477-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645599999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599999, "uuid": "4885032a-c56d-451b-92d7-f0a510afab72", "comment": "Malware payload (AsyncRAT)", "value": "cd4390f74a4e13942b6cb2936753763b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599999, "uuid": "87a50d43-8fa0-4a9a-9063-e26fa20333e6", "comment": "Malware payload (AsyncRAT)", "value": "2d7bf30bd5e0cc578921a9271506b5f1293ffe7fede157484def8cf1e7813309", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599999, "uuid": "41b2473d-d34c-46bd-b473-c84ce682c8c2", "comment": "Malware payload (AsyncRAT)", "value": "8d3ae050ebff69b3d9b61b94c2a90ac47d503060", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599999, "uuid": "fbba0c9b-94fa-4cb0-ac77-334e394fb15b", "comment": "Malware payload (AsyncRAT)", "value": "7274bdf63274d001894b0495148bfd2698e56a9f8466b4246b3292fb8264999d763c6f3d6f8921d996215d3a12001800", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599999, "uuid": "76b52114-6696-452a-a6d3-a84bb26482c0", "value": "T173D49D5631FF1092D3A2EBF10FE8ADBF8A6AF173121E753931815B4A8726D40DA42375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599999, "uuid": "7700f8f6-40da-45e9-8c47-2d974ed9b906", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599999, "uuid": "ee4f0b2e-b534-4e43-a7c7-42c97ba6af22", "value": "12288:wM5VkoN+NNgmmMP5un0vDH+AWh6/KFHiLR+4a2G8Q1ecM:wATtA5uyGh6SRiLR+4vG8Q1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645599999, "uuid": "dea2424b-37b5-43a0-8082-24d3e843f566", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645599999, "uuid": "40201c83-9ab0-4db2-a145-bfd49de40cd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599999, "uuid": "77a020d8-2779-47d1-a8e1-20f04a517002", "value": "cd4390f74a4e13942b6cb2936753763b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40f3f80-9479-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645601097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601097, "uuid": "c72cc6e2-9ab1-49fd-b895-88cfdf1d5f04", "comment": "Malware payload (Heodo)", "value": "933cb4d5b423f3a79ff06ed4f0615bbf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601097, "uuid": "4dff0112-b847-4f23-b009-59aaa8fa7c0d", "comment": "Malware payload (Heodo)", "value": "2e11c61ccc0c7903bbeb33b93185feb623ba1a508e3936245364b03d88ff77a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601097, "uuid": "0223907c-ed76-4cd2-a3b8-0f0a7db9e425", "comment": "Malware payload (Heodo)", "value": "1aaa49ad615c84eb0939329f0a0844ea37476ec8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601097, "uuid": "cc33f568-bcc7-4f9e-abcb-a33f71d74ec1", "comment": "Malware payload (Heodo)", "value": "59a5bd6e5c379ac78b382efab040f217ea36eb7dda6cdd847f605d0f1886e25d2916447b5ca97832dd07efa123c126ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601097, "uuid": "a3131857-e083-4f3e-a945-06fbf8447287", "value": "T19435BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601097, "uuid": "8b4f6f6c-20e3-4e45-b4ec-3c0ccfcb855c", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601097, "uuid": "f856fa6b-51c3-45b5-8c8a-7b740e280b53", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/4TewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/4TeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601097, "uuid": "98e390e5-411e-4c03-a652-27b1ed89403d", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601097, "uuid": "e4688e96-2b10-44de-ae21-c9f232337b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601097, "uuid": "1606fec7-4e1c-4312-9f3a-ce9b38502c77", "value": "emotet_exe_e5_2e11c61ccc0c7903bbeb33b93185feb623ba1a508e3936245364b03d88ff77a6_2022-02-23__072452.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db73aabd-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "46dca04e-af85-4bd4-b431-20bcf7ce8c7a", "comment": "Malware payload (Heodo)", "value": "abf592b4ea8f01b1f1e1306889d55f1c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "2cd45d6d-b1ee-44f5-bdea-c13321e98a9d", "comment": "Malware payload (Heodo)", "value": "2e585286ad57d0fde157b616dd35a60f1921113feb75400e2575abf76bef4e8a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "ea507706-a18e-4fd5-b6f1-4641a2a32f0c", "comment": "Malware payload (Heodo)", "value": "49ddfd95cf1cd61222db8c53f8d599bebfcbed13", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "0ef22758-23e3-4795-85d8-c884e9f33b3f", "comment": "Malware payload (Heodo)", "value": "f14bd2c2fe7330e7c88436f89f4ea0d0fefc8e04daf8b4ad5e1cd6068b31008b0fe96a0c1895c72fad63c3e851aefdac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "02926f8e-4c41-4a09-8ab5-a367b9057fc9", "value": "T1A1B42902A612F13DC28FA0754D016A65D0AEC8E5277177E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "c042d2bf-7c2a-42bd-9249-279e9d87bcaa", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "1130aaf7-b231-46a6-a0fa-881449cf6579", "value": "12288:IOzyEtBX2ZHq79+X6/G5YgvmgZDa6A9TU:lnmZKR+RYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574964, "uuid": "e7e7d493-32ef-43be-ba6a-b21bbc627406", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574964, "uuid": "05555960-e2c1-444d-8d8a-c38b1b22d49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "5dde1430-1577-4332-9777-89a4a2e27d71", "value": "emotet_exe_e4_2e585286ad57d0fde157b616dd35a60f1921113feb75400e2575abf76bef4e8a_2022-02-23__000919.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fa3900-9479-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645601097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601097, "uuid": "ad30fe51-16d3-4810-973c-78480db53a03", "comment": "Malware payload (Heodo)", "value": "6c162ea6f89c4bfc07b064602a9bb32c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601097, "uuid": "308bb049-bbf4-41c0-b370-db161bce9f6b", "comment": "Malware payload (Heodo)", "value": "2eaae3b7c5cf3384ee40f36d193ccf60cb54da4caa9e9efa5c2dcb51b6914407", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601097, "uuid": "1e79189b-be6b-44c9-93a1-f113af0b4c5c", "comment": "Malware payload (Heodo)", "value": "6fbf9d85437d4619d21d27a65b717c139cdaab7b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601097, "uuid": "ecccd395-3547-4931-99c2-349b33981e8b", "comment": "Malware payload (Heodo)", "value": "eea43c0bf10d9f9c124d27251a798eb508826afebf7801f1c5ea6e2235aa968934cee66a106e70857efff1d7ac7a01aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601097, "uuid": "896f5943-ad56-4e6b-831e-637a3d30e215", "value": "T18735BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601097, "uuid": "bd599a88-43bf-4897-a747-dee030b8c328", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601097, "uuid": "5776e72e-5d0f-405b-bebf-309fc97fe858", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/VTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/VTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601097, "uuid": "6fa536b4-64b8-4e10-bfb0-ea4486ec65e6", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601097, "uuid": "94defdb2-ff9e-4c56-914f-4f75e8cdb263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601097, "uuid": "8d48c16a-3bb8-4937-86dd-35c5b3dc65c7", "value": "emotet_exe_e5_2eaae3b7c5cf3384ee40f36d193ccf60cb54da4caa9e9efa5c2dcb51b6914407_2022-02-23__072451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84136405-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645619055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619055, "uuid": "644930af-777b-40a8-b0f1-e59af700cbae", "comment": "Malware payload (ArkeiStealer)", "value": "69db5b9aaa53ef081ca8212325f13bba", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619055, "uuid": "98d8db3e-6619-4053-8d0e-5168147054ca", "comment": "Malware payload (ArkeiStealer)", "value": "2f79c41045be2704549003930a2712977bb4b854e51a55851432d01b01297647", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619055, "uuid": "d69dafd4-46c1-433a-ba29-33bdc3770f4c", "comment": "Malware payload (ArkeiStealer)", "value": "8e5dcdce1ff59d0460f9d542b10bf77687d33d5f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619055, "uuid": "04e08442-6077-4b25-b44f-7357da94d5bc", "comment": "Malware payload (ArkeiStealer)", "value": "5555ece73f191e42758178de55082d479071720afd6ee40d1e839f10d33c58c3ccc84c40ad911d0fbf07d54ad34ad068", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619055, "uuid": "3bdfd8a1-5a46-42f7-9471-6c9e2ff03c7d", "value": "T1F864AE10BBA0C035F4BB52F845B6D3ADB93E7AB15B2850CB52D15AEE46346E4EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619055, "uuid": "d32d3717-cdbd-4743-8c1a-843dd02b20c5", "value": "791d76659e45e8da008e73b27d00ce69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619055, "uuid": "b8955330-104d-4203-9909-2acbd056d5e9", "value": "6144:X8bHNbbNCgev+XTHHVoEABaN8xpzrBHDsDFqM3atkk7oudgnz:MVbogSQTH1oEAbfjsDFqptvk64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619055, "uuid": "75cf2f97-db36-4b31-990c-fa2809463da5", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619055, "uuid": "546dea50-cf19-4c58-ba80-8817790440ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619055, "uuid": "a3a2f143-da64-4539-a01d-af9d05e52c5d", "value": "69db5b9aaa53ef081ca8212325f13bba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8985b64-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645611037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611037, "uuid": "85475793-4950-4092-b8d6-e2a8bca98e62", "comment": "Malware payload (AgentTesla)", "value": "d5ece3d22f4bdcf2d6b66570108a15a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611037, "uuid": "f51019a4-f2ec-485d-bd68-402069cc2201", "comment": "Malware payload (AgentTesla)", "value": "2febe7bc04cc572c091de6c923c2e5dd61da768c477532ee89511c9e534b741c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611037, "uuid": "88c5b2f8-a18f-432b-b027-9967fa57d98d", "comment": "Malware payload (AgentTesla)", "value": "3d3a4976aeaf9aa757fd5f84cde221abe90031f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611037, "uuid": "f08d54ba-0b17-441d-b8d9-11cede1048db", "comment": "Malware payload (AgentTesla)", "value": "d4dc8c439dcac38f43b1d749175714c9bc884c40cadbdeb121266925fc6c25491a9601c458104a8b75ff0e86e9460556", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611037, "uuid": "5ba50fbc-af36-491f-8723-fef997281203", "value": "T18014026C328D9BE3F633C738683049918727EF8B45519697E6FAF5CB22329504C27792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611037, "uuid": "e3557117-44ca-4368-a535-e7dd3734c05a", "value": "3072:W6d7tIaHUTl9Tp/bffZpEo81aJbjqmlXsKkbDzsS+zYHqdghQO:hdET/FjffZK65OstIs3sUmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611037, "uuid": "301ae524-1b4f-454d-b070-82fc22dcc494", "value": 191192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611037, "uuid": "308000af-a1c3-4036-926d-8fd4d9f4f31b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611037, "uuid": "91812fdc-09c0-4840-a53c-7c8cf7240501", "value": "Revised PI-0249.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c426b6e-94b1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645625109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625109, "uuid": "5b786467-3a74-41e4-bfb8-a6ecb388031e", "comment": "Malware payload (Heodo)", "value": "e70f1c07e2987e427a45e471bfc311af", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625109, "uuid": "5c8fd457-c082-4cd7-985c-5b2ae35685cc", "comment": "Malware payload (Heodo)", "value": "2ffc0c02c5da396d7805f368c101c9fbf045a809bafbe2d2e39de75f507293e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625109, "uuid": "abcac205-54cb-4191-859c-18645328e77a", "comment": "Malware payload (Heodo)", "value": "df38bdf32700b1957f3e8341b8617069384aa1bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625109, "uuid": "d8df0952-983c-4513-b070-a8583b5240bf", "comment": "Malware payload (Heodo)", "value": "e7c7d80ee735e4a3fe6120afd96db3fb5bae9169335dffd85cf439bccb9a2db1b3513d60d94027169faadb6ff8ab103c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625109, "uuid": "2b486e3e-22ea-4b7e-98a5-1e4c4e5e25ec", "value": "T19A35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625109, "uuid": "7adfbb9c-11bb-4ecc-a66c-dfc79ab09edc", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625109, "uuid": "fc0f509a-588e-46e2-9478-e4b92e3b533e", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/BTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/BTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625109, "uuid": "a4ba3638-b1d5-4466-9225-6880cb1c2fce", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625109, "uuid": "7bd22f49-aba0-4a13-b000-54eda14d89da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625109, "uuid": "60f2e453-f00a-4893-8f1a-c45a2cdba440", "value": "DRAsssOWrDJU4W.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec3d4e5-9488-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645607638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607638, "uuid": "3503a535-5b1f-4313-b9e3-c7046d7cd865", "comment": "Malware payload (Heodo)", "value": "bb2ba104e0e6d0aa3d11710fee87b45c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607638, "uuid": "a9944656-b0ad-4b9e-bac5-e4d2408b312a", "comment": "Malware payload (Heodo)", "value": "30257f2afa1de369b17846230b159a447f8dc44437eeb31887324fb8dc383c98", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607638, "uuid": "4cc6e928-9da8-4e67-896e-661909779c81", "comment": "Malware payload (Heodo)", "value": "fcf4f9788262c623777e5e2de503a0c0d0e399f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607638, "uuid": "94e4b809-01c2-4531-b32a-343db768196a", "comment": "Malware payload (Heodo)", "value": "f0c5064caafe0336645509e2c467ceea5a00c0b0e19410af230532a1963230f8f707cc6aa9069694848914f29472febc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607638, "uuid": "ee9024b1-7cce-41fa-99cf-296682ba58f9", "value": "T1E035AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607638, "uuid": "dc19d0be-81b2-44e1-b7fe-f06c5420bcd3", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607638, "uuid": "92feae76-cd26-47fe-9b02-f47c76d88aba", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdN0TEMJdHuN3LafJSrN:hDQhXJ1Td2CpdN0T/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645607638, "uuid": "a9540617-12b2-4907-af9b-493a9240dca7", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645607638, "uuid": "6c86e71e-f364-4de4-93b2-85dc542b8b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607638, "uuid": "114a783a-b18e-4db0-b399-36c13eaa02d6", "value": "G0cnu2ZoVKqHjeRF0SZyvcyN0tW6Nz.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c484a63-9464-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645591930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591930, "uuid": "97656e7b-eff1-4a78-94a5-8c6f6483af58", "comment": "Malware payload (Mirai)", "value": "9eca556eaebc09ec04fc9ca1fa57e450", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591930, "uuid": "74d9a845-75bb-4b93-b86f-f217b097b685", "comment": "Malware payload (Mirai)", "value": "30d864747c4fae627d3ec49661daf170847a51f3de64686b91b0f04d633564f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591930, "uuid": "389e735c-01a7-4ce0-9d98-2131950ac32c", "comment": "Malware payload (Mirai)", "value": "f9d3e73032743a51619d25bf69b398d681588be2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591930, "uuid": "ce6f6a4b-451b-4505-b12e-ca7740748bbe", "comment": "Malware payload (Mirai)", "value": "0612ed41f95ee46b76141294aade040909d9a4647810d29412cc828a6707f58eafdbb6159a06d2fa8792c559efb92812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591930, "uuid": "24ca2f60-deb9-476f-a0d1-38d9cd7af530", "value": "T15EF2E1BD284304A6F3AE45F11BD707042D185E37D88AAC6F654B969F4AE60B03C47ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591930, "uuid": "b41fd749-b491-49ec-90ba-761028b0c181", "value": "768:7AKNiHVfCPYGU7/Y0tAU8t+ziCCFowyCBfXYIgJPY3kRSeoJgGlzDpbuR1JK:7tNi1fCAG+TtyI+DuU1YBiQSeoVJu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591930, "uuid": "615446d3-00f9-489c-ae31-8a929b3b41c7", "value": 35016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591930, "uuid": "63ceb08d-b9a0-45cf-81ee-2ae09f46c845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591930, "uuid": "ebc93c10-f40c-4f0d-b78a-941759557f7c", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.11156.5796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411020ba-945a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645587590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645587590, "uuid": "6e8bc08c-20a3-4642-85ee-ba61707c43d5", "comment": "Malware payload (Heodo)", "value": "7baad56cc483132b8b9cb7a14722c3b1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645587590, "uuid": "7d990e66-6364-4d1f-860f-c2467b3ba62e", "comment": "Malware payload (Heodo)", "value": "31cb0d7a224f16ec4e998140c4efde8ef752295b8a88080915f0bb2b49034bee", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645587590, "uuid": "ec0cb95e-f22a-44a1-a954-8203617c95c3", "comment": "Malware payload (Heodo)", "value": "602f7933c443765697bb178ca137f17f81856f0d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645587590, "uuid": "7b0efe47-f6c3-460b-92bd-2da6f5085bde", "comment": "Malware payload (Heodo)", "value": "df796462c4588964e34325eaa7f2a887136e069dc6d31d4658984f4864ec89d5fe8fdc7ae1d2a4ce70121e383b6f6359", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645587590, "uuid": "47851169-e84b-4af3-8bfb-78adb0fa53b1", "value": "T1F34153A0B65C4778215A5AC5D1E7E85CD60B18D358287E2DB894A3EFD21CBF383B740A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645587590, "uuid": "f9b63c69-3d10-4323-92b4-d06cc7af185a", "value": "48:G7GafbEucQ19ksqXXPCehEIYrd7IchPrR8Qcraj:aEucY97NtIYrVIiVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645587590, "uuid": "5d35bf8e-f9c5-4950-a7e2-01cee2c74139", "value": 2034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645587590, "uuid": "1251e73f-e947-462d-bfef-a818f3d12868", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645587590, "uuid": "0fbabf51-02b3-477c-a992-b0677a73e26a", "value": "test.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15aabdbd-94d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645642063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642063, "uuid": "37fa24ab-a37f-4ede-b5d2-f2a21c487b47", "comment": "Malware payload (Heodo)", "value": "ef2fa79e978a5ee2e7907f75ae8e5171", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642063, "uuid": "94d35f04-219c-457c-b8c1-2ca892f66d77", "comment": "Malware payload (Heodo)", "value": "322d3fcc6e9105184fdf236f77524c21e0642addcd0fc24adac31cb02581fa47", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642063, "uuid": "dbd2a1d1-4e4d-4880-97e6-d8906c6c2740", "comment": "Malware payload (Heodo)", "value": "e8501924d477a76e38dcfc4ecddc0e390a8e5c08", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642063, "uuid": "a8c320db-7c83-4417-b1f3-ed481f2a0190", "comment": "Malware payload (Heodo)", "value": "782356b00b010f43fcb9b98016ac05ca0874b477513387dccb188077387170ded2b7559be0387c6d5b0f7842ad1b8516", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642063, "uuid": "c648d6e7-f81e-4c38-97f4-360afbc1310a", "value": "T13E93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642063, "uuid": "ce6edacd-e61b-4cdf-8e4f-01f7b0ca575c", "value": "1536:/QBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:WDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645642063, "uuid": "8ed37c9e-cf7b-45d7-9964-190809e4804e", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645642063, "uuid": "1d478ad8-bb25-42cf-a039-23f117a3a0c6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642063, "uuid": "fd1005f2-882b-45bf-ad6d-2342db9a404a", "value": "Opast International.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb14e488-9463-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645591740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591740, "uuid": "d48e0d24-7771-4cd9-9b5a-287741c19bfd", "comment": "Malware payload (Heodo)", "value": "489b42cf92870ee11980aa0473cd177f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591740, "uuid": "166518eb-d65a-416d-8e1b-9eeb8a5daf4a", "comment": "Malware payload (Heodo)", "value": "323eed758d748575401373afe468c266822c94d8379330cb91c615d62780df2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591740, "uuid": "9d5eca7b-d9d7-4b3a-a9f8-c5da83bac4ef", "comment": "Malware payload (Heodo)", "value": "6a31fb722ef973c34092c721bd1e665a26343915", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591740, "uuid": "b5094d77-8eed-45b8-a7d8-e9c4acc7bb1f", "comment": "Malware payload (Heodo)", "value": "c972c19dc9eb0bfd300776953e05588ba579ef6303045105901310424222ba81eb7dec43c2aac24cc2ba4fa71c44c0b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591740, "uuid": "abd5e633-50be-4dc4-8db8-171446737726", "value": "T13FB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591740, "uuid": "5715512d-1c89-4930-afb3-635c7c2ad902", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591740, "uuid": "898184ba-581c-4f8b-b83d-5ca2b51344eb", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wZIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWmzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591740, "uuid": "7611e484-fb94-4003-946d-db441d03e279", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591740, "uuid": "cbd38f05-d57e-4328-bf7f-bb0c47954777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591740, "uuid": "5c27da19-879e-40ee-a1da-e230a5172617", "value": "489b42cf92870ee11980aa0473cd177f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52ce547-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1645610977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610977, "uuid": "c3e35602-7975-453b-a270-d2ce4b16eb84", "comment": "Malware payload (RemcosRAT)", "value": "5fe1fef6a76229ae34a45ed69c9d1311", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610977, "uuid": "5757acbe-c9b2-4bf9-937a-4057148d1bc4", "comment": "Malware payload (RemcosRAT)", "value": "32ec31634ad3597469e9aaf487617b39b11538da4761004cd8b6a4976c27e1b6", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610977, "uuid": "4560b3ff-8fee-43e3-8327-11e8c2dddc57", "comment": "Malware payload (RemcosRAT)", "value": "1513f398664acb93a175e70a1e427a53a78b4085", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610977, "uuid": "4ba801c2-70fa-416a-8422-e3328b8ee4cc", "comment": "Malware payload (RemcosRAT)", "value": "a45856f2f920f7dac1ae21e4fc52a77c78f8096ddf2ac4b475de2f244f7618e921ae2a8e55d25066f12c69202480ff7e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610977, "uuid": "2cc3f9a9-3511-47fa-ab92-4f7a3a5296bc", "value": "T1D8141279AFDB5201FCB016F06B73852025F9AD610D6111066C09B38EA1F9B6FB93E27C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610977, "uuid": "d6bb93ad-0cc4-41ec-b07d-33512fa71f4d", "value": "3072:G8ZXD0BKfRgms68G7TGYm13d9DU3Hgl1y8J8xP7YU8pAC+6sMcT9F+2ewZk9:tfWmAKA133Zl1ygGPQAC+6sfHxS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610977, "uuid": "6bf62746-964e-45dc-9c85-81d4d57452ed", "value": 191144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610977, "uuid": "7d15c3ce-d496-4a6d-9f23-200709e02a00", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610977, "uuid": "44594d1e-7e12-4c31-9930-ab749072aa4b", "value": "Revised Order 2-23-22.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d516380-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645623742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623742, "uuid": "d1f534f7-5edc-462b-9839-1df6dccc5540", "comment": "Malware payload (Formbook)", "value": "055bb9d26064b091388362cd9460d440", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623742, "uuid": "0f48b5bd-7b3a-4585-ac68-c3ba4f1587c0", "comment": "Malware payload (Formbook)", "value": "335fa8671bb1ef8659247de4bed05898512fb3a056ef6deb31849eefef8a4743", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623742, "uuid": "1bf0556f-e29f-445b-ace1-7735ee2e3704", "comment": "Malware payload (Formbook)", "value": "0edd4226c1c62dfe6c3fdeb272eade9c8773d2a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623742, "uuid": "2ca80499-59a8-4c36-bfd9-5e212fb449a9", "comment": "Malware payload (Formbook)", "value": "35ae7fde0748fdb9ba22bf9d2e834a3c86e65f00cb391abdefa3b136722d80c474c5a27e8acc9d71bded4653a8d28f62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623742, "uuid": "26abaa44-b1bc-434d-8adb-7e6ee5d24de4", "value": "T187642239B3F0D5BBE9590370A173857AD3A9F79229B22A0717E46FF2927120795027C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623742, "uuid": "089b6b20-1eeb-440f-9af5-44af69ec47e5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623742, "uuid": "2a258080-6218-4207-ab84-5ebe90d5ba1c", "value": "6144:TxD4QE6Nh+pYG3NNMRSPtXKWvwRRNWar3khZf0hYcVmI:+QE6Nh+pf9NMRcVJw9VQ8FVmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623742, "uuid": "e19c5fc3-d067-4152-a704-bbccbb60f40e", "value": 324424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623742, "uuid": "a659ae45-cb91-4847-8120-34e5edc1ed39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623742, "uuid": "28eff5be-a5da-4229-91ac-010458e893b5", "value": "055bb9d26064b091388362cd9460d440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fc97e0-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645610500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610500, "uuid": "efa71569-236b-47df-8285-4ef1a562770b", "comment": "Malware payload (SnakeKeylogger)", "value": "bc3dc52a8fda71ca0423e3f73f123c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610500, "uuid": "0ee06a14-5145-4d98-8476-bb2e276faa7d", "comment": "Malware payload (SnakeKeylogger)", "value": "34712c08c1f46ab69de4852db25e41ca846fc8246b8337dded481c8a03ff1d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610500, "uuid": "456480df-5842-49b1-880b-55720e48884e", "comment": "Malware payload (SnakeKeylogger)", "value": "fedc9eea971ac55689003bd1529118319de6bdec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610500, "uuid": "7a48c335-2adb-488a-9634-d3fc41e90d1a", "comment": "Malware payload (SnakeKeylogger)", "value": "feaac48fc8bdfff23c146268566ff87c8a76a7bfab3bda79bb9eed6bfe686fe7816797883d7e4241609267bd0e79d7cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610500, "uuid": "0621bdd8-3cbf-4085-abb4-3f7ad86800ce", "value": "T15825399C365072EFC867C972DAA81C64EA61747B930FD203A05312ED9E0DA9BDF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610500, "uuid": "638d62ff-dbdd-430b-8926-ff97e7bfbfd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610500, "uuid": "0f87c64f-0e72-45cf-82e1-c14d80c602d5", "value": "24576:dfrXymjAEJWKzD4lVDG2MNVN/0Q8bfkP:d28bWKz0vXMNVfMfkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610500, "uuid": "466daba6-ecf6-4e9b-9d55-b2f8d51419d8", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610500, "uuid": "cc9fa8eb-0d6b-406a-b47f-22584d37bd5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610500, "uuid": "9e508584-9a4a-4e26-be3f-09ed5b1f6f87", "value": "5lW8XUXLS5Jkj6p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5776b7-9498-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645614242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645614242, "uuid": "cd7b6cc1-8c18-4f23-afba-1d163119529f", "comment": "Malware payload (Heodo)", "value": "41bb8680c2a3c3d2d7ae6bd88d258cd4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645614242, "uuid": "ee386290-c145-446d-820b-7ab9906a5309", "comment": "Malware payload (Heodo)", "value": "34eb11ccf65166286782f2511e200d04533ddb98c000e525efbc528360a7e233", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645614242, "uuid": "7d502bcf-ceea-47bb-a450-196b284f10c3", "comment": "Malware payload (Heodo)", "value": "16829199e674a2e74c60032ef7875c3cee46e3ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645614242, "uuid": "7785eeed-3a91-4da7-8c4c-46a3188a2940", "comment": "Malware payload (Heodo)", "value": "94502f5941f78a9f9e65a572f7c4eb987e5327299332eee5ce4bc76de5a325e01d76e69e00e6ef76ceae946046040892", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645614242, "uuid": "0a657b3f-defb-40b9-bcab-ddc9f71be210", "value": "T16735BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645614242, "uuid": "17d13edf-4eb5-4595-8729-b7b30ee5442f", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645614242, "uuid": "1070d650-fbe2-459f-a222-ee7a7a17dbf7", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/lTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/lTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645614242, "uuid": "0efeea67-9fda-41f8-85ac-0be19a54bfb3", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645614242, "uuid": "5fc078f9-33c0-44e6-b689-1fb2278afedd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645614242, "uuid": "9282f016-7a68-4bbc-897e-68c94401b1f7", "value": "DDN6gp3RCL1CSZ13Xm2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44b654c-94b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645626464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626464, "uuid": "707c48de-683e-4e2d-b3a5-a32d86421fb7", "comment": "Malware payload (Formbook)", "value": "6cb30a9f9d530785abcd883a5462f62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626464, "uuid": "ba234f9a-0120-4771-9c49-d1c4d45220f4", "comment": "Malware payload (Formbook)", "value": "3554e8a6c968467f681a97f7d0af60e7be69d515ee9b093b8be749811ec99c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626464, "uuid": "72ee763f-0186-40af-af1f-96a0e00ab08d", "comment": "Malware payload (Formbook)", "value": "70ff7701f5278d3ad314c7badbdc00f2f7bbd1b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626464, "uuid": "1bfe36cb-65aa-474a-be09-dfeef964c429", "comment": "Malware payload (Formbook)", "value": "1a6c1e9c7afa2ecfb09eaa3449d75d2e16a10e6a879122b9508193aad8a2f391da0b524c30845fc0de5d62e8da8c1f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626464, "uuid": "df09ee44-5178-4779-842e-2fd6d860fdb7", "value": "T10F05BF083DA70F3DF5749BB21DC4ECA4BA59FB231C08B3BD78516696C6A1B408993277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626464, "uuid": "f6266780-f3bc-4893-974d-040c419683a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626464, "uuid": "5fa507b9-cb99-4349-ade0-209b8ade4212", "value": "24576:8EK777777777777p/vNkKoieRMQSlrsLro2fXEGE/+Mt:W777777777777yMQ0rmBO/+Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626464, "uuid": "5baae821-7b40-4d31-854b-25d91f5e1d8b", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626464, "uuid": "e5a8b35e-39ea-41c8-a593-be71752feb8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626464, "uuid": "3cdf9e22-4f89-48a0-929e-7931e3e94436", "value": "Gv694Ht4iPIaqIv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bde213-9479-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645601100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601100, "uuid": "de53cec5-7476-43d5-9737-afa900cf381b", "comment": "Malware payload (Heodo)", "value": "9eda958cc6589b3452f7a77de90d852e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601100, "uuid": "c3d160ef-2cd7-41d0-ba10-ef22e8d09f39", "comment": "Malware payload (Heodo)", "value": "356c9645559e02bef8dec816d94e8d308d4004f655e3456d600385a938ce452b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601100, "uuid": "5479743e-10af-463c-958c-d7b84fa4f780", "comment": "Malware payload (Heodo)", "value": "6c02f27eedc70d9dd21f82730e42e2bfc9f66e63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601100, "uuid": "13609c42-4319-4df7-a4cf-0c72a0531811", "comment": "Malware payload (Heodo)", "value": "bdf66838a6a7576a1fd64f761ce1e4d470e81d7bba4286e7f85d8c8365dd304630d87b2f19d879686fa5edfdece45374", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601100, "uuid": "fbd5647b-c765-4e99-b430-3cc260a1401e", "value": "T1C435BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601100, "uuid": "77745a55-eafe-48d1-aac3-20fec54c1f52", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601100, "uuid": "13515015-1bcc-401f-b875-eb46afd74f4a", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/gTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/gTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601100, "uuid": "ffe34c8f-5e55-4927-bd94-64e40671bc37", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601100, "uuid": "3968dbf4-b193-4584-83d4-40f3367f0045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601100, "uuid": "b7dc9449-eb90-4118-b221-84a8520625cf", "value": "emotet_exe_e5_356c9645559e02bef8dec816d94e8d308d4004f655e3456d600385a938ce452b_2022-02-23__072454.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507d02dc-949e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645616821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616821, "uuid": "77b1160f-58b6-45cb-bd45-d01eb251d779", "comment": "Malware payload", "value": "75a281d5ee5cc5983d464158991b05da", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616821, "uuid": "52114c9c-853c-4076-a531-c9185d2dd6d8", "comment": "Malware payload", "value": "359a81edf4c5b44f3a897ab1d75d71105b289cc31bb78b616fae22a19062a358", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616821, "uuid": "3b2ea607-8a73-47ab-8329-02ccf00d1420", "comment": "Malware payload", "value": "ee0f07837fe29643b9bdc34a246a7ce5a55bfee1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616821, "uuid": "2b03b9c4-fd45-4e16-b2b5-f1defb8032f9", "comment": "Malware payload", "value": "a68ced9843000888ae79b377884a1adf49cd4016ff072183cde8fed3d5c5b24fb523624a0963e0f03b3fa1941365101c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616821, "uuid": "c81ab3de-9551-4f38-ab6c-f0b0835f93d3", "value": "T15BE54A22F245673EC76A163A4577A258993F6A7126228C5B17F4CC8C8F374C32B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616821, "uuid": "242198da-6dee-424c-9052-7d5da62a1cbf", "value": "49152:tuDvTyDmTyBUfIkqJZoSGjC3cUvivMD04vTQoshaOYOEA:+aPUfI33D0bhaOYZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616821, "uuid": "e3ca038e-1f4a-48a2-9205-33e3ae21b435", "value": 3284992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616821, "uuid": "797f55a7-9092-43b6-8547-8684876017ad", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616821, "uuid": "d48ea47e-4e8d-4dd0-9117-faec83876e2e", "value": "EndesFact2302.Archivo.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ea3e35-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645611348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611348, "uuid": "a3828eb7-9a86-468b-8e18-904c4b95d047", "comment": "Malware payload (Formbook)", "value": "36774f1d8a322ba7a95b339b2e7369f8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611348, "uuid": "ea254f24-0c04-4d9c-bb75-2e2058b35459", "comment": "Malware payload (Formbook)", "value": "362f14c6417d960b26ab12d97a6f183a5bad4a2543cfcdd5ff73a30202de033b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611348, "uuid": "fb11b558-dd96-4951-9f7a-6cd09565d809", "comment": "Malware payload (Formbook)", "value": "5db7b916ada3a69d629a8cbb327f07df4d579ba5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611348, "uuid": "7cb3c439-015f-4de6-b221-55259a2a2cb0", "comment": "Malware payload (Formbook)", "value": "55d77b800f4523a8481587a3db2415bb538acd22d5f52e3f777231fcd887ac7aab3bf9c37e383140483138a60a3815d2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611348, "uuid": "e905e5d1-186c-4210-b852-ae60b5d63500", "value": "T12F141284314BD5F3E7B34B375F96C621552DDC608A9A6378DA86F7EF00F76A382041A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611348, "uuid": "47f85899-7fad-4c93-9e5b-fc7712003a53", "value": "3072:T11gscPZkrUFB0JnjJQ6HfUngvv+iliyfJ+xKXP9wt:wsW6ULWOlnilBoAFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611348, "uuid": "09b454ba-9991-4131-aaf0-c2500e8b23f6", "value": 190648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611348, "uuid": "2c12b8b3-d241-4f1e-817e-ffa04714b55c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611348, "uuid": "cc2e817e-ce36-47e9-927d-46c29a29cdd7", "value": "Transfer (MT103) 160FT0624190001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba681ff-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620303, "uuid": "fc81419e-33c8-493c-8f01-00116d7214ce", "comment": "Malware payload (Heodo)", "value": "7856727e9a5fe1723e2689f990171dfc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620303, "uuid": "1e751e30-c419-4969-ba64-dd613a707559", "comment": "Malware payload (Heodo)", "value": "3699172603af1e4b54dc68d71598d8cc4518ef1061053fba24ebd5b29b84bb73", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620303, "uuid": "3c2a97cb-993e-47ae-8425-d573f5ceadfe", "comment": "Malware payload (Heodo)", "value": "c64b0b406833842fc40d5061a8722e257aea4d9d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620303, "uuid": "e71a7dc2-9e84-4d2f-9b98-f692f75f22c2", "comment": "Malware payload (Heodo)", "value": "aee99aba633d0a6db94f2ac3e246d8b4ee36d3961a3d00c4e97e24f4c0106f2b74c5a6942897e44a83d676677d0232ce", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620303, "uuid": "65d9cbfd-7883-4321-9f8c-7f6ce1707108", "value": "T1C524AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620303, "uuid": "ae546f09-d71e-4734-8f69-09e64e05b8d0", "value": "6144:GMyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:9yrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620303, "uuid": "58fc1fc1-adbb-4c5b-b7ad-afbedf0ed931", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620303, "uuid": "df22c828-b687-4c52-b4e9-5e225acaaffc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620303, "uuid": "2ce8bc4d-42c2-4458-9140-b1fce5e10749", "value": "imedpub.com_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b5c1fe-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645623694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623694, "uuid": "c42d6c15-f684-4a60-a048-55848feb8320", "comment": "Malware payload (Heodo)", "value": "2b2dd2827ff53b67dd7297c96cb1f588", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623694, "uuid": "ddbeba2d-7d8a-4432-a88c-dbaf3466586d", "comment": "Malware payload (Heodo)", "value": "36c6a11df225adc5f2c7b0191efefefeac667e0475a46cfb887254c8f942b2b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623694, "uuid": "c4e73d67-589f-40a2-90b1-eddb37a19dda", "comment": "Malware payload (Heodo)", "value": "d29be39dc3cc6caf6baf154de19726f34b1ea114", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623694, "uuid": "9362ab4a-1bd6-4aea-a52b-c948a9ee1bce", "comment": "Malware payload (Heodo)", "value": "65181b5f604dde7d36d2d5bdd9259ac8816450b4f20c235d0fa743a762e6ebb2d05f931b3800434a5ec07a736569c2ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623694, "uuid": "df2f3904-49ca-4d1e-aa98-f12f6e25dc5e", "value": "T11B35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623694, "uuid": "5dae0632-24fb-4d4a-87c4-b0904860ac49", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623694, "uuid": "9bb2e23c-d3a2-4ed0-8bd0-4559f866606f", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/fTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/fTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623694, "uuid": "09f61ee8-3c1d-43e3-ac06-d984cb60a14c", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623694, "uuid": "cc570474-8777-4601-ba89-22fa5e382af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623694, "uuid": "4b65b543-3083-4b00-83eb-11a52b1759b7", "value": "2b2dd2827ff53b67dd7297c96cb1f588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5900130e-946a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645594502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594502, "uuid": "a1a275ec-c364-4d36-b681-687e9b9977be", "comment": "Malware payload (Heodo)", "value": "97ecd77c48c3ae5d91f074e880e97742", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594502, "uuid": "28867c34-72ef-4c2a-baab-8dfe23962760", "comment": "Malware payload (Heodo)", "value": "37068ab31fbf847402e4a18eedc70f6395026671b7b5013e4df4454ebc04ada3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594502, "uuid": "8e6624f5-0417-4bf5-999d-af4d4a25ea52", "comment": "Malware payload (Heodo)", "value": "9af20d17e477c27e1a8c07588c0d54ae27caf07c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594502, "uuid": "c3547d55-3789-4bda-bf1d-d14960672415", "comment": "Malware payload (Heodo)", "value": "bf6ea3adf40bdfc2ad2fdece602590d5b52782e734ed2cd69054fc48e4f82f934bee7c17c0fe2dcbf87a39498445a1ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594502, "uuid": "a65d8857-e280-4d8a-a33e-ae22315394e3", "value": "T18EB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594502, "uuid": "380ee48a-b2fa-4bc5-9be5-81507e78d5d9", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594502, "uuid": "95b68491-a92a-460e-b80e-f41280e2b803", "value": "6144:mv51rwubH3Z/C8N7u+kzL1w2IfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWBzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645594502, "uuid": "ec0d43d7-4222-4bbf-84cb-2676a7821048", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645594502, "uuid": "d8cd5861-756b-4a2f-933c-366cd54a202c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594502, "uuid": "3729ebce-b80e-4360-816b-dc435b8ee719", "value": "97ecd77c48c3ae5d91f074e880e97742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d0b18e-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645622900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622900, "uuid": "404b31bf-7503-4fec-85fe-0a7101b72dff", "comment": "Malware payload (Heodo)", "value": "a0bc03266b45bab2910f849308a6856e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622900, "uuid": "6c5d629f-5ee7-4ac0-bbb6-7d18770ccc0e", "comment": "Malware payload (Heodo)", "value": "37bfa4b71762609bfab5620eba3261c8836659fec289ca4be1a875eb2132a9be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622900, "uuid": "b2e4cbc8-5aab-417c-981b-29265f507781", "comment": "Malware payload (Heodo)", "value": "23667d41a830d1a1d7af37709a501136c5455520", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622900, "uuid": "1d9ea6a3-5b99-4d3f-9e64-a893b06fab82", "comment": "Malware payload (Heodo)", "value": "1bee50c3190c959893734e6c5d1631a2df6bf34dd85ac3ce6ffe05bb66a5f2d4f095d92d8f4494038d97114dd2678906", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622900, "uuid": "fba23b66-e708-42d6-b477-515f8c5a245f", "value": "T188E4AE2136C1C0B7E6E321B34516A22EB7F3EA61033B99C35BD11E196B389D79736247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622900, "uuid": "c9620f35-c3e2-4ff0-ba32-ce4c2e6eb2d9", "value": "6144:jJF4l9hriKmK2miG4vj1mw90h+D5t7p4SqelSmVp2XBJhbFcqTwl4Hc5kxxpFJFx:s/9RP8f5TiefonhbF3wleXx7xXhP7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622900, "uuid": "61ba3afc-e5ab-4388-869b-eb82182013fb", "value": 720404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622900, "uuid": "ce4f71a6-6ebc-4525-a221-76366d6d778d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622900, "uuid": "8e5d1c5b-ac66-489a-b337-6c2686a0d770", "value": "emotet_exe_e5_37bfa4b71762609bfab5620eba3261c8836659fec289ca4be1a875eb2132a9be_2022-02-23__132814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ed0b36-94af-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645624018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624018, "uuid": "ab5f6ab5-d4e5-4fc0-b5ed-430f8b867883", "comment": "Malware payload (Heodo)", "value": "2b6152518a00f2208e06ce58b3263fcb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624018, "uuid": "9cd55682-5ab9-47fd-9778-29db7adf5d5d", "comment": "Malware payload (Heodo)", "value": "38061726d1934fab95da9c7d5dc704b42420c790d4160a854a068d6f8fdfd1b5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624018, "uuid": "938e1ed6-1727-4220-a42b-8cd130bacdde", "comment": "Malware payload (Heodo)", "value": "81fa98ad2390872065403447df2b6f5c0149a715", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624018, "uuid": "a3d13d4e-819c-4393-bb7b-0c528c4ac898", "comment": "Malware payload (Heodo)", "value": "3ebc6a29b25355846228d835d8019e64a2d85588784c4b1c7cfc6e46eb2f9961b18c3a9523ede3e7ebd004d4befaa57d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624018, "uuid": "9b01268d-d077-44c5-ba89-4229716d40a1", "value": "T17393022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624018, "uuid": "837030a7-1116-440c-ab15-ad3010ebcb3e", "value": "1536:/QBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:WDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624018, "uuid": "64e4b917-1476-49e8-a54b-3284ac0df4bc", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624018, "uuid": "a4c58642-9653-4ea2-b23d-85668bf3432f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624018, "uuid": "705b75b8-8b11-48d0-a369-a166f45a62cd", "value": "2022-23-02_1428.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712c259d-94ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645622460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622460, "uuid": "2a569d0f-6c06-485a-9d84-7d871d8da5d3", "comment": "Malware payload", "value": "305b3230aa20a42d48227ddac555c673", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IntesaSanPaolo", "colour": "#87454D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622460, "uuid": "aacef4c0-a34b-4d37-9069-688633239e70", "comment": "Malware payload", "value": "38c3503178301a8afe695304251815a7940f2a0bc9368f9343cb9b71823b6427", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IntesaSanPaolo", "colour": "#87454D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622460, "uuid": "57e61b33-284d-41bf-bc53-0a561e17087f", "comment": "Malware payload", "value": "be80c813b9b8eba7738fdc390c0c5a2a30f3631a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IntesaSanPaolo", "colour": "#87454D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622460, "uuid": "1ba07be1-6980-4089-9fe2-3ffd3cbe6e49", "comment": "Malware payload", "value": "ae44054843f387a998f97f7b3bbe3ba43503ab1772f5b2253b6b48d533ef9da66098bc9f0f9575b3364034764c760a29", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IntesaSanPaolo", "colour": "#87454D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622460, "uuid": "97246859-97c7-4127-a63a-a36e558eaa4d", "value": "T1FE96DFCBF7849A6AC0F243B6CD358B9625574CA98F43DA832A14773C28B35D46F45ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622460, "uuid": "1e379cf6-6205-4c4d-a658-00f16ce3ca7f", "value": "196608:s5IEDoVSLODI/cKBQ1v9h+Er686T2/xN5L9:cJtOsEsQTJG8dN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622460, "uuid": "2c3a25bb-88cd-44d7-86a0-1b6899d98548", "value": 9303227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622460, "uuid": "17b5b5f3-36f9-447a-b7dd-2507031921bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622460, "uuid": "036b135b-92a8-4495-96c4-28085959267e", "value": "IntesaSanpaolo-Aggiornamento.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf390e1-94ee-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1645651338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645651338, "uuid": "2512ee7e-a081-4caf-80d4-0e59234e1280", "comment": "Malware payload (NetWire)", "value": "f624c90ef94ca0471613b65c5c030c50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645651338, "uuid": "826105b0-e1c7-4178-8074-698913d76272", "comment": "Malware payload (NetWire)", "value": "38e03022d860e662214e8535bd8024021ea4ae1d5f58991a7bcd1c7a01cd0608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645651338, "uuid": "d0ad174a-1b48-4302-8213-c3aaf3dc2050", "comment": "Malware payload (NetWire)", "value": "82319e5c1d612e62e6f6069b27ad52179cdd64b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645651338, "uuid": "8146f775-49d8-459f-a350-a9bffac8883e", "comment": "Malware payload (NetWire)", "value": "c1c1401f8dd8fa1c9cbee35f5d853e91169946a59f060d377f5a3eeb3bc1de34b93bed35047bc5883f28887bcd4ec57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645651338, "uuid": "03276455-87cb-4477-9076-204ff18ac1e2", "value": "T1D7D31A04EE87A0F2FE0B4D70A5CBF7FF4A295605C224DEA2DFA46D82FA13D15110A756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645651338, "uuid": "58d81200-c92d-4f00-9edf-a76b2c7edf8e", "value": "3552255b0308f758d071474baf31cb31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645651338, "uuid": "15526573-3fad-423e-8572-cdf968602f2e", "value": "3072:nq3E2BfBSbEsz7nCAFVNNvBGvdO5gPaEjep8Fe7Z1iO7ZbvbZV7:qRBfBSosz7nCA3NHCdXaEj7Fe7Z1iOFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645651338, "uuid": "413e35d1-d222-434d-9df1-c4f4eaca6fcd", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645651338, "uuid": "57b458ef-fdeb-4488-a673-7d5b1d106eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645651338, "uuid": "d49d797e-300b-4b07-b8d6-0f451e465e28", "value": "38E03022D860E662214E8535BD8024021EA4AE1D5F589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaa69c0-94e1-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1645645615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645615, "uuid": "a607a333-13e5-4691-a5d4-977077e71ce2", "comment": "Malware payload (DCRat)", "value": "78366bd7d6ee299f1e6e9209ca08a80f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645615, "uuid": "1a36bccc-6718-445c-94ea-77aae60360ec", "comment": "Malware payload (DCRat)", "value": "39180a3dca5e45e26e5bcbed31ecb2edf9ad0ebe534887aa86d17a752ef93fe5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645615, "uuid": "a37c049b-e3a7-4588-9263-7c4049f5adb0", "comment": "Malware payload (DCRat)", "value": "d3f5cd357997cecc4472163399ef11faa529ae15", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645615, "uuid": "6d6c0e42-b31b-4591-970a-5d728bf671f8", "comment": "Malware payload (DCRat)", "value": "214e6f1ddf1d65145f874c15279d3884a69a2859bc40adf99eefff33e54ca721ae1ac910a5fd5ab1b44e533538d13921", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645615, "uuid": "feaae1c5-c80f-459a-bfe0-2a20b0d85500", "value": "T1E81507027A44DB01D0AA1737C5EF845443E9AD417A62EB1A7EAF33BD29213A71D4E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645615, "uuid": "060d5088-2a55-4289-8075-c905e57c800b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645615, "uuid": "b2c577c1-1fab-4e6d-8805-c0a924778f79", "value": "12288:gy6j1ZEbr8k630YZpNw9FHpVhTwCxW40c2:c1ZRk63039VW/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645645615, "uuid": "582bc52d-1011-4b4f-8911-2d76b825c263", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645645615, "uuid": "8e468377-49b4-4a32-9a4f-b9e7670491a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645615, "uuid": "4fbe4792-96f4-4d45-8a81-ce630d07d84f", "value": "78366bd7d6ee299f1e6e9209ca08a80f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f155b1-94e1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645645608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645608, "uuid": "1e78591f-cdc4-4ebb-a1ed-ad1de94487bb", "comment": "Malware payload", "value": "a46b5c34adc2d45bafa9349072989979", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645608, "uuid": "3495a5f5-61fb-421e-ab18-1903fd575205", "comment": "Malware payload", "value": "39b09faa83941765099c8c9f347050f8c7523b56fb754342016f9d3ac717afa0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645608, "uuid": "b824ca21-29d9-4bda-8e1e-fcbcf1132f5b", "comment": "Malware payload", "value": "31b99865153bf6f532e664792763c2c406e9933a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645608, "uuid": "f971dec8-55ef-4b55-b2dd-f27d494c7892", "comment": "Malware payload", "value": "57aa132692909ee2fc4f8de5b5888d5cc63726d4a4ce2d4e9cd1db5c9fe2c58f4e1856abc3cfc1763db9d2d165fd47e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645608, "uuid": "1c50b4bf-2409-4e8c-bfde-2a7b19b7ac19", "value": "T18B930A2EB6878B12C0486975C5D7562403B9EBC722B3E7493DC9535A0D033EADD8DBCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645608, "uuid": "d6bd698e-a435-4c8e-9900-d9f61d009f4d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645608, "uuid": "7541176e-a141-4d81-a168-f85aef75dee5", "value": "1536:bKJe/AgBFtMw6uAYNKNVb0QxCNYQCq6rg3OQZ:eCtBFt/wPVb2YxrrsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645645608, "uuid": "8372f374-48b3-437c-af2a-cb06747b9b19", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645645608, "uuid": "61d44ac7-8479-48f6-967c-816030d3ed4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645608, "uuid": "c1e0fe0b-21cf-4348-b9f6-9a3b600c64f7", "value": "39b09faa83941765099c8c9f347050f8c7523b56fb754342016f9d3ac717afa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5894a700-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645633585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633585, "uuid": "5cca6642-8154-49e5-abbc-2ff69b44dc7f", "comment": "Malware payload (AgentTesla)", "value": "77411d8d551df0010725be04eea7ce75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633585, "uuid": "01b7102e-4b52-45d0-b925-e0d63273e960", "comment": "Malware payload (AgentTesla)", "value": "3a498707c39bcc1fb0f8fdb06e35643f9acc6ce9ec736336538a39447514f673", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633585, "uuid": "84023de5-74bc-43c0-ab8d-39793c202b25", "comment": "Malware payload (AgentTesla)", "value": "43fa8cc30d6e3f9841a050cbeb93c1de922c7211", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633585, "uuid": "780b0d50-660d-4b57-b23e-a2cef8c0ee08", "comment": "Malware payload (AgentTesla)", "value": "1cb1cca4d98af6ff7651367c41e4fae1963acd662c7dbf16de4acc640e0aa6517f563cd9816e5a3d3250b676cb79657d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633585, "uuid": "54e0a873-e3b7-4103-86c8-01d1923d4610", "value": "T132C49CC5E98055A4EC19AB316A36CD3582237DFDA874A42D2ADE3E273FFB2D35021053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633585, "uuid": "15a2438e-f61a-43e9-90dc-05fc255ba3ed", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633585, "uuid": "c348abc5-bc11-43be-9ec4-fff09d674d4b", "value": "12288:zP7r9r/+ppppppppppppppppppppppppppppp0Y7St7UZqJ4ZK1/yTlVydRfgcMZ:z1M7w7Uk4ZKt7d9gLyzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633585, "uuid": "37a2fbbb-dd84-49a3-a14d-c0ccaaefc0d0", "value": 563672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633585, "uuid": "49a6e7e8-a388-4ba7-8d41-2f9f3a74e131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633585, "uuid": "b3ac21e9-ccb8-4ed4-bc45-b02b78c5dec5", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c5cc04-949b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645615491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615491, "uuid": "ba86fdda-6934-40bf-ac0c-991699790b8f", "comment": "Malware payload", "value": "5d09106cf59243755c7dba429c957072", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615491, "uuid": "ea0e1735-5b42-489b-b6e6-d2eead721185", "comment": "Malware payload", "value": "3aaa129b5cda5df2c4f146829ec65a3d986ba6942b5166c364d2d1f2816b5b1b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615491, "uuid": "691e6ef0-7c83-4caf-8702-9d8dda5181ae", "comment": "Malware payload", "value": "17dd8f75c273be29bb9de99d2e7cc3775b9ae1ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615491, "uuid": "30351142-5256-451a-b3f5-6035b0fa6068", "comment": "Malware payload", "value": "fd3fb68dd5d9fc21082c91dc69e0f46863aaef13e3c7cc4fee401a2a608b8db567e0382d8ae7e8e6ec03f96777e7ea44", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615491, "uuid": "08a641d5-2675-4419-8ec4-fa83bd752fdf", "value": "T1D9A1E850112C1AB17346697AD26FFA52B50EC81B097B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615491, "uuid": "b61625b7-1106-4d6a-9f76-6bc4086c470c", "value": "96:aRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:aRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615491, "uuid": "4ace13ef-d128-4093-bf54-30eedffdad6d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615491, "uuid": "6d6d288c-45f1-4635-9f3b-7ca1a6234074", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615491, "uuid": "f7dc8e71-b9a8-4d00-9abc-7dfd36e234b3", "value": "3aaa129b5cda5df2c4f146829ec65a3d986ba6942b5166c364d2d1f2816b5b1b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cd89bd-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645630282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630282, "uuid": "0f344bff-e319-437a-800b-a12138c6db4f", "comment": "Malware payload (SilentBuilder)", "value": "e1805abfb37769b3c831c9b1184dc98e", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630282, "uuid": "d4822885-d7bc-409e-a368-87f2b2d81eeb", "comment": "Malware payload (SilentBuilder)", "value": "3ac396d0364915cb63833a184a956181ff9861c7273684ac0a6b2937d1840ef2", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630282, "uuid": "60db22ed-45e0-4344-aa90-79bb7f39adef", "comment": "Malware payload (SilentBuilder)", "value": "6eeefa9ada9a8e0affe5cd29c3a4d3526e6bc81f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630282, "uuid": "a6835fd8-0263-4456-bacd-39ec3fcff4fc", "comment": "Malware payload (SilentBuilder)", "value": "180a1310c19a962826ccb923a61d19df2e06e816aaf4a2529b2e636162f20a7666a987fb0ece0db057eefcd9489ffd89", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630282, "uuid": "e79c1498-4f7d-4b30-9f67-56271140904c", "value": "T1AD44C04AB84A5C35FD45C3BC8983C7CD84E5AD3A6B5B815E4D28332396B3EF416025EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630282, "uuid": "61d5c283-69c6-4ea8-b84b-27b6f55787b8", "value": "6144:EKpbdrHYrMue8q7QPX+5xtFEdi8/dgUThvsiKIjvl5fd1Xh8rsoX/w/05:UhEXs5fXR8rsNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630282, "uuid": "2bb16364-ffe6-4bad-a1a3-367d438ad49b", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630282, "uuid": "f9794745-1237-41db-a97d-91d10675b057", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630282, "uuid": "adfd5e29-4eb0-4b7f-a533-a057d25d5f4a", "value": "095-8650692784.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e01c53-94d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645639813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639813, "uuid": "5cb1a830-7951-4da4-8353-6dfa7828272c", "comment": "Malware payload (Heodo)", "value": "ca4fe7729c1991425ae5812c2568d619", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639813, "uuid": "bac68246-5a99-4958-959d-194f09f79193", "comment": "Malware payload (Heodo)", "value": "3ae8cbbeb56013a00aef5b08c961822b8b6c367a706486c4ecbe86e3fe78847b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639813, "uuid": "ad5eda37-8d73-4a1b-a51c-cdd03d41b522", "comment": "Malware payload (Heodo)", "value": "f9cdfc5d7547338a562f4fbad81c32649292dbb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639813, "uuid": "9de14fb8-2135-4b9c-891a-3d91b6d2b424", "comment": "Malware payload (Heodo)", "value": "dd36124998079450a4614362c88fc2b47433b05e38d081892f404691732284e7b349b8c7550737562dd6893aca318649", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639813, "uuid": "d9a6a0aa-3a77-4cce-8ba1-1b44ed687f99", "value": "T19135BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639813, "uuid": "f66286bb-b5fa-451d-824a-90590a230198", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639813, "uuid": "1ce5361f-2569-4beb-8bc3-8e5507e0fabd", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/bTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/bTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645639813, "uuid": "58f68a48-c3aa-489d-ac81-b8db6cbce13a", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645639813, "uuid": "5066d420-89b0-46d1-9a9f-77a1555097c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639813, "uuid": "4bfa618b-9872-4980-a7b3-345c1c568a08", "value": "ca4fe7729c1991425ae5812c2568d619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77045153-94b9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628482, "uuid": "7ff811fd-f46f-4bf2-b8c7-445b5b88c245", "comment": "Malware payload (Heodo)", "value": "44649a627856be4b9bfd91d142640f75", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628482, "uuid": "9da17cf5-5f48-49e0-8058-32cdbbb98d58", "comment": "Malware payload (Heodo)", "value": "3b4c3a79cbc168c5dc6efea053b2a25be77e32d74e7fcbf5f6ce8e97af58eb00", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628482, "uuid": "f6e47285-b8e1-4338-b160-3b1e3569672d", "comment": "Malware payload (Heodo)", "value": "d866131fbf2dc4b4c944fc38fbacfe0df34d7839", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628482, "uuid": "acfb94a2-9368-4be9-a8d1-9d45cb0d5ad3", "comment": "Malware payload (Heodo)", "value": "3f94af702ebc33e7b95c258d7b2714f056746c919bd5a16fe0376754064b9313991eae24c5f421b94e8b397304d98bd0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628482, "uuid": "65e0af7b-2462-4925-90ca-6f07075792d2", "value": "T1E635BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628482, "uuid": "f505ea7d-8706-4b4c-805e-db20d8b85a3d", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628482, "uuid": "97dd1be2-d593-4727-b7f5-398b9763497a", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/3TewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/3TeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628482, "uuid": "58c09c5c-3e3d-49f7-86e8-19d259ff4a71", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628482, "uuid": "e7410e68-4784-4ed7-ac22-61fcf5b5b87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628482, "uuid": "69712364-595d-446f-9d5b-c51ca4c43eac", "value": "77bf4a34bb5505df191b4edf277b55e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db060062-94be-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645630798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630798, "uuid": "0ffc3d71-1157-49bb-881f-fdfb3d3ac50e", "comment": "Malware payload (Loki)", "value": "6eb77482ad919e60c33f105bbde54c77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630798, "uuid": "4bb4bce8-ac52-4d24-8969-f540ff8860a6", "comment": "Malware payload (Loki)", "value": "3b7cd7be09d6a92f29d880b489b3efaea53d7bd2f20bcb02353cc4fa08c6570a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630798, "uuid": "dc3aa044-aef8-475d-8b3a-dedd14337c7e", "comment": "Malware payload (Loki)", "value": "49d3c59d4a2678a35ad76bff7879f14de2d1e888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630798, "uuid": "14b51bb6-7239-4dac-80ea-6c489eab16ff", "comment": "Malware payload (Loki)", "value": "a425ccc7de90de0f41cda11d938a1af384b8146f5bfcf6ee10bf052606c47c2a3f7c9e4e99e9e8cf6dac06ff0c79c470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630798, "uuid": "8ab0d225-eb5c-47b9-bd57-4cae7dd5a9f9", "value": "T1C654132F26C90873E91643761DA05B56D7F991012E34106B2F7C8F9EBC2138A5A6F7D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630798, "uuid": "3c3dc0e3-ffe9-4989-890b-cb93098f3cd4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630798, "uuid": "b4dc78f0-2a5b-48be-9e52-c7901d3e62e0", "value": "6144:TxDQtFybpKJCP5h5gnTIVJZK8JLsbsf2QxI/+fC3v:uLMpKEP7mEVJZK8JLsof26m+fCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630798, "uuid": "f6aac3f8-f6ee-4b15-8231-6b074dd0a0ee", "value": 285970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630798, "uuid": "d44ac198-7b6f-4f23-90da-01ffaa3f4f1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630798, "uuid": "bbf96cca-8b9e-43e3-935c-b4fb99fd7593", "value": "6eb77482ad919e60c33f105bbde54c77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327b4ff6-94dc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645643400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645643400, "uuid": "15ea8e18-8d9d-4cb5-bc7e-9b3c503ce3b3", "comment": "Malware payload", "value": "ec5ac658d64efdd3017dbb82cc9bc338", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645643400, "uuid": "053d72e4-b693-4b6b-aadf-e0c43df5162e", "comment": "Malware payload", "value": "3ba2b0a72133a20a7c1955c2142ec3411ba3d811bff0e86146cc062b19f84619", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645643400, "uuid": "797bc61e-bf4a-4f8b-af63-d3350afadf9d", "comment": "Malware payload", "value": "f62c1066694d4261d517674c378687fe98253c0c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645643400, "uuid": "e1eed903-df6f-4195-a0dd-d93d6b8c1fce", "comment": "Malware payload", "value": "bb80d837093a4a21cac8eebe617209b27d4163bfbf379b3bbe079eae9717db132ec1cdd903d70ee2333cae549a9a49e3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645643400, "uuid": "03ee0fda-ddf8-4f66-9c16-4f06c310a660", "value": "T12D6423A5FDD08FF608C8A7FB79AC4BACAAB9DE0CCE70585244F455842E937439784847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645643400, "uuid": "1f2d36ea-6542-4760-aa6e-06ced6c05a72", "value": "6144:WIRYAHXZw5RhjuOjQzP2ny0MUaD3ioZjMzQAqnesh7j/lEw5sQ71oJMZzyI4po2:LTYR8WQzuny973ioV7Pesh9F5sgoJe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645643400, "uuid": "98ee9513-f611-43cf-aa01-3e7ea716e356", "value": 316623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645643400, "uuid": "9f80072e-cd5e-4d49-b134-c82cf3f9c209", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645643400, "uuid": "5ad6c5b3-d10a-4df2-b3ad-f6f73caf942d", "value": "Factura-RlD9KeqEwux7Jua.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e95620-94ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628796, "uuid": "a113ec85-89ae-48de-963f-dae16ec2dcba", "comment": "Malware payload (Heodo)", "value": "433f895ecab269ff3fe667eadf06f6c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628796, "uuid": "d7cc1e5d-cae4-4d10-9b50-43f9fae48277", "comment": "Malware payload (Heodo)", "value": "3be62262bc49734382d2eca4ec097aeb20547ae0c296987636a9c2762b1668c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628796, "uuid": "07110e5c-8693-4c15-9ee1-6976742b6fd8", "comment": "Malware payload (Heodo)", "value": "2ced8c5138d4a07738b54bf05510cb79e4848ddc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628796, "uuid": "2a3fce42-6cfe-42bd-aaf3-5e3de12db905", "comment": "Malware payload (Heodo)", "value": "81c58d68b64dd4b3730829d7ea4466b7bc997c4e4ae47e03bcea5da8c8692b4d8fff445302f73e0b1e97c4bbcbfa511e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628796, "uuid": "3f8dd215-2e8b-4278-a711-0ab126488e2c", "value": "T15735BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628796, "uuid": "655c677d-e831-4fd9-abc4-fa6024560cd5", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628796, "uuid": "f2c73cfb-7bc2-4882-b0f8-0364267cee19", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/2TewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/2TeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628796, "uuid": "92f005a3-5b96-484f-ba3e-7812a16b53be", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628796, "uuid": "fe2eb3c1-1163-4aa4-a648-abce4bb9f04a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628796, "uuid": "0a2408c9-ec14-42c5-96b4-abf5435d82fc", "value": "433f895ecab269ff3fe667eadf06f6c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742480bb-9477-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645600131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600131, "uuid": "e3fe0e1d-127d-4149-ab0c-4b33608112c3", "comment": "Malware payload (Mirai)", "value": "235447b3c40d3568155e4cc4d9602f10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600131, "uuid": "70950c2e-e1a4-4ac4-b2e3-01b2e11d2991", "comment": "Malware payload (Mirai)", "value": "3c735d694bceb3aa64c2bd8e4f11540ad54883d4cd09c1f8b788bf80c0de0e91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600131, "uuid": "3b0d8ecd-0c69-467b-ad07-fc7abb6f398b", "comment": "Malware payload (Mirai)", "value": "cb36f331867f7aa776ccafae7ef5534f00809ddc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600131, "uuid": "15cb81c1-6f7a-4440-8c1c-86990819797e", "comment": "Malware payload (Mirai)", "value": "d0f428930564bd6a0e2ae0063e051c8d5e4f9b7cd1db5182a881cdb8dbea61429136a00455e396e43182c65eda0148e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600131, "uuid": "d1190e64-070f-4127-bf5e-02bb62e26b06", "value": "T195C2C0392085A1F7C83714B191D44AD32C3D4FF26893AF1FDA16E4E6AF81974A09EB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600131, "uuid": "cf46326e-fcbd-491a-9ac7-4eca5fb22980", "value": "768:wgBmeJ0k9HN00HIwuKdjKGjoKZJgGlzDpUYsG:wgBik9HN04+KdKWVqYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600131, "uuid": "ea70eda7-b4b8-452b-b04b-0d43cf418d7d", "value": 25968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600131, "uuid": "550a02ab-7d64-4f84-a6c3-b9dc023cd1a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600131, "uuid": "1aa99d1d-aa41-4c8b-96b2-ad649c7d3e71", "value": "235447b3c40d3568155e4cc4d9602f10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c4a096-94bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645629415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629415, "uuid": "c75f47f4-64b8-49a8-83e1-bcfc1c94718f", "comment": "Malware payload", "value": "7f53bd90358389f27485803075fd73ca", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629415, "uuid": "b8d4c541-c728-4bc6-bbdd-0be07100bd48", "comment": "Malware payload", "value": "3cf485c3cd4c2ea77726ddd3d3ec6805c62574ee1b189f988254e45fe11ecc24", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629415, "uuid": "9f565278-0c32-4497-80ec-fa43687a4747", "comment": "Malware payload", "value": "04e5a27a356572696a071379c0860c74eb867762", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629415, "uuid": "3dbd0641-ad4f-4182-9a86-e9e41343cdda", "comment": "Malware payload", "value": "75f8e42d65ceb8cc69e3ab47a31e79dc715f50e68bfb4a3b8d34e6beac623245eb1437b4d2871c2898cea8a82cf4bf97", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629415, "uuid": "579c8aee-b183-4242-99e4-cab80e7b0370", "value": "T172763333EC74FC6EFEAD6DB5AD865107DFA97B2C6108634AE5A1862601DAC140CD32CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629415, "uuid": "642aee90-2ae8-4d6d-aab7-3beb9ca250f9", "value": "196608:KyGKWizEU1kLDCMaifTndZfs/10e345kYwr2A8FYFjHA:Prb1kKMzdZfs/198wCD00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629415, "uuid": "991f1c77-ec1b-47e6-a7bd-09f7d96a41dc", "value": 7790889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629415, "uuid": "75abca2a-b7cb-452d-886c-8c9df4ce8003", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629415, "uuid": "55889a30-706a-476c-8042-c69b116fa5de", "value": "SkyBlade.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfe2f8d-94a7-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1645620924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620924, "uuid": "481c4e0f-9dcf-4498-9264-96098d4b86b6", "comment": "Malware payload (GCleaner)", "value": "e30fb60f71b379f8c832e70f77ba8052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620924, "uuid": "a3dd1829-cb63-4886-9548-f6af790abb6f", "comment": "Malware payload (GCleaner)", "value": "3d898349908143bef8f7652dada13c6075f84af469349be709b1d33d2ddf6672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620924, "uuid": "fbae119e-c5c0-4cf1-a3e2-78379045d805", "comment": "Malware payload (GCleaner)", "value": "d2a64bc77ed6d5d92d66445ad76ed43bfe5cd9ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620924, "uuid": "b2eed842-8266-4ee0-952e-07368b78b1da", "comment": "Malware payload (GCleaner)", "value": "7170830078dffcd77fa9e50e8a4d676e81fd97d294d5735a8eecf7b92471e9d79dbfda3d38d55be517ab1ed8dd085be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620924, "uuid": "9835d2ce-b729-404c-9641-ac15299946b2", "value": "T19216337850191041C3108B714BB624EEEF6BF73655A003C27B9CDE4F678AF63BCAA695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620924, "uuid": "d4623541-8cde-4fb1-a695-776013ee4e52", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620924, "uuid": "b9db1367-a123-4cbf-b023-c2de5963ac46", "value": "98304:yNGmhLZvAY7H9FH0YZwK3iiEvDlcjwn8zwYlLw6:yRhLn7dFxbEvDlc01YBw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620924, "uuid": "608d8dd4-f4db-4b1d-a53d-4593178f3549", "value": 4255906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620924, "uuid": "7315f1ff-42eb-4f27-9f9c-28ab685adffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620924, "uuid": "81a7a4e4-d30c-474e-852e-8acb878a2d2b", "value": "3D898349908143BEF8F7652DADA13C6075F84AF469349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd35fce-94bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1645629968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629968, "uuid": "5563b2d8-70ac-4498-8e1b-04c82c1a2cd7", "comment": "Malware payload (Tofsee)", "value": "e51a053134034365f39714c782c36a93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629968, "uuid": "cb4ced7b-65f3-468f-97f8-2e04f4cf45e6", "comment": "Malware payload (Tofsee)", "value": "3db9a9633bb3097ee7f34cd85bbc168ed3a59496c0c407cf1d22087d58fa2763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629968, "uuid": "a1b57773-6a0b-4556-8d6f-82357671254d", "comment": "Malware payload (Tofsee)", "value": "91e470527e6df4a7d90da44c6d56768dae7eb85d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629968, "uuid": "bfd1b574-4e19-40cf-803b-98888eeed6b0", "comment": "Malware payload (Tofsee)", "value": "c16bfb56a703743f90380bd9dd3fd3d017a9813167fe69b29d2e18d32dd7f9621abc6445938b97845b78cbd30e8d93b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629968, "uuid": "7265a158-2cd1-46d9-a64d-0f9830c01e7e", "value": "T137549F10AB90C435F0B752F8487AD3ACA53E7AB15B2551CBA3E45AEE5A387E4DC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629968, "uuid": "f89de46f-0a49-4aaf-9c38-943ffda9c63d", "value": "32f2c538eab8007c123c6eaeceead9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629968, "uuid": "60cfc311-c3df-4fb6-8bbf-785b41e18dc1", "value": "6144:lBapH7MbNv/ALBKBCO4XS2y9EJS6GJIf9I48jVRoM7gn4:Hu7MbloLYAO4XS2y+eo8VRTk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629968, "uuid": "fefdf763-3fb8-4910-b79a-ccfd2d41162e", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629968, "uuid": "2457b696-578c-4d02-a0e6-b321a6e53f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629968, "uuid": "935c039f-ca5c-4d04-a119-7fa03cf17fa7", "value": "e51a053134034365f39714c782c36a93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb5722b-94fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645658233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658233, "uuid": "b023ece6-66df-463e-964a-430a95308be2", "comment": "Malware payload (Heodo)", "value": "4534676b3c6f9cc5843098e100a2cb4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658233, "uuid": "90fe4f59-8ade-4588-8d87-4ea4ebe6c026", "comment": "Malware payload (Heodo)", "value": "4003739d5e822ff8977dbc3a0f44c1ffa17cc50943e8e86d1aae271a45709830", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658233, "uuid": "d7a7827d-3fe7-4863-89ed-9352bf198159", "comment": "Malware payload (Heodo)", "value": "17b80ff7026669fed5acbd5d389e8e19885af4ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658233, "uuid": "ce9882f6-d6b4-4e50-ad61-ee26128f3409", "comment": "Malware payload (Heodo)", "value": "99076944805cc6f1fc21fc7923bab1189523794cca55d3b5dae82b5e1f2310370c624b01c3b3e77d5000f4c3385f3352", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658233, "uuid": "c2435490-82bf-456b-880b-8c30ff3bbc79", "value": "T1B6E4BF4176C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658233, "uuid": "b091259e-a995-45ed-ad8f-6db7357dbc39", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658233, "uuid": "4bc10d0a-689e-4a4b-bd75-2d192bbdba3f", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0VhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfTPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645658233, "uuid": "5a3dd889-430f-4d8c-a1e8-80606e29aa89", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645658233, "uuid": "3f2fa967-88e2-4874-910a-3e8271cc2a81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658233, "uuid": "452e5f13-a43d-4a47-be87-534214ee4c22", "value": "4534676b3c6f9cc5843098e100a2cb4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cead9aa-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619016, "uuid": "b62793d2-ae56-4434-8025-07a10a4f0d82", "comment": "Malware payload", "value": "30e11f8673e997e09eb894587e63dc7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619016, "uuid": "87a32a0e-4005-42bc-92fd-40b5579b2ccc", "comment": "Malware payload", "value": "405d3324ec5c7aba5bf9e067edb328158d364b0a89b6aa674c1411a65cea275d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619016, "uuid": "0d716bf3-2e39-4c43-b529-8c957681e10b", "comment": "Malware payload", "value": "31f85d258cbd844417ae910d389b4c0e6411840e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619016, "uuid": "48cce8c9-96c5-469e-931a-6dcea35e9b8a", "comment": "Malware payload", "value": "91af94deed3157e0bb85ee6c6004c3b2a29735bea9a4fb593a85d3f94efa4a578a780258ec90513edbf670dfa74f2930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619016, "uuid": "9ca8b088-f6cd-41c4-945f-6bd8f063c03f", "value": "T1285633C2A5809B363C6DDBDD5B2C65F68D16D9FA6186EC099CB13B40ADCAFB04244FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619016, "uuid": "8ed7d5ef-1c2d-4714-80b4-7295664ca6cd", "value": "98304:D+hoUAA6mt/cOkw09D1VxIFCeG3lEGxjRP/ody7mZoqUfJY2P6oPZw4IVf:ihlAA7t/chZVqCeG1EGF/ody7+nmv6EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619016, "uuid": "62b72606-f786-437a-a14c-d334989c9ca3", "value": 5929599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619016, "uuid": "ab3faab3-60f9-40fb-a298-30dac7b14e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619016, "uuid": "b43ac489-3779-4bad-a7e2-a47d91d1a39b", "value": "30e11f8673e997e09eb894587e63dc7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada4eb6d-94c2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645632439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645632439, "uuid": "210c6124-e241-4b21-87f0-7cdb08f264d8", "comment": "Malware payload", "value": "8c35109fe1c9ca4924a62e08b3a750d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645632439, "uuid": "6dbaf781-d07d-4dcd-a902-c51b1b951c0e", "comment": "Malware payload", "value": "40691b728dc937f299041f4d823cddc716d18fe51943a398bdab187203cc91c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645632439, "uuid": "d801748e-51a1-4324-874c-13de805c31c0", "comment": "Malware payload", "value": "158955193e69972cafc0d68ac6e8987a0abd1516", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645632439, "uuid": "603a4516-d427-4428-bca4-b16c59223666", "comment": "Malware payload", "value": "65c27ab580d18cfbf95560e3029d165201776c82e0fe5270e80f45a1995505b6ad7396ae4032562478a48fcf09e3c6ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645632439, "uuid": "7c3e4ea3-e5c9-472a-86be-21597599547a", "value": "T1B275F155E7521AC1E898A57D95F023013371FBB09CDFCA0B76ADA47CC5AB398AE601CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645632439, "uuid": "b1a099d9-39b0-4445-81f9-303a2f7aee8a", "value": "49152:jyHTutQ7uV76PkGW2m/Bs2LjK1bXj0IXL4UM97w3eD:jy6tphGG/6+OxXIIcUMBwOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645632439, "uuid": "170b82ba-a4e6-4dfc-8661-07b09bd321c8", "value": 1691136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645632439, "uuid": "d9eca789-8953-4f8c-9a0f-65693e4ebaee", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645632439, "uuid": "a7d4609e-d31d-42f9-8c42-2164fafdcfb6", "value": "511.65-desktop-win64bit-international-nsd-dch-whql.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9425795d-94c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645631538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631538, "uuid": "36ac7ad6-03f5-4ba6-adc8-54d3fa7d9ba1", "comment": "Malware payload (Formbook)", "value": "e48f72bdad355f351b3a4e658fb55e7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631538, "uuid": "434da696-234a-4ed5-a78b-8c3faad2dc5a", "comment": "Malware payload (Formbook)", "value": "40ca831a495e2c76c2de5e94c2a65fdbc91a6a59e5a5be2c86a2381166365459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631538, "uuid": "8b8d4540-0359-4d6d-9025-a236a4b5c2ec", "comment": "Malware payload (Formbook)", "value": "bdc5fc905b299469afb7c6ff590e9900902dced4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631538, "uuid": "0672e037-60fa-486e-aabe-10963c338e6f", "comment": "Malware payload (Formbook)", "value": "6ef4c07120bf476cd05b2d24fc9e4b762c3920c3c0104a8409a69c73ae86eb37e59ab8a8f5e65d74b57bbac9dc8f67a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631538, "uuid": "183b1950-03ca-45c4-a35f-b44ce47500b1", "value": "T1C005C04439A78F3DF1759B724DC5ECB4BA99FB231C08B3BD78552646C2A1B904C8237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631538, "uuid": "581a469d-1436-4c48-8962-44e1101521d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631538, "uuid": "86b0fd3e-b7f9-4a11-83d9-9ea9423de5d5", "value": "24576:3MQK777777777777EdjRBgVjRjGOLNfjQCfQbN/7:3a777777777777EdlBc5xLNfj7fYNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645631538, "uuid": "befd50f4-1c98-4450-a1da-5268388aaf1e", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645631538, "uuid": "5e987a88-7a0f-48ba-9e4c-ab551584307f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631538, "uuid": "4ce8c0b1-8ce8-491c-b879-6c1bf9770e4f", "value": "1vjxtCGQOUfpxPD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6cc594-943e-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1645575480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645575480, "uuid": "f937d892-dca7-4a72-8aee-e73afdc976c5", "comment": "Malware payload (RemcosRAT)", "value": "4b65ad46b38a817aec5a2edf876df9eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645575480, "uuid": "ce8a2b00-9b27-42f4-a209-9bb4b43e88a3", "comment": "Malware payload (RemcosRAT)", "value": "4115c8a0eb853e13d86fb5bd7e939e69bc29176a59e5606cac7165803700c7e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645575480, "uuid": "4150aa57-acd8-406b-b49a-cc4e2d758784", "comment": "Malware payload (RemcosRAT)", "value": "8decfe225d42713f308851910f37b567f446f195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645575480, "uuid": "f82ea1bb-dd96-474d-82e5-5d1ef5ca6d0b", "comment": "Malware payload (RemcosRAT)", "value": "7572e3f526c762afb3126ff7333bde5381b38ded992be74683b0cda3a08e0dd3c9d62c839e6fae94ceed5fd75017ca97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645575480, "uuid": "58573120-60d5-4ee1-8597-0b0420c3578d", "value": "T1C9C3E011ABB1C433E9B25730487A6B3B8FBA952561B4AF0703503E8D7CB35D2891EB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645575480, "uuid": "c1d1e3a2-d74a-4108-8a11-97af3df9b02c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645575480, "uuid": "dec6b160-81ec-4e34-94b2-469018db6257", "value": "3072:UbG7N2kDTHUpouY+bWYN8A3Vd0lduKCr//+wngP:UbE/HUzVN8C8ldIj/+wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645575480, "uuid": "216848e8-ecdf-48c8-a2a4-19e2d01a99bf", "value": 118280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645575480, "uuid": "e3b52344-940d-4c36-a3ae-da6cf48fbf9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645575480, "uuid": "1070010c-7ffe-4dbb-902f-1c24fa203e01", "value": "IBPG_PROJECT-03_AC0585_IBPG_JSPC_Rev0 20220223.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f32bfb-949e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645616832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616832, "uuid": "63a32d15-69c5-418d-b28e-1c893864147a", "comment": "Malware payload", "value": "a13ccb77dd573ffe116f7403985e419e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616832, "uuid": "8145756a-6c77-4e10-890d-426531844d79", "comment": "Malware payload", "value": "4174273461be09741fa884000332f703451d3e487d37c78128018b224276d35f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616832, "uuid": "06386f3c-b1d2-4dcb-a2c8-f0299c6f7dc0", "comment": "Malware payload", "value": "b32e6db1d32a86fb80d5c32ed88677ae8280544f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616832, "uuid": "4426e809-a9ec-4b37-8539-9564f1bbe4e3", "comment": "Malware payload", "value": "8ad252b736594a5bcc0e6134daba76c138f3d7635a2baba16fd0e46ee456a4af8a6ce762f7767461f943416c726e0c35", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616832, "uuid": "77e5c129-203b-4fc0-af04-24e1312101d5", "value": "T1E9E4190432C0592DD387577A331FB1E2E92A1C7E2949490BF224BC15AAE9727FEF6171", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616832, "uuid": "383a40ff-d1b6-48c4-b8e0-1c22341fc6aa", "value": "12288:UeH8er1n5YI7A76m9QKuNSLUOeFJ45bhTNoOjfMWhH:UNe55YI7A760JuNSLVeFJ45hTSOjfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616832, "uuid": "0bb1063a-16fb-498b-ab5b-460e22d6e26c", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616832, "uuid": "25c6d2f2-a3fc-41b2-bdc2-598621a76cb0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616832, "uuid": "caf42320-03be-4e5c-9443-f8604d58e8fc", "value": "^_-uqrvy.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6b8c64-949b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645615501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615501, "uuid": "63cd68f3-509c-4ee9-8d87-b719926d5971", "comment": "Malware payload", "value": "7b7cbd3cafe874598a8c32397849a683", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615501, "uuid": "37b242bb-aee2-42a0-be4f-83bd13c9765b", "comment": "Malware payload", "value": "42390022ffee42dc52a3e497721342ee32cd5b3fe8d5af54709deb1eeca89151", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615501, "uuid": "13004dc7-3f3f-42a0-84a1-15e50b6d63ec", "comment": "Malware payload", "value": "5bc590f2f2ab5fc4685901b4f5fe73f6ecb94a2f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615501, "uuid": "40fc6028-5d09-4d00-8843-1fb0aa0d12dc", "comment": "Malware payload", "value": "24a283fe0b41c9db17e3ba478e198985f93b8863e5e525b6db7cc4cc5220f78ebffbe712dc1ed9658de6c91e1a5930fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615501, "uuid": "8418a3b6-f2e5-4fbd-9741-0e1b237831a1", "value": "T1E3A1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615501, "uuid": "46bc0444-0b57-440d-a7a6-b5ca61757db1", "value": "96:lRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615501, "uuid": "158d69ef-79cb-4f42-b030-42489bb7d71a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615501, "uuid": "d63b962f-f960-4db2-aee8-e08e52538d2b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615501, "uuid": "db1bfffe-5b32-433c-bbf0-004aa575f326", "value": "42390022ffee42dc52a3e497721342ee32cd5b3fe8d5af54709deb1eeca89151.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f6deff-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633799, "uuid": "bfed5106-912c-45c5-9d7b-9962b05b3402", "comment": "Malware payload (Mirai)", "value": "a811c8e76e1f1bed1b55140139c3081e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633799, "uuid": "ae7d1aff-439b-4b7c-9fb1-7a405adcfeeb", "comment": "Malware payload (Mirai)", "value": "42d319760f4403dc60d5d1b8a5393ace419934cb039f56bbef74032dacaef97d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633799, "uuid": "450e6eda-891c-4cc7-bfdd-4951282f145c", "comment": "Malware payload (Mirai)", "value": "0f1f89c9704c867bfeca846ff02ae0db85240c23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633799, "uuid": "5011470e-d2ec-4a97-ad8e-6e29c50f0601", "comment": "Malware payload (Mirai)", "value": "94ff0ce8ddaa0c5079bf55e302c88f7f3b8284b91eb89fcda2dcf6b020f0e0b2a64cb496f00d41c338e0b176e10e30a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633799, "uuid": "6f1a3305-dd6e-446b-9363-893b765898d9", "value": "T12A732981B8809A26C7C01777FB5F118E331597DCE1EA72438D151FA9B6CE90F0D67A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633799, "uuid": "47eddcaf-74f5-4def-8217-69865745c92e", "value": "1536:hhI5fEA6+tse2IdyBUmO35w5Osyi130wA0RDYceZWkLf1YR/9j7:0WA6+tse2I0OoHV0v0RUcwRfW77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633799, "uuid": "25cda727-f53b-4e6d-9cc4-e7c13bd53fcd", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633799, "uuid": "38129305-02b3-4076-adbd-b486f66ae1f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633799, "uuid": "70603f70-d508-452a-a6ec-70db72c30181", "value": "Zeus.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7fc6be-94b2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645625700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625700, "uuid": "14878791-f881-4d52-8945-5a9dd43c5783", "comment": "Malware payload", "value": "b5a7086b944d9f09058e540f6fbe8597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625700, "uuid": "7b5fd632-6850-4c1b-aa4e-5023660b6830", "comment": "Malware payload", "value": "432063bc1891476e66f83d439b27e5387e85a9888f24d2ff1c33a6571f15868a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625700, "uuid": "27c397ae-23c6-4a98-8925-1446de97181b", "comment": "Malware payload", "value": "c5c183253d2900bdf209a9ec65f58700ee460a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625700, "uuid": "83534f48-f770-4fb1-8687-1b18d2f7a0b0", "comment": "Malware payload", "value": "43d3a9a1063be9897fac94f503d410e189ea97c28aa9016295e8c4a7515c7d5d3d950c4e92e764316fd405c2171f865a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625700, "uuid": "21dc7e0b-a6cb-41a2-bac7-7a51be1ac4e8", "value": "T189F38E5161D3427FC8A2A67095EC4690C5EF7E123A798FCBA74C223ECC392A11377E16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625700, "uuid": "010dff30-ff64-45d4-ae77-4e45dcec3478", "value": "302c92cfe50e25c860a4b55a375f7422", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625700, "uuid": "9409bbdb-b597-43b7-a65e-7deed4a47a2f", "value": "3072:pc4Horf5X/n8eXZHTFGAfU7VKXHGHggY5dfUn3Z3:p3y1/n8YpDCVKXHGAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625700, "uuid": "82393af9-1d72-4f22-a457-47872ab77269", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625700, "uuid": "f25583d8-8efc-4ddf-9ae4-b14bf95b98e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625700, "uuid": "3a698a5f-fa25-446d-b2df-aab331b76802", "value": "SecuriteInfo.com.Variant.Fragtor.62229.29600.7144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85a401c-94a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645620942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620942, "uuid": "4e6a8c49-7f52-493a-8e65-df74de474b66", "comment": "Malware payload", "value": "4c121ed03f8af0def67bfdd8dfe542d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620942, "uuid": "b16234a0-4b50-4e5c-88dc-c21d993dae5e", "comment": "Malware payload", "value": "437f639d05da27e1909877e3f8c39f70ee5d525a8be7c631e69f4141db287ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620942, "uuid": "04d4a267-e125-4ee8-94c1-c3b3ce338fcf", "comment": "Malware payload", "value": "3d5f98311fbad255078b5377810b14d099e0ddf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620942, "uuid": "ae100f74-bba9-4e8f-ab0f-be7da05ee0dd", "comment": "Malware payload", "value": "67cc40d9119e06e2d79f66758306d98270d9183bd0dba9361d6d3290d4b197aa99d1a75e96c4157a9fda3a8cd2fb7b25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620942, "uuid": "cc9e9ae0-f7b6-439c-8ce4-128df30fc25b", "value": "T14736334B688CBCE7C57196B1337F67E9C34EDC8C4422E20D66E16A4564FC01BB90A7E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620942, "uuid": "04f0a677-9e91-42f2-88d1-8eb924fbdf73", "value": "b68c06ac20c224bc7251eb8d315ec0c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620942, "uuid": "44510838-e51f-477b-8a6e-570b11e5ec53", "value": "98304:KfvFV1nm6rIl0k/oaq4eAc6cE9i4unig4X3aA6F19r3Rlj7oJXEu:KnLrva2Ac6hi4unigEVghlj7oZEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620942, "uuid": "28ab1a26-16f5-4b19-bf85-788f1a8fe0d3", "value": 4918843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620942, "uuid": "18e1b63c-990b-481b-8d3f-b63e17a30aa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620942, "uuid": "b08a25ab-283d-415d-9a86-0fd73817a4df", "value": "PRAVDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387968be-94dc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645643410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645643410, "uuid": "ee0a94a5-2cd5-4883-be42-3d0fc8dee1f9", "comment": "Malware payload", "value": "74005927fc1b4925ef6d05e26ebdbfaf", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645643410, "uuid": "b0226b72-7dec-4918-8092-28a5295a8fc7", "comment": "Malware payload", "value": "4485be82073caf3ecbf6b72e42a93d7d2bdc134727f54d159c44cdbdc38c8306", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645643410, "uuid": "f6233282-80c6-40c3-afdb-07495cb48ac6", "comment": "Malware payload", "value": "3101f7a6b821df600119397e0286714817d48b72", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645643410, "uuid": "83a0ff08-c88c-4b2f-8ae2-01e467b047e4", "comment": "Malware payload", "value": "07087b7b4b96b0f2bd8651ec62a2977dcdef3bd2ecb6882958cb4d12dd265595d8548d48707b38623c9371692080d878", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645643410, "uuid": "da44788d-8181-4caf-82b0-0db5fd49b617", "value": "T19BE1828D36562B9D703C39E68290ADD08616D44FA7FEF704AC9FAF0D39EE996D042134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645643410, "uuid": "986527f1-1768-4155-8980-371e3335da0e", "value": "48:u6tiJRqj55o1o5cLKJahj5H6oFoAoQ48BYCXOiJRqj55o1oHIpiJRqj55o1oHItc:uaqZpMQ48BYDyMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645643410, "uuid": "1877fb86-3ef7-4e9e-a9ee-edc991100fc5", "value": 6904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645643410, "uuid": "a77a4a54-fa84-4b60-a911-0ddf81fd93ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645643410, "uuid": "26c2e8c3-c4b4-48ea-a79f-c19562cd3fac", "value": "Factura-RlD9KeqEwux7Jua.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08a5714-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645610943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610943, "uuid": "eda25c71-2068-45b1-855f-07d87ed8dda6", "comment": "Malware payload (Formbook)", "value": "50d0fd4846a8e72a6b4f59f0f3df86d1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610943, "uuid": "271272e6-6bcf-41f0-b28d-76eb277d844e", "comment": "Malware payload (Formbook)", "value": "456ca33de7c167dfc6964c7862a89cfac7ef8e6228756f0c1c3b85fcaea0dd6f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610943, "uuid": "3ef712b8-0e6b-4979-8664-cc005a5d3e4b", "comment": "Malware payload (Formbook)", "value": "b7dba6c5817183a7db693e1fe7d799a9d86b9126", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610943, "uuid": "3a2734db-1315-4d6d-bcec-3c2ed5f457eb", "comment": "Malware payload (Formbook)", "value": "f418edb40c6e36d8884fd1897f28bcec12c378bfaebe276a22c342dc48fd9766a2f4d24478c50cbc27e87e930eb9ae77", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610943, "uuid": "d88bae2d-1977-425b-bc8e-a9b8c8d31494", "value": "T15B1412A432F52559D9C19DBDBABBE981B2A4BC7F4C4F5E1124CD334C10B60B9A20369B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610943, "uuid": "3350bbf4-6795-4818-b8e6-adc448e3c171", "value": "3072:YpssssssssssssssssssssssssssswssssssssssssssssssssssssssEssssss7:bw7DIkziCKPDOLe8Ejjauehue+nDgXgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610943, "uuid": "b2ff3e6c-fc9e-4ed4-b6d9-4d2adea6bbae", "value": 190488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610943, "uuid": "8ebd5e80-57c4-4bc9-aebb-5ce80bfd7392", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610943, "uuid": "09e695f4-377e-40a9-a88d-bd1e74e49c7b", "value": "S28BW-421122909390.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9da44e9-9457-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645586557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586557, "uuid": "bd48589d-2e8a-4f4c-b822-b1133d3e41cb", "comment": "Malware payload (Mirai)", "value": "8e05ce62fd5bb242fda1bf7d5f07cfd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586557, "uuid": "5cb42b7e-2fa6-437a-9fb7-437a120124d7", "comment": "Malware payload (Mirai)", "value": "45a2b2b4532eb7cba49f0dbb550720aed30cfef08f889233bb5a757c6fa90793", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586557, "uuid": "2a8b93e6-9b2e-430b-a454-1c0aa733f6d4", "comment": "Malware payload (Mirai)", "value": "d52aa36d7e69af5d4f3440db438bde9601f48336", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586557, "uuid": "f8126e6b-db8f-4de7-9e81-4844285c18f0", "comment": "Malware payload (Mirai)", "value": "40604b8ce89f44558bef746162f5e9d2f221ecbd748863f96858ebda41b7f7bf9c177bd41116e66ff739d45ad7754a35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586557, "uuid": "2aa83760-d481-4585-8b80-b599e9ad895d", "value": "T152D2E757F9819F01C5D0527AFA0E224E77235B2CF3EFB3266E246B2467475770A3A806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586557, "uuid": "8925c9e4-3116-4b82-9ddf-30d6856c1877", "value": "384:8Bnqt6xxb/VOjiawEBKFrm3GJYs8LQEbVAeMxwlZogXx4elk6enj7DD:8BnDLb/V8iajKrm328tVAeMxwlZmN6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645586557, "uuid": "defc2a64-0973-4b58-b8c5-9ca8e38e262a", "value": 29980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645586557, "uuid": "b55508b1-139f-4b0f-96c3-93f77d966efb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586557, "uuid": "5a62e3c4-cd25-4d02-b450-4fd592472396", "value": "8e05ce62fd5bb242fda1bf7d5f07cfd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0648ccf9-949e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645616697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616697, "uuid": "3c75059f-151a-4350-a7d4-f4b243908959", "comment": "Malware payload (Heodo)", "value": "d204e083e419e6f767358d6efee7e7ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616697, "uuid": "6587118d-13c3-4527-9cc9-826e3e461867", "comment": "Malware payload (Heodo)", "value": "45c0de2cfe03d1dca8136b037d9d233aa6e6ca24aea38e9f4a9cf91fb1661385", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616697, "uuid": "90a08f04-f723-4721-b408-9eba924afa8c", "comment": "Malware payload (Heodo)", "value": "f807e2a850f4d3ec799184c5aa6e25b6a6350d1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616697, "uuid": "6b0ca41a-813e-4e48-830f-18ec5a4c359f", "comment": "Malware payload (Heodo)", "value": "d17d96ad122bd0830e9b0063cb15b911f416a1ce8e372d51541657b7f6667e9aac46cc19795cb0dfa30e4df9c8dca5f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616697, "uuid": "fc0fbd58-f565-484d-9b86-f730a9dd81fa", "value": "T1A135BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616697, "uuid": "4b7aa520-c995-4e0a-a58c-0aa77b55a841", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616697, "uuid": "f96c3fa2-9b87-449b-9eae-194f5238b734", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/2TewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/2TeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616697, "uuid": "77de958b-0330-4782-bb53-1cd0b595564b", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616697, "uuid": "9f8b4f50-d7b7-4d0f-8047-f7f34c17302c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616697, "uuid": "f478ef8c-28c7-4e48-a22f-f042a87eea30", "value": "d204e083e419e6f767358d6efee7e7ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301245e4-94ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628793, "uuid": "5de2d437-4aff-4077-8f0d-0ae921924b8e", "comment": "Malware payload (Heodo)", "value": "9518ac21bcf2e9e127c17657fbdd9a6e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628793, "uuid": "cdb0f841-84d8-450d-9a02-371b1e72ae45", "comment": "Malware payload (Heodo)", "value": "46a72f3d87767f5c24c64d94c17ef7b9df57cfc9859816192e2e3f2e5c540a7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628793, "uuid": "a2be1b31-ca13-484d-b3a7-edee453bf156", "comment": "Malware payload (Heodo)", "value": "92b70fefa36844c7b9a96f166682aa174e0759ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628793, "uuid": "6cdf46c3-9520-4157-b037-b10a92ceabbc", "comment": "Malware payload (Heodo)", "value": "bd8efcc6117d7625de1b3b3be4b7269a4262f136de3d1d7e577ba1ae96542778dc3372371638ac2cc47204126c8eb0d7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628793, "uuid": "4dc2a896-a825-4467-bf0f-f16e078ab857", "value": "T1B135BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628793, "uuid": "a5e4930d-731d-4d17-a74f-96c2379a67de", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628793, "uuid": "b59db16a-aa91-4b35-a27d-a23721951050", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/pTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/pTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628793, "uuid": "3c109d33-e37e-47ec-99d4-b6002bab0115", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628793, "uuid": "85f87637-bc3a-4640-b5c1-be4d50b32ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628793, "uuid": "fb4c043c-929c-4e7c-a48b-546e98edb49e", "value": "yqFK13wN9kp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc6e94f-94b8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628250, "uuid": "0ae2bf1f-3077-4659-a19f-38db3ca9b1b9", "comment": "Malware payload (Heodo)", "value": "836cc063a84d39c846a56e9eec71509f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628250, "uuid": "0f127749-0916-47f6-bd44-284a37f6d02b", "comment": "Malware payload (Heodo)", "value": "47eec8c1b6fe13ed1bde7abbd3847440efffd765764a12c4816208ea3029b861", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628250, "uuid": "ba584c95-2f3b-424c-a6fb-056bac25bcf5", "comment": "Malware payload (Heodo)", "value": "6e0e0bbeed4b91fc7ece0035d8f6d32a8931493f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628250, "uuid": "6a2d6a7c-c4bf-4eab-a75b-0bb267361c75", "comment": "Malware payload (Heodo)", "value": "b96f448b443ec3a4fa57d100f99e5d65caf35c2744e89d434ba9987488d96e77677690dd8d566c7323aedf610cf1f83d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628250, "uuid": "0b6859ea-23d9-4745-8bf4-6bdde3d6ba55", "value": "T10935BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628250, "uuid": "8395bae0-e68c-4496-bab0-241ca328b5f2", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628250, "uuid": "0d5af88e-4ab6-4aa4-a57b-144da7262768", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/lTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/lTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628250, "uuid": "7e420deb-f79e-4392-9a54-d5d4144d1ad2", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628250, "uuid": "c3ddb156-7df6-412a-b6a3-56d7378b443b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628250, "uuid": "475d05ff-1cdf-415e-99fa-5eec799a019d", "value": "836cc063a84d39c846a56e9eec71509f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9bed1f-949b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645615496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615496, "uuid": "2e42c612-8862-4214-871e-2d77c3813f7a", "comment": "Malware payload", "value": "8fcde93e1d2ee91b362b7e8688cda205", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615496, "uuid": "d37d1433-140c-4e4f-8020-a985cb84212e", "comment": "Malware payload", "value": "480d2b0e627c7b5af50ede54b039847cc966a71dd85af37bd684d4c65e755369", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615496, "uuid": "a58e37e4-17f1-44a4-a4cb-c473ce6849c1", "comment": "Malware payload", "value": "370df1ea236b0e134c85943bc73967a73bf0c27f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615496, "uuid": "167027e3-3615-413a-87ad-2354a9cd357f", "comment": "Malware payload", "value": "7465e6a715d57d022d616c4cee99143bd03fe9b7428bcedcc9c92bacca25a9f67960efc74f0c75e4ef20b64db54d7bfa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615496, "uuid": "308c3394-1256-4783-8215-18794f00eafc", "value": "T100A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615496, "uuid": "e6dd4c93-73cf-4b2c-a5a5-36bb244f1c64", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615496, "uuid": "cd2ad0da-1d5e-47e3-8ef4-6c518dfd8eaf", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615496, "uuid": "520b48a1-bc83-4376-9ab5-92d34a9f1bb7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615496, "uuid": "f1a5384e-d840-4335-a517-360951912df9", "value": "480d2b0e627c7b5af50ede54b039847cc966a71dd85af37bd684d4c65e755369.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e349439e-949a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645615350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615350, "uuid": "9881b32b-ad7c-4b5b-807b-1fb0667661f3", "comment": "Malware payload (Heodo)", "value": "8550584b939cec79b708a807259ccbb9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615350, "uuid": "c82d0140-5a54-41fd-8031-890652ded61b", "comment": "Malware payload (Heodo)", "value": "494bfbb8c8236bf9005f52e108d5b8c5fb26f9332583df86cd03781eca91180f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615350, "uuid": "e08c6196-a3a7-4d76-9d41-98e36ce2de6a", "comment": "Malware payload (Heodo)", "value": "0994ec7aab8cb9af2eb79326c23ce568cdb639b3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615350, "uuid": "c93d2a7f-14e7-4f51-b360-9ca794df4a03", "comment": "Malware payload (Heodo)", "value": "d5705be6638cd38b4e1dc0328fd64812a57dba3e3dab4f5151ec8c2464345960cffdae654fec2799a6fe4450a1d63eb1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615350, "uuid": "37607e4d-e3bb-418b-a0bb-76e6668a9883", "value": "T11E35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615350, "uuid": "42984f3f-959d-454b-8d16-bd03949f0fd7", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615350, "uuid": "68c876fc-c654-4b51-b652-b2557f2eef82", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/fTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/fTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615350, "uuid": "e81e0096-f9c5-4ee7-9cd9-324265071af0", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615350, "uuid": "14e15589-0245-459e-8696-5c8837b770e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615350, "uuid": "fcf8b2ca-ca96-4b7b-abfa-f8aceca2c82d", "value": "Y3g1nA4ofHZ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2224b62-9478-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645600718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600718, "uuid": "68c1c437-e6d2-43fb-bb15-58129fd9599c", "comment": "Malware payload", "value": "a1da17aa5507e02ffd2862ac22f50ea1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600718, "uuid": "1ff26adb-03f2-47af-841f-9feb1184dec1", "comment": "Malware payload", "value": "49ccad0a8280bafd83648b13203abdf9e38e113755a326446431c8da9104ec24", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600718, "uuid": "76a99ed5-8c1b-4df0-bf51-cc1d81f72fd4", "comment": "Malware payload", "value": "0d60921be5ab0b2f3c641d54f1c083b63fb17f0f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600718, "uuid": "bba7e62f-d1ee-41b3-b749-989b84c5c73b", "comment": "Malware payload", "value": "cebee67bbbf678135d548fa6e3ecdb419d4d30c68f2a0d24b29a2d223e88f20e2ec8a28743677ad4c0ff204118655c7e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600718, "uuid": "5722eade-5cab-4a27-877d-d75122370fcb", "value": "T19F124B7C934C49A8CBC9B3F4B566BC62209D7D4293C0B0E273BC6B405B779B9111A954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600718, "uuid": "5dbf9922-e451-4f88-952e-4de46354ce26", "value": "192:OZkoWa6Oxxdz5HkJnAgbh/ndyX3qrVut0xruBBy/NkIRzg0s:OZbsOxxx5HEn3YnqrVY02BkCIR80s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600718, "uuid": "0526c92a-63ca-4cc6-b300-cff66ed1d1d2", "value": 9071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600718, "uuid": "8f8d587a-e122-445d-9951-64e898febee3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600718, "uuid": "59a02e3c-9d67-43ea-a5b9-6aeba37bbd5c", "value": "Payment Advice - 0570952022].doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8d0442-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619286, "uuid": "e95d40ae-6c4d-4fb0-b8d4-c1aea6c58373", "comment": "Malware payload", "value": "245944017a43a0806494e8c1f5a27e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619286, "uuid": "6c6f8ea7-ea7d-4d47-a1a8-9afac2da9d54", "comment": "Malware payload", "value": "4a076b7b979e6bcd04f4844f48534c0a8d1a3f054e24affb07595d20bbc2fb11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619286, "uuid": "6d9b9b64-b4a0-456d-8f0e-23f473972be2", "comment": "Malware payload", "value": "0c98dfca84682384fee8c4cafc07e70cac2f84b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619286, "uuid": "6c67900f-fb40-4dcf-bd4b-f0a355e7b4b7", "comment": "Malware payload", "value": "ab4c89a013e1018d6c0b7ddbe2052d02f0c0a79dba61a973240d5c681799c34683f6e04991ea2030926d4dd13d79f165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619286, "uuid": "b7513059-13a3-43f3-ae18-d18af28237aa", "value": "T16144A45631FF1096D7B2EBE20FE8ACBF8A6AF173121E353931812B468776D409942375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619286, "uuid": "92f2a2db-a134-41d4-8f0b-205850308363", "value": "3072:nsZIxmSa4uT7XG5Vkof9UILFmJmtYWR3tC45St0b5o1QGHeVLb2JUX9:ASaA5VkoVLFH2itC4rC1B+CW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619286, "uuid": "6e786435-4a5c-49eb-a787-a7f74d2d7dc5", "value": 264653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619286, "uuid": "77216403-47e0-4fbe-bf50-a3becf41d59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619286, "uuid": "bff9f86a-226d-407e-a421-4e0fb32cfc6b", "value": "245944017a43a0806494e8c1f5a27e61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de6f20c-9453-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645584605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584605, "uuid": "1cf6ba4b-6fe0-4020-b1aa-978227e819eb", "comment": "Malware payload", "value": "cea0e498dc48063e70ef2e892cfc40e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584605, "uuid": "b9212ffb-b61f-4a5b-8960-f0684c334f2f", "comment": "Malware payload", "value": "4ac1194628f44b05c07a33f911951aebf2c30abc8280c2cbc341f4d89a6bfd0f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584605, "uuid": "87f267eb-f336-4638-97fb-633a9acd8ef2", "comment": "Malware payload", "value": "1e7f6c921bb1f30c29572a3393a167edd98e0ba7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584605, "uuid": "88514a93-68ef-45d9-b96d-6e326d0bf971", "comment": "Malware payload", "value": "c1a4cf3c9107de64661c94473604a0bfc0de29444c62d9b61b54d1fad3a57851672aa3feaa8868480e6b11d234f8c060", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645584605, "uuid": "97571d10-7d76-4d03-bdef-760c0bc97613", "value": "T12382A42B559294BDC89AC27801BEB5368133B43D325AB10677E4F636BE5EF362E6D001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645584605, "uuid": "e2a5963c-1435-41a1-bc3c-5a8087de6002", "value": "384:cZNzzlhjjk2+BoJeG6GTYXwHLaZMzekH:cZdvkBU5teZMzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645584605, "uuid": "0bd82d56-747d-4e84-9428-e5c5823b9114", "value": 17608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645584605, "uuid": "c47a8bb2-fa53-401a-8afb-4b92ed11623b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645584605, "uuid": "ef03a1bb-c79c-49e8-bdcd-9683fa8f9965", "value": "Yofukashi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e5b91d-949c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645615842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615842, "uuid": "f85ae023-ab14-4b1b-a949-2c9ef44d49a9", "comment": "Malware payload (Formbook)", "value": "0e510cf57791c66217e65ad54b1ea1f2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615842, "uuid": "496f8fea-790d-46cb-b54a-4cd7d34d3407", "comment": "Malware payload (Formbook)", "value": "4aca550bb010ef18b4b8e102e140ba3a9281e0ab1bb822b6619c4b045fa53d89", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615842, "uuid": "6c626982-e04c-450d-b152-739ff19b657c", "comment": "Malware payload (Formbook)", "value": "59c8c7ff93dc013fad93dbcf20c99855a24edea3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615842, "uuid": "b1206609-0722-448a-94f7-1133640be0cc", "comment": "Malware payload (Formbook)", "value": "93bf745516843893b9d69437f450da278cf14b13cfc8b214bd06cc5aa491faaa6bdda4f379bd031caf6f7d8428d33b27", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615842, "uuid": "0f237c9f-d012-4a27-a90d-6323c26dee8c", "value": "T105141228FA590CECC3F3A6BC3F59141175CEFD48E429984A6272FB9910B9B96379103D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615842, "uuid": "e5d0912c-92f1-4d4d-b8e3-a20580886390", "value": "3072:avHOp+VPHjRp5tM/B0jkFd9NlIGdKSrIg+zasUWYdQy6CD0m6IGS9sLEFnSNmBiK:wu4PH9tM/I49NFNrD+bPYyKGrAJGOiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615842, "uuid": "94fa6691-9979-4d0a-b94e-227df9060dc4", "value": 190360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615842, "uuid": "5085739e-b406-4984-a4c8-873563d112f1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615842, "uuid": "f2572fb5-cd04-4f42-ba49-2bfe1b2485db", "value": "Efax.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a04462f-94a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645617804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617804, "uuid": "c5bbd53e-e945-4bc0-a5a8-a4253291616c", "comment": "Malware payload (Formbook)", "value": "c82efbaf75583bd6fe08777102119b99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617804, "uuid": "0e928f62-1953-41ca-8e87-04fb54d3f38e", "comment": "Malware payload (Formbook)", "value": "4b11b45c019f5c15f5568d5c1258cb1cb077aaf59bdff581e5efc280047f62ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617804, "uuid": "c2064f35-88d6-4cb6-b5ca-62e6b420fe18", "comment": "Malware payload (Formbook)", "value": "c222bb70cd49b03488bfe1566e49cde155db6eed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617804, "uuid": "901d2bb3-10bb-4985-815a-d76b32af2e60", "comment": "Malware payload (Formbook)", "value": "c0ac0101bff94235c49687863ad133b7a8dc264aa73004a59a884fa35cb3ab2df7795b0680e43de1b827be9f6744073f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617804, "uuid": "5fa3d734-e914-4999-bc63-aa186908ce82", "value": "T1CF64233775D12ABBC23E593004B36AB9C33AE7243D61129F5BD89E54787B683140B2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617804, "uuid": "5890a62c-6291-441c-9691-f71cef6d79da", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617804, "uuid": "332024ce-f4c3-4f96-a077-977c9965c346", "value": "6144:TxDZNJ8w6lH6xJ4kmnvuNai5hKt9KPgDK15kRvx2m+hFpjfMoX2Kdzd:Pf+axJ4kEei2rR9HfMkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645617804, "uuid": "9ac46531-df6f-4023-8cdf-d884da22c6a9", "value": 323372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645617804, "uuid": "9f019421-b573-4684-ad8b-f37c6f176e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617804, "uuid": "c9012c18-1c49-47d1-9a3a-2c86f046d26e", "value": "sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67f0df5-94bc-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645629850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629850, "uuid": "2c861222-11da-4b67-90d8-c7e35a211183", "comment": "Malware payload (SnakeKeylogger)", "value": "5f32cde4c1512587913252182454ec8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629850, "uuid": "83d73739-19d6-445e-bce7-974222e80d3e", "comment": "Malware payload (SnakeKeylogger)", "value": "4b1b4839091eb21fb7298614496f6dbe6f68f87f154e936436cdd39b509c619e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629850, "uuid": "00bcd389-eaa7-4b31-a108-27c1d0ebb8e6", "comment": "Malware payload (SnakeKeylogger)", "value": "6fa6db8a6169b43053b163b1b00796ed01e8425d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629850, "uuid": "87daf5d2-e7b0-42fe-91b2-1c364ae3929a", "comment": "Malware payload (SnakeKeylogger)", "value": "5b56a14c0ab123d71d15ccb4221fed7c6da940d1a93f0c7c054309abdf495d60a6cd260dfa15ce218e470c9ae8277b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629850, "uuid": "98c989ab-ddc9-4b91-b63d-4c5deb0a8938", "value": "T16CF4CF4839A71F3DF1B58BB21DC1EC74BA99FB271C08B3BD78516646C2A1B808943776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629850, "uuid": "9ba4c1e4-5aaf-43dd-86b4-1a77ed827718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629850, "uuid": "c8d7c56f-f4be-4275-ab26-5f1effb1768e", "value": "12288:/WDyjIRjh7jxK777777777777JRZ2rs3wdh9vXCoZgzV8QYQhy+R77QN8Tb6SxQx:eK777777777777DwO8Qzy+R7q8HRx/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629850, "uuid": "5040dece-bcce-402f-a2b8-53d40c823fae", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629850, "uuid": "35c051ea-cf8b-46a9-b607-25e68ef44e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629850, "uuid": "db346565-2f4e-416f-bf13-81501e2f1457", "value": "SOLICITUD DE COTIZACI\u00d3N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a31a901-94b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645625830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625830, "uuid": "1eab8b14-ad78-45dc-81d7-a3cb9b92c5e2", "comment": "Malware payload (Mirai)", "value": "16503154091c55461b83aed11b91a3b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625830, "uuid": "642d8d37-c1c2-443e-8b0d-f874c73eb56b", "comment": "Malware payload (Mirai)", "value": "4b216df952e62568c3e5ae4bb697fab35fdafee9ec35edade9ea6b7d344344f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625830, "uuid": "068602ce-730b-47b2-942c-9cbf2c7333f7", "comment": "Malware payload (Mirai)", "value": "d91945ec15d9f869a71c426d76b6ff8facd2c4e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625830, "uuid": "04f4b56d-4ba1-4988-920c-879d5f1efffb", "comment": "Malware payload (Mirai)", "value": "bddad975f2f9cc1fa361c4d5ba540c2d389d68ff7fd18f248e349ce6b456d1be2943f18708457a4161be1292f7b8813a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625830, "uuid": "55c2bc49-b3cd-45e5-b599-e83c65ed455c", "value": "T137335B21F9395E17C4D1B9BA52F3872AB3F5430E25AC8A1E7D220E8FFF1198065472B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625830, "uuid": "45846dc9-1f6b-442a-9f25-c427c21a0eca", "value": "768:6/oNE7UoJeJuq97QL4gTOZ85UR1cPD5O+qnrGgF5o:6/PUOeJuS7QLfTOZ84mDZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625830, "uuid": "d3b66a05-2565-46e3-93ae-62346d413256", "value": 54104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625830, "uuid": "4bb77dd0-54a4-4b24-9850-26457b0993ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625830, "uuid": "d4483bd3-ac64-4d27-93cd-c472f18aa58f", "value": "16503154091c55461b83aed11b91a3b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1aa2b7f-9478-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645600637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600637, "uuid": "52caf828-565e-4d95-876a-48a3e42d1759", "comment": "Malware payload (AgentTesla)", "value": "263a5d05362aed045c8c2a37198e1bc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600637, "uuid": "e8b6a263-8e49-4cb2-a318-19a355187b73", "comment": "Malware payload (AgentTesla)", "value": "4bfad3f2cbe64b8e4ddc120e397c235f4d1db26aa1e9969a857452318c81fee3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600637, "uuid": "b3744714-7ee2-48b3-bbcb-5c101c388529", "comment": "Malware payload (AgentTesla)", "value": "2ae51893725b56a577876ec51cf5bea19aa7d259", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600637, "uuid": "a924acaf-c5ad-4759-9abf-a4bb6c6133fe", "comment": "Malware payload (AgentTesla)", "value": "153443b327d6191d12cc9f1bfc23dce6bd8fcb6d89be21df217ec61c4af4077223b5442b72b0d4578a63374bebf7da3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600637, "uuid": "795a8832-0dfc-4da0-a2ce-96dfcd1d551c", "value": "T1DE9423B5E1AC4653E241610454CE85BC027B844EFBA58AEA7C4C6FEE53757730B42CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600637, "uuid": "be5baf7a-8775-40e1-9a82-3553582f8b42", "value": "12288:n0FElsMfmbhMj8G6ivkxgqqoYJqpRu80OAkK9ieH9I8:hlVmbmgticefHgRu8PK9FHW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600637, "uuid": "1b111139-be4b-48c6-a3f2-13b1a72be438", "value": 424460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600637, "uuid": "a92a0a20-f5a5-4cf7-bdbc-fd19ccca4698", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600637, "uuid": "db381492-c839-4e1f-9d2c-eca5ed2c7745", "value": "NEW PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0825dc89-94bf-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645630873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630873, "uuid": "66478999-d67c-44d8-bdb0-72bb72bf3801", "comment": "Malware payload (ArkeiStealer)", "value": "d3dc388312ff29a8ef87770101c5334d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630873, "uuid": "d9fc9d1e-3fb2-4944-83c0-039abd0382c9", "comment": "Malware payload (ArkeiStealer)", "value": "4c2ee3aea718f89be0dd83db92ed882dd4e94dc65807e344e2bcdbc032674c8e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630873, "uuid": "2498c29d-5d25-4c49-a6fd-27b41d0f1463", "comment": "Malware payload (ArkeiStealer)", "value": "0dbd1b4fe253d73d7407cde7a7b4c78c41b623ae", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630873, "uuid": "57d27e2e-8a18-443c-b858-22c576e2e672", "comment": "Malware payload (ArkeiStealer)", "value": "0189333cb68a7082b3fc113f23b10707719193e9730fdeb6193d281826726300afe32db90eba446b6ec902f36dc8c508", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630873, "uuid": "8c4de0db-3822-46ef-911a-c7a6172126e5", "value": "T197748E00B690C039F1F756F845BA9369A53E7AE05B2461CB53D52BED5B34AE0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630873, "uuid": "f8439583-c31c-44d2-ac5e-204496cc14dc", "value": "ecfb8ce0d70668868f462672b03acee3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630873, "uuid": "1e17506b-c1e7-43fb-9cac-98bed19b18e3", "value": "6144:+fRWS00j0i/kNY0HID3jr68KDGoflsoTwxe4D3SsbZDmR2vSr:+pWSMYLbjr6LDGoflpUeq3SsFpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630873, "uuid": "e772cdd8-5e79-4bab-a52d-44621b16adb8", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630873, "uuid": "d56f10a0-0747-4bd6-8fee-081e77b03214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630873, "uuid": "7bd64059-5e3e-41d8-892f-4ceceebcd715", "value": "d3dc388312ff29a8ef87770101c5334d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20442c1b-94d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645641651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645641651, "uuid": "05abc665-cb1f-4034-afa2-e6a437230740", "comment": "Malware payload (Heodo)", "value": "51126ccb25506352c8542e4cb6d9bc0d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645641651, "uuid": "4db9e719-2d08-41e4-ab9f-7b4c899c643e", "comment": "Malware payload (Heodo)", "value": "4cd919969556937c51884182e4c699df63010a7b1211c90ab691315486f85075", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645641651, "uuid": "ee273272-021a-424a-846d-0c5e299594f3", "comment": "Malware payload (Heodo)", "value": "e68ed3e7451a7257c2cf9aba95dae1b06c7f897d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645641651, "uuid": "c26ca759-38e2-493f-b9c9-53c97c86be47", "comment": "Malware payload (Heodo)", "value": "9217908028e431757a1debdf363a9bbb47d125f3a35a7569876e0c6ad6a931367fbc830d401fa5a7ff42227dabfc9431", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645641651, "uuid": "c2eec631-78ac-4dd4-8ea3-ae58b32d7108", "value": "T17D93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645641651, "uuid": "0c307a63-3bca-47eb-8747-db64cb062765", "value": "1536:vQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:GDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645641651, "uuid": "a47e4a9b-5261-4cc5-8b86-1218f070fd80", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645641651, "uuid": "fb56156b-0ad8-4eab-b364-4a6e42acc5d6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645641651, "uuid": "4a46149c-e814-44b1-a2dd-972eca173951", "value": "payment.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8aba68-94bf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645630884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630884, "uuid": "ebfe575f-9711-4a9a-9f5a-52b5c0fa70da", "comment": "Malware payload (AgentTesla)", "value": "eacb25f6856aeca31b55a0600f1ef4c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630884, "uuid": "eabee51f-4fee-4aa1-a6bf-4c49b99ada39", "comment": "Malware payload (AgentTesla)", "value": "4dd8aa04ac02dd1fb4aae41cb1160b968896f399612203ab56dfed1ee0bff6d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630884, "uuid": "63d25765-1bed-460e-9bcc-8cba558b11b2", "comment": "Malware payload (AgentTesla)", "value": "a33abc3d209cd7f57a61efd37efa7ca0f5345422", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630884, "uuid": "ec6b2975-909d-4cf0-bee7-61682eb5b47f", "comment": "Malware payload (AgentTesla)", "value": "9a1d232874c81319298978b2e9f7c1aaf27f71c50e0f934df798ed9b561a99fc974f0c2aa54d0c7f5f41e873ac803001", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630884, "uuid": "dd85fd6f-769c-4590-a427-a42444f217f8", "value": "T1A4355B9D365072EFC867C976CAA81C64EA60747B930BD203A05716EDDE0DA9BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630884, "uuid": "dab69d19-db23-421a-9fa7-1c489f9af156", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630884, "uuid": "ed62d4a2-d970-4f0e-a2ba-778e28c2ad60", "value": "24576:dQ6gkXiFEBSNQITMwy8IpgPu+9jkULmK:dQ6JwTagPu+96K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630884, "uuid": "5e57b567-8e90-460b-adf1-f584f1f68155", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630884, "uuid": "ab967cc0-02d2-40ff-bb82-58b888baebe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630884, "uuid": "b6f92284-eac4-45bf-8272-4f09daafc8be", "value": "eacb25f6856aeca31b55a0600f1ef4c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ef7406-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "ad351c3e-f645-4ead-855c-77fd18e92206", "comment": "Malware payload (Heodo)", "value": "6719fbbbca7ee0cadb791ee356a32a77", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "66def5e3-b518-4549-b97b-dbe3b87db0c2", "comment": "Malware payload (Heodo)", "value": "4e09c97f637f6dd3da46fc1e364498624cd735611f21ab32ffcd29d178a76a5b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "f54cfd99-04a9-4a5f-8341-0d1944967543", "comment": "Malware payload (Heodo)", "value": "113a7224d42a6fb6f367c199b9a8c11977506d7e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "9409ec8d-026b-467a-97ad-d265414b5d63", "comment": "Malware payload (Heodo)", "value": "02890e299ecfb3692a737826072ad40309a49dc2ae25a6f6d115a76b9a8ecf9ba87b72edb248ad75764b29cbd413afb2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "e49074d3-c368-49f2-8d48-240b988537e3", "value": "T17CB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "be0c43bb-6c9b-4f33-86de-7eddd83db9ae", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "c71f05bc-53df-454a-b04b-a525229edb3d", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wmIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWRzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574798, "uuid": "5c1e2dab-d397-4bd4-a023-4637eebd424b", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574798, "uuid": "345a2a57-d028-42fb-ada4-1944bfe0edd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "f84fdcba-97dc-4e38-a1a7-dd8b414c2ee1", "value": "emotet_exe_e5_4e09c97f637f6dd3da46fc1e364498624cd735611f21ab32ffcd29d178a76a5b_2022-02-23__000634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516bef81-94b9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645628419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628419, "uuid": "3713d419-8618-4d45-a427-48dde4bd4926", "comment": "Malware payload", "value": "7c21a2a4eca7ed2f58d316e51a9e6784", "object_relation": "md5", "Tag": [ { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628419, "uuid": "614348a9-2ff4-473a-b8fc-a8d16079e10b", "comment": "Malware payload", "value": "4e52de14bfc1be687bd3e96fb0ebbf9b73a95218d529186cd53e41b8903f1121", "object_relation": "sha256", "Tag": [ { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628419, "uuid": "b00a659f-fb6e-46d0-81cb-95acbe9f43f4", "comment": "Malware payload", "value": "1c2ca8e1fc86208a38c41da4e75337b9110aabfe", "object_relation": "sha1", "Tag": [ { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628419, "uuid": "852f741e-37cc-4e59-9edd-ddf8db77e6cc", "comment": "Malware payload", "value": "ccd5221c21aca29a73eac91871cc7235461921979bc40dc354723b7bee24322205449e9b4dd9aa947faa9efd14da0e6e", "object_relation": "sha3-384", "Tag": [ { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628419, "uuid": "d236076b-0e7d-418b-83d9-c0a6c31e1a03", "value": "T11AF3120A7753484CA065709A3949F689E87B5670772221F6FB297978CCEDCF4E3A19C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628419, "uuid": "0b31e604-a96b-4a5d-851f-b1e64f195097", "value": "3072:y1TCk5ckL31RmLcHLmBjTT4T4hfBBYjLDSbTQbH7tldmOS9PRKAk8ng9:iTC9kL31RkcHLkjT8TMfBBgLu2HhLmO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628419, "uuid": "6ca8ab31-827b-4fee-aaa8-dabd3db374bf", "value": 166174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628419, "uuid": "dc354484-8ab9-464d-b96c-66bc380801e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628419, "uuid": "9d3e198c-be5f-41c7-99c4-99f2dfd14a6e", "value": "DOC-8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0ea099-94bc-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645629752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629752, "uuid": "ece47a8c-fd26-4dd0-a902-8e98ee80aefa", "comment": "Malware payload (SnakeKeylogger)", "value": "315a9bb9b5e735fa8f3565a605dbcaad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629752, "uuid": "3ab19171-06f2-45df-9a55-4e504c63b4d5", "comment": "Malware payload (SnakeKeylogger)", "value": "4eeb394072120c6dc5d90915b9e65740d5a03f12a8fd53cd7e038d68a1069b92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629752, "uuid": "b1b8f217-b3f4-42ce-8e8e-6137d5f9b841", "comment": "Malware payload (SnakeKeylogger)", "value": "0605da75aed272c9e84bcee6c486e991613f2f18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629752, "uuid": "3020ea27-48cc-4a4e-b85b-acd70bbd7f72", "comment": "Malware payload (SnakeKeylogger)", "value": "2495f3340cb00159689bd27c5d1e009f678d138c1f397c3c4c134f626d72994d1bfb0e60255d7b9c178d3bd075618b2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629752, "uuid": "0633b815-cddc-49d5-ba48-419d33b4fab0", "value": "T177F4CF483A671F3DF5B18BB21DC4ECB4BA98FB371C08B37D78516686C691B809942376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629752, "uuid": "eaafe1fa-e52b-4cbc-9ec3-d15714f29171", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629752, "uuid": "baae18ac-e340-4ebe-8130-63747a5eb2a6", "value": "12288:HWwX7N3o6h7jVK777777777777jZ09jpKqzuqDr7nKAHNgzY7d3DV+qqhpKNWvKX:xK777777777777j2LZz1DrnUYFDVUhd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629752, "uuid": "fb7f6a29-52d2-480e-bcf9-18a09fd4e095", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629752, "uuid": "aa5dc260-0835-4dee-849e-7334f0124a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629752, "uuid": "84944895-00aa-44a5-9a39-fa6b0a23075b", "value": "IMG HBT0093174836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e0cd32-94a9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645621629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621629, "uuid": "9892edb0-5431-46c8-b8a6-683a3521fdaf", "comment": "Malware payload (Loki)", "value": "295582c1fe1cbc3ca30f150e4b3d409d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621629, "uuid": "739c4610-92b8-44a5-8ba8-fcf64e314e55", "comment": "Malware payload (Loki)", "value": "50762a8f6247c667e01b4f2d2a1c067401d8e278fd37e73668c927349b9727fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621629, "uuid": "41257104-fe70-4269-9c13-2fab92376c92", "comment": "Malware payload (Loki)", "value": "5de08c51a64c497b0a5e3d3bedf4c9d1abf4ecce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621629, "uuid": "8ac5d9ad-b476-4d40-9e8c-8bb6f80342ec", "comment": "Malware payload (Loki)", "value": "5345fa2bf1025c5c40fff8a9ca90e487b69103c1176310210c11d3fae42b8232023aae2cc03af43f081163007e2c171f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621629, "uuid": "88996960-4fb3-4363-8d0b-e0b55fc86743", "value": "T184549E10AB90C039E5B712F8497A93ADB53E7EB15B2461CBA3D01ADE96347E4DC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621629, "uuid": "42706006-0f54-4b13-a982-2f3ab132559c", "value": "32f2c538eab8007c123c6eaeceead9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621629, "uuid": "e7963c71-5141-4974-981a-587659cf817d", "value": "6144:NVOxwrNyLlK1BDvo3SC7W26WOl5gkJajiuzOAbjnM:bjrsL8jDvo3SGEDJS9zM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645621629, "uuid": "1fc0e7df-50ff-4a11-a792-429d5d83da70", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645621629, "uuid": "acb180e6-e177-434d-851c-951fd515015b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621629, "uuid": "f5dde84f-54c0-43d2-b8aa-2daf78608841", "value": "295582c1fe1cbc3ca30f150e4b3d409d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aeb44ad-9464-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645591928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591928, "uuid": "62d255f5-4249-430f-b34e-fc556c056cc9", "comment": "Malware payload (Mirai)", "value": "590f6458811e86ce9eaa230ad83bd328", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591928, "uuid": "68810c87-4888-4a62-898e-56b96304368d", "comment": "Malware payload (Mirai)", "value": "51b629e5c57ff619461b65c4744f17593432f1be05ac65d26a14c8d41b940dff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591928, "uuid": "cec07841-34db-43ee-96ce-405c54624bd4", "comment": "Malware payload (Mirai)", "value": "4c1b648ef692e7a3c35b5704f74d6f6daa4bf431", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591928, "uuid": "b677d0d6-7c78-4d3a-bc82-0714c96c2de6", "comment": "Malware payload (Mirai)", "value": "56965a980424c9bd6f2daa7919609decd7b959c800d6dbc6b22cb6d6ba37f5465b86b0f4bb2bb5f98a11d08ddcfc7651", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591928, "uuid": "4304deed-9a30-4d70-ada4-2da20f255f47", "value": "T196F2D08CE662A88CC84E4C7DD4CF06528F9DB30321EF6AA867609E50BB769473C45879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591928, "uuid": "5d133f74-5ed9-44bf-b8a1-31c785df6e3c", "value": "768:2s05hYiVFKgcjg8mTADtGAgpAMMfMiq2cCMcWq:2TYiVFKgcjPmUDtpgprMEiNKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591928, "uuid": "79efd246-cea9-44b9-93ea-d098bc448459", "value": 35512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591928, "uuid": "31594900-4896-4683-b17f-af52247121ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591928, "uuid": "82789054-93f3-4c38-bce2-b0a696daf572", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.4326.345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61d5862-946a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645594765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594765, "uuid": "82035682-3300-4fa6-8778-c5fe139f6dbf", "comment": "Malware payload", "value": "9822f80d7953612df9dee799d9bf5d66", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594765, "uuid": "2919f9e6-c514-4939-a8e9-103f1a24e3c3", "comment": "Malware payload", "value": "51d6eb2a57ebd31a7e4f72f0bde114ee6f29f838e81ab316b3085273125e5898", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594765, "uuid": "f6e9fb88-da6d-4e23-9dbf-27b5971328ae", "comment": "Malware payload", "value": "162c7ec9b2f116db2bf13084f3256bc18848e4ec", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594765, "uuid": "8ab309f6-840d-4134-9699-8624a9e79881", "comment": "Malware payload", "value": "302e53f90e2a52af7d90191e70c5d41bd8f4a718f8b5d97a1fc729b9e5ef497b9b1307f034ee233610d0bcc77d9cbf44", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594765, "uuid": "2386bbf3-cd78-48bb-b4c3-69fe59d71ee3", "value": "T177D02B25DD30E4CC434EB050C985261C25D102208F251FA8D5150416D81CB88C71D48C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594765, "uuid": "ba4d222d-0169-435e-9834-93a037a1f533", "value": "6:hKX9tSa2jkzozaqEHiO6snaYpXkGVokOMktnrCSVxWpCY:hKNtSjJ2qEHiqnaYuGPO7hbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645594765, "uuid": "a3435c2d-69a5-40ff-9ba8-4b70d7825dfd", "value": 251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645594765, "uuid": "5ca8c0c1-5401-49ec-9912-5117570415c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594765, "uuid": "f533ad60-1d91-4cdf-bdc7-d8971a949a28", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33b02d2-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645619215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619215, "uuid": "f2475be9-1e46-4c29-b9bd-d7bf7ffb4ec5", "comment": "Malware payload (ArkeiStealer)", "value": "ab51760d456536c1e7a1d767c649c885", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619215, "uuid": "19256179-5204-4462-9780-c8fe1c41ab60", "comment": "Malware payload (ArkeiStealer)", "value": "523ff5fa555ad1837c439fd962b07f6cf17a56961fb0c9675d54f9724b476e5b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619215, "uuid": "d14829d9-94ce-4d81-9e86-69e605225a93", "comment": "Malware payload (ArkeiStealer)", "value": "06f4447984af968acc4034144346b1cf0ca615e3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619215, "uuid": "c511f9ac-908d-44f0-87f6-0a2c48d3e3dc", "comment": "Malware payload (ArkeiStealer)", "value": "8c9f89d382c07a917ac28455a064bf240856c92bee4a5fef03e65b2ad50cc669c024ae72d63530d72a7b0c28d204a0cb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619215, "uuid": "e2242740-cba0-4f4f-8065-e78561140321", "value": "T101649E00EB90C035E0B712F849BAD3BDA62E7DB15B2565CB63D56AEE56346E0DC3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619215, "uuid": "a5a27b20-b57a-4dcc-8e64-370a4be41967", "value": "ccd6a4e90a04c24d49f4949717a298d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619215, "uuid": "b46d4839-1ca2-4b41-b5db-7091860b1fef", "value": "6144:rG8NuzZJNdq+eWFUKpXbYxq5jxP6Na5SShcEqZd7+nO:S/zZJvq+3uKpXbYx81SSGduO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619215, "uuid": "22b7c79f-2ffb-4ae3-b2fb-8b8cbb731143", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619215, "uuid": "592ba443-3881-4cb9-9d21-87c0393153ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619215, "uuid": "ca4b92e2-bef9-4fdf-8b98-0468c65fe667", "value": "ab51760d456536c1e7a1d767c649c885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75db225-947d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645602847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602847, "uuid": "f94d5855-8a71-4b71-b4ac-763ab9f7e382", "comment": "Malware payload (Formbook)", "value": "93f68822bccde7d1004967418c40f886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602847, "uuid": "a7515e78-2762-4d46-895e-0f8029ff9515", "comment": "Malware payload (Formbook)", "value": "526f4e19614eb20343647b92758df4c1f9227e77bec90af22256af4b3b091596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602847, "uuid": "22604298-f353-4a71-96cc-9a61fb32c206", "comment": "Malware payload (Formbook)", "value": "71e4bd4743f41edd54d3727d9b8b9d0a0f955870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602847, "uuid": "2d339f84-e523-4fa3-bd69-107513e25c44", "comment": "Malware payload (Formbook)", "value": "0f36d7bbd5d6f36afd8a9bf0c9ee1073a896e60a3fa3ffe183f09fe8ec3620c8ef8bb806a0a18d02fe5f98abf956ed3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602847, "uuid": "42bab20d-6cfc-4ba8-b4f3-acbb1e22ba0e", "value": "T15EE48D22F1E18432D02775399D5B13549826BDE23D3CF8466FE83F587A39A89351EE83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602847, "uuid": "b2142662-0b9e-4503-ae48-c71f469b9726", "value": "9a208a82f2ac1ed3524405196188a65f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602847, "uuid": "d8685b7e-d8b4-48ba-9cbc-46655e65b862", "value": "12288:wqPCYSx1alrmI6WvcmOEgJCegF63A5W7S2x3pxjsf:wqaVIiI6WvcykBzw5W7d3/j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645602847, "uuid": "28d5d077-7a72-44b1-8e58-0dad5240cfb5", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645602847, "uuid": "dcc4772c-f917-41a8-bd10-2ea8930ad2e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602847, "uuid": "e90e5bb5-48c3-4c94-8f8b-36906c8e8bb9", "value": "d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb6c7b0-94e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645645757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645757, "uuid": "96f540d2-2bc1-421b-bf60-04c35c30d119", "comment": "Malware payload (Formbook)", "value": "c01a0ec91c882e9c565a7c7a056d2195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645757, "uuid": "5b2c405b-16a4-4e6b-a93a-c1fef7dafa2c", "comment": "Malware payload (Formbook)", "value": "52c0e61d96bee61df6c543a1d38835bf8cb4691f777fd2e81bc377543a53ef24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645757, "uuid": "5665e541-a686-42f2-b78e-95560dedc4bc", "comment": "Malware payload (Formbook)", "value": "4187400e3b08dfec4a104cf2d88df7c49b1da86b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645757, "uuid": "b6926e47-cfeb-4426-bedd-72469f95bf19", "comment": "Malware payload (Formbook)", "value": "2595d4c46b740010b52c02be1424e3572b127f576b4cf6b0d9b51f2255fa86c25ac1c50e4b68c7e2b1e204a2a618b922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645757, "uuid": "474e82c3-4daa-4d35-a7a0-d7f32aa971a4", "value": "T15105C04839A75F3DF1B59BB24DC5ECB4BA98FB235C08A37D78553246C291B908C432B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645757, "uuid": "f4980ab2-06cf-4a11-b2f8-a500d293b534", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645757, "uuid": "d45c468b-f9b8-4a84-9c3b-b0b7c036afb8", "value": "24576:2qK7777777777775kbfHnyNeLf4GY/KrYB+:u777777777777ObfSALU/4YB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645645757, "uuid": "fd696e38-d47f-4a3f-9bd0-50f77f7cad96", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645645757, "uuid": "465ffb1c-a8d1-48c3-8c67-6b27620b9dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645757, "uuid": "294090d4-2b0f-418d-a9dc-bf082a418cb5", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eceb802f-94cd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645637270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637270, "uuid": "47709aea-41b0-4019-a42e-f547985bd728", "comment": "Malware payload (AgentTesla)", "value": "b8eec09f266e41c69079fb336b0b4008", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637270, "uuid": "e2def54a-281d-4a3f-bb0d-3941a4124926", "comment": "Malware payload (AgentTesla)", "value": "5392ffef649d047bb5a51354b8ff8553a0113378ba880eb25c83bcd068d4c7ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637270, "uuid": "e652b000-8034-4a44-addb-cb7f32d498f2", "comment": "Malware payload (AgentTesla)", "value": "8d2d7a5bb54cc74710bbe7818b76016cc5e1f0c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637270, "uuid": "f45f21f2-b319-45c3-a80b-1f7282a1db59", "comment": "Malware payload (AgentTesla)", "value": "cb68aed6fdad4e3089a7007a0067907783fe05786513345678f141845c839a9abf1efb9ea2e4c72c589932c2f32bb3c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637270, "uuid": "3ab0a59c-eee4-4b08-a167-d318eee6ad3a", "value": "T16C0512AA38584AA7CFBD4CB52C9041805BB5ADB13246F3DC3C89B5EA55F3BD146133A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637270, "uuid": "5e12c12b-4567-4a9a-8b90-be2fae3460fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637270, "uuid": "743cdcdf-e657-4354-883d-1996bbef795e", "value": "24576:GK777777777777UwWWmhnudZI5RGdsT40kDrDBq1kcMyYm:T777777777777nZyRGdM03DBlrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645637270, "uuid": "12355d1a-2d5c-4c69-a652-521b9f0cd7ed", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645637270, "uuid": "e81bea03-2cf5-4a7c-9050-9a4ac248d1b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637270, "uuid": "fdb89c5f-0f32-47ac-b553-00b6f589da42", "value": "SHIPPING ADVICE ASEANS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee24605e-94af-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645624387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624387, "uuid": "ba708ab6-e0d6-4a2c-9305-080d884242bb", "comment": "Malware payload (Heodo)", "value": "36b3d494a5c0c8b216d0f3a435617c58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624387, "uuid": "a1c71f7d-cb93-4712-a287-93780897bcdb", "comment": "Malware payload (Heodo)", "value": "54c0371aa48d46b57954bcf7c6a140641bc3129b94252829ab2f56ed30384ac5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624387, "uuid": "7638b092-b1ea-4a56-b165-8dd3208044ab", "comment": "Malware payload (Heodo)", "value": "54623202b2c7989e4bb064e294e41beddcda4659", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624387, "uuid": "240db01b-f2a8-4658-87d6-b57e0c472d69", "comment": "Malware payload (Heodo)", "value": "02eb45b81ea4476a4a98d127f732cbd907e425979f71107cd6efc6ecd47903ee1cc1dfcaba089c4b12e23ca4e1385e62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624387, "uuid": "7958e27e-67c6-48da-8597-4f5543544e13", "value": "T18735BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624387, "uuid": "79b644c4-8da4-47fe-9563-8879c2cd5847", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624387, "uuid": "0268e466-08d1-4ab3-ae64-54d454a8a994", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/STewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/STeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624387, "uuid": "cbccbb99-ed85-4ba0-9cbf-59861c613d12", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624387, "uuid": "f13a0389-06e0-43b9-bfd1-02c8530c6d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624387, "uuid": "ba494e84-226a-42f6-a58c-993ee4913dad", "value": "36b3d494a5c0c8b216d0f3a435617c58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baaab587-94be-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1645630743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630743, "uuid": "82a0bd31-5cd3-4c8e-bb1e-ab74a7f94fcd", "comment": "Malware payload (RaccoonStealer)", "value": "24b98318b838252915ce6a0f731621e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630743, "uuid": "85d4d4b6-3dca-4779-b285-fae62414ea52", "comment": "Malware payload (RaccoonStealer)", "value": "5500259af99715db9be2bc2bc4a8be0817018564e6cca97236325c13ec0a166b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630743, "uuid": "263da9b4-ec9c-4781-a647-2a74227f3405", "comment": "Malware payload (RaccoonStealer)", "value": "57c4d389d045a111a7ebeff476e1451b013adb02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630743, "uuid": "6af0e72d-fb0d-4fa4-bf73-4f5da6bdf0d8", "comment": "Malware payload (RaccoonStealer)", "value": "26ee3aebef9b01beebe7c3d42fc00cd7913898134ecf74436b74d1c33a5c86c612efb5b0157138ccfea8973122572e0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630743, "uuid": "a06d8a1c-9859-46cb-a0aa-6bef2d99e958", "value": "T171C4E000B790D035E5B712F899B593ACB62E7AF15725A1CB52E41AEE47386F0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630743, "uuid": "2e6b0f1c-bff2-48e8-91a6-c58bd1e15dca", "value": "32f2c538eab8007c123c6eaeceead9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630743, "uuid": "5c2d2591-d0d5-47c2-8e5d-464f2734e6bd", "value": "12288:dLGaL20ZHCSQbIoYvfEp3H0mcUVdugazoLgprx/Jl5+W3H4:U+HCnh4WHW1Kgprl8U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630743, "uuid": "86a0a4d0-9996-409c-a35e-97abf1abb5bf", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630743, "uuid": "ecfdf946-84f1-4b5a-b591-b01a99878385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630743, "uuid": "ddffec9a-a4a2-4e78-85ef-1ddf72e73909", "value": "24b98318b838252915ce6a0f731621e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d165c1-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645622920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622920, "uuid": "9a91e430-bbf0-4e0e-a319-f1db42c5ae4c", "comment": "Malware payload (Formbook)", "value": "953708e0cefbd35c124e526d9f7bd4d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622920, "uuid": "04e503fe-3b39-4592-b34b-31d23f36a3dc", "comment": "Malware payload (Formbook)", "value": "5598831a8a17b53751f4c34112c7c4b42d4906a6e73d60018ae8d499ce605580", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622920, "uuid": "a04a0272-c28c-4053-aed3-0ed4388f7fc8", "comment": "Malware payload (Formbook)", "value": "5c3437b790aaca62b048c38f53584aedb6aaa118", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622920, "uuid": "4579fa9a-0fcd-4077-82fa-2f1fc3daee91", "comment": "Malware payload (Formbook)", "value": "ce299d4a6304f608ddfc614c7d475e29d149b4c922a4497cd1cd581c7f0d4100356ebc42a8f15f491391a10eb448ec67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622920, "uuid": "5d2c7ba7-3fa9-4549-ad80-70b4774baae2", "value": "T1DEF4A92A38AA100DF262AD7C6BBCB175911EF7F226365CB70DF7050A11129F0DB9D627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622920, "uuid": "c518f3b5-70bf-497c-b5a5-22f031c9d90e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622920, "uuid": "649425b3-4873-4ee4-bacb-dced14a0374b", "value": "12288:Wmh4J9EAXNRFkrYEID7STduSghxtH9Gr0UdSKhbXeU9ouJ91ds6xEk5oU:NIaKhceUJhJSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622920, "uuid": "d20093be-8be4-43d7-b4e8-958f73feaa33", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622920, "uuid": "373f2813-36e6-4701-9139-4b76a21785b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622920, "uuid": "177a69c4-369c-4b53-9a22-6f023d1a4df0", "value": "953708e0cefbd35c124e526d9f7bd4d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ada0478-94ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628811, "uuid": "9ca9ddb7-1d94-42b2-957b-cb3cf585ce2d", "comment": "Malware payload (Heodo)", "value": "9ef9d5d06e49e02fe07f83dde4c2a57f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628811, "uuid": "023e93cc-1fab-4dae-96d3-886558fc6ed1", "comment": "Malware payload (Heodo)", "value": "55e36f83adc239d974852e374a27bcfb7cf158aebe78efed4a598bb7c28a154f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628811, "uuid": "002ba485-b103-42e6-ade4-f0fa37f16568", "comment": "Malware payload (Heodo)", "value": "a0f76b24c3ce96bf80d0d37fb59c8cefd6d98f33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628811, "uuid": "98767ee4-0db1-4504-857e-2473cbc19a8b", "comment": "Malware payload (Heodo)", "value": "68ad1d5f8a88dd2a51d66c2a2b5c4700adbfba8d43bc3a01c2c86b14cfdfad6a1268eee83006b492b6499ae917be63f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628811, "uuid": "7d791d0d-10ef-42f0-8889-5f154210d96b", "value": "T19A35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628811, "uuid": "df0308f1-8f1d-41fe-bd1d-836f61e56282", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628811, "uuid": "0c0784e7-f8c4-4f05-8541-84b4b375718f", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/TTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/TTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628811, "uuid": "04c5419e-aac4-48ac-a78d-f130109d2a2c", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628811, "uuid": "106be663-eacf-45bb-9aa3-01bda2c6871e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628811, "uuid": "60718a86-d9d3-4bf1-b081-9f4f69ba4c1e", "value": "9ef9d5d06e49e02fe07f83dde4c2a57f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5193366c-94b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645627990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627990, "uuid": "4d6d08f9-d0c8-403d-83e6-ee3370de4605", "comment": "Malware payload", "value": "0533a234ac2761d9833170ecbc600414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627990, "uuid": "9abb23c0-fd0b-40ff-bccf-b3ce88948992", "comment": "Malware payload", "value": "5611d86c7c8dc065aa831d18491247e34456e6e846c08526e9c51942b556a653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627990, "uuid": "8c6c2306-d266-439c-a7e3-f5d5a9aca61b", "comment": "Malware payload", "value": "55ba926bf728f9b8b89c841f4f60f95869ec60ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627990, "uuid": "7506b306-090c-4a69-868f-7524aa5b1dc7", "comment": "Malware payload", "value": "64ec8d457e57caf1267d0310f489f90872ba44f81af5b469471d3e7ae9d014dd118e917cc82c7576a68de780f5c57476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627990, "uuid": "ec433e01-f181-417e-b22d-1c14afbdd1a4", "value": "T17A530239EB54A47E8A5092B51DB5FA07A03CE2575669CC8DEAB882DD316A2847E0C133", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627990, "uuid": "e791e9c2-84bb-4232-81d2-4f0f52f33f25", "value": "1536:M3/yDbZL5gEW6oNtogK7Y8BOdWc30K6Dbvi24NV:M3qD4EW6oFx8BOdWckKTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645627990, "uuid": "a9353e73-dcb3-4d0a-9bc6-cb180b85a81c", "value": 62199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645627990, "uuid": "800ee1b4-9ee5-4f21-9820-448a3f0d5f56", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627990, "uuid": "f82ef279-b042-4f50-8608-08995981ad1a", "value": "RQFFOB.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89813f89-9477-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645600167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600167, "uuid": "a3aadfea-f401-4552-a741-60dcbf3e5347", "comment": "Malware payload (Mirai)", "value": "61615b7310cddc94021d7f26f12b6d48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600167, "uuid": "ec6aa17f-1f13-415f-b5a3-439cd588170f", "comment": "Malware payload (Mirai)", "value": "562f4d8f1a8df867a5f41f3e136be568cbb11fb302082e89fa88b7589dedbc52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600167, "uuid": "55cbf620-dd61-492c-9d4f-24b6c0b2f167", "comment": "Malware payload (Mirai)", "value": "76512fec14b3722120199b11b5297ed9f5d90e98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600167, "uuid": "4545351e-efe8-4073-a902-9e2212f5d1c0", "comment": "Malware payload (Mirai)", "value": "b7256d564eaa0a6bdf8caa3c7138925fc4e93ebbb941821bd0c16438419a3437a9ec22c2bb3fccf4e018d9159da4a0e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600167, "uuid": "272a1aba-1bb7-4f42-9734-4a705335822c", "value": "T1C0532B89B8019E3CF84BE6BE84310E09F735736525A30B2776A7FDD36D711684E86B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600167, "uuid": "1ac57767-b9ef-4e67-b931-1ce13b3b3029", "value": "1536:ShyW98iXe9Y2MY+VkkTLUOQOR48mwRPw28uwhaNqHl8OwfO:Sh5ToORq8LY1xlBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600167, "uuid": "10029b73-d969-4123-aeeb-b37cabc03ca2", "value": 60892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600167, "uuid": "c7768bf3-5680-4391-b771-fde355b93972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600167, "uuid": "3a765841-47aa-44e5-8c34-e497fb80fdbc", "value": "61615b7310cddc94021d7f26f12b6d48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b8949b-94b7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645627806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627806, "uuid": "1e0d8001-120e-449d-8cba-d786ae7a021f", "comment": "Malware payload (Formbook)", "value": "74543dc728beddd590f93691884b957f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627806, "uuid": "770f0389-f63c-4e34-bc3c-e5c805423839", "comment": "Malware payload (Formbook)", "value": "564d91f37b294e7a10fe79495dc9da5ae6733b20f2d7c732ff0c692110b0e01a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627806, "uuid": "2866dcf5-8b3c-4967-8caf-81d376238bea", "comment": "Malware payload (Formbook)", "value": "fadf20cccd5b329c2f984320d2af7dcd3fdfa867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627806, "uuid": "06a0e619-0e1e-455d-b491-1654eda2309c", "comment": "Malware payload (Formbook)", "value": "3bd584ff507d45d814def47e39afb7af2665beea54878f802501170589dbb8cdbe6941148522d720173d652408281586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627806, "uuid": "88a885ed-b551-4bba-b70f-1080da6b0090", "value": "T15DE48E21F1E19833D02765794D1A5258A4267EF0393CE84A6FE43F497F3668E391BE83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627806, "uuid": "33a0e84b-f6e8-4551-b3a3-58c02771a716", "value": "9a208a82f2ac1ed3524405196188a65f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627806, "uuid": "bebad7b9-2ffc-4171-9de7-14f5d19ca6c0", "value": "12288:wqPCYSx1alrmI6WvcmOEgJCegF63A5WyS2x3pxjsf:wqaVIiI6WvcykBzw5Wyd3/j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645627806, "uuid": "aec16534-ad3b-4752-8bc7-998bdc0ea017", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645627806, "uuid": "43fa59cf-f6fd-4977-8541-9232bba952f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627806, "uuid": "51bbe072-bffa-41bb-a1b8-a7c10e9d25ee", "value": "RFQ_ ORDER T0057-22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8006ada-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645619250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619250, "uuid": "2fdbe31c-f157-430a-b190-c19d109fe61e", "comment": "Malware payload (Smoke Loader)", "value": "a57462a9f7716bdbc01ce14f62ae9c4d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619250, "uuid": "d1d0f840-71c1-4592-bebb-10187d8dc35f", "comment": "Malware payload (Smoke Loader)", "value": "568060fc93b570334a759a26c96b13e79e6eafd5f58255fca9a22d7b9d566deb", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619250, "uuid": "973ba04e-3933-4b24-a905-575703e4ae71", "comment": "Malware payload (Smoke Loader)", "value": "b7e2c2fe41b7b883571a25519a89e40f1dcbadeb", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619250, "uuid": "6e702aa9-f89a-40b8-8c07-dfa8b3fe912b", "comment": "Malware payload (Smoke Loader)", "value": "2da1e71772eb55f05f5471e908646bce52591e35370a3029f2497fca94e0b57728215458df67ccb7bdc6b2a7e5d5c291", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619250, "uuid": "5690d807-9f59-4039-913a-2f196c65ee12", "value": "T1DB447CA3B42C5937E1544B3D1819C4D242F67CA55A212B2A3CD8BB78DD3235E2367F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619250, "uuid": "cb6423e4-70a7-489c-9d52-3ab566c8b182", "value": "48e807a7b58ea2b8edb6203daf32ec53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619250, "uuid": "d71b4677-052e-4267-87cc-f41fba2bf3eb", "value": "3072:RWum2MgcLZt7QyB+l9p8IEkmoFGs8GFKjhTYR9NQIm2M7Wx:RfmRgc3QyhiRFiGgjdY36ImR7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619250, "uuid": "cc974533-95c5-4a82-bf12-e2e9bd1a835b", "value": 255672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619250, "uuid": "d6603f2e-1224-46e6-8b79-17857ca50ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619250, "uuid": "b92e9cc9-35b8-4a12-81fe-a6b19db42f3d", "value": "a57462a9f7716bdbc01ce14f62ae9c4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f771125-947a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645601358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601358, "uuid": "b52427cf-0212-4d71-98be-882748f90a05", "comment": "Malware payload (AgentTesla)", "value": "4b257a4311344820fede75716a250285", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601358, "uuid": "a7f7b026-7648-4335-b989-7581b0084989", "comment": "Malware payload (AgentTesla)", "value": "5711d668eab4584ac03714e189cc7951cb08f8a5c8fc4745c298a4f19bbd3132", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601358, "uuid": "b3de17be-cbd6-43a2-bce0-e497a29d43dd", "comment": "Malware payload (AgentTesla)", "value": "2dcc7b1c01b6cb8a3b4663e1d6b7f4b0c0fc428b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601358, "uuid": "bdf2f16b-44ed-4cc0-94a3-32567a65a190", "comment": "Malware payload (AgentTesla)", "value": "aa7fce211b6ff4cce577b55aa259e1ca6cda504101524d6048bcc4486eceef1bb803fdc4cfb183dcbb8e35ce150176a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601358, "uuid": "d68e386d-81cd-4b78-a196-052b69cede7c", "value": "T13F152331BD79B57D83E239CBA9B595219A8830C82C8442FE320E6F41754EEDA79D3948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601358, "uuid": "6552c21d-484c-484f-b76f-92acd6ef1887", "value": "12288:MU9+RRq0B/zBm2Uwoc7VL4s65JR5TTGl1tpai7Ob0miWiMYKQGlCfd/zlmbA9a5a:MzJB/5HDuRVTKHpaWciWXXQNzlmNzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601358, "uuid": "3ff4457d-7725-411a-a0de-3646df0861ce", "value": 888085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601358, "uuid": "6dd220bd-f714-4def-a508-0f2ff3bef033", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601358, "uuid": "8be0ae84-698a-4398-a3e6-fce9090e6776", "value": "RFQ FOR INQUIRY No-6674 -290920.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f549fa-947d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645602758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602758, "uuid": "c170c59c-a129-46fd-b5ea-7417b72b2846", "comment": "Malware payload", "value": "6e05b674fb8725a4f1faae9d39be1b94", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602758, "uuid": "8f20f043-e6c4-4a60-994d-c92e1dddd63c", "comment": "Malware payload", "value": "58593bc1e886c09c98af123ad57e63973957fbdff65536e3a42bcb52e3b88947", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602758, "uuid": "bee07b29-2fae-422a-a13a-7c1d8d2cd829", "comment": "Malware payload", "value": "b94cd50f44e756895e7910f6d094584974066522", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602758, "uuid": "a7b58c5d-1eff-4060-b2a9-d21bccb36d15", "comment": "Malware payload", "value": "f6acc6642168155b648e93d5c7fd49d74fc3f5da7fffe2e834045675e1366688410f366071561900f80ef6ec643aace0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602758, "uuid": "79bdeecc-9ed8-4793-92bb-3ecc9c0a7d7c", "value": "T1FCC6125AE764795FC8F743324A369636740B0D268B4397873848373CA5B7BD01E8ABD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602758, "uuid": "3d823863-4a30-4d9c-9a3a-8f9d5dca012e", "value": "196608:NQGvQJnQ3CQvQQdxQpMQnuQEYNrIu1bUYe/cxES6hSoTq8DX3vfIg0:PkS9lwTeQI0UYe/cohSoNYg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645602758, "uuid": "31edb92f-9f38-4b78-bc6c-417ffd04945c", "value": 11658460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645602758, "uuid": "04e9830c-ef6d-4f88-b489-9ed9db899f41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602758, "uuid": "7a9edc96-9947-4a0f-ae60-eab24a45d98e", "value": "Healthy Blood Pressure.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a51eb4e-9478-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645600517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600517, "uuid": "58e9b435-c629-4055-abb4-fd5d20745e23", "comment": "Malware payload (AgentTesla)", "value": "7e5d976b5fee1318359f2135f35ffe19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600517, "uuid": "c94970d6-a95f-4549-b7f9-c5006bdd77a0", "comment": "Malware payload (AgentTesla)", "value": "587913fab422e14148da344c2c582790c0aebf2058475647cb892de06c2f2fc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600517, "uuid": "7cce200a-f07b-46ea-97df-8a9910a26d64", "comment": "Malware payload (AgentTesla)", "value": "dec218f7495de9791e5aaa7bdc27e8380964074c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600517, "uuid": "798d5133-9997-419e-8bbc-92a4820d2454", "comment": "Malware payload (AgentTesla)", "value": "d4300d4c80f49e58d9daddfdef99d35f1c46515cdc150ca8e5505b06264b514364cbc41eec47ce468478ab0f374d0a72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600517, "uuid": "890297d1-3aa4-4bd8-90e9-b0626e1c9c75", "value": "T18805CF4839A71F3DF1B18BB20DC0ECB4BA59FA331C08B37D78556686C6A1B849943677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600517, "uuid": "25e12683-dd47-4eee-b293-404eeee98147", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600517, "uuid": "2dcbc7d6-a307-4197-8143-8c2e749ca86b", "value": "24576:7K777777777777u1B9Sp9SUItnC/h5ei1nTd:m777777777777u1/q6ehAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600517, "uuid": "a33149e1-afcd-4f32-b9ef-0baf68145060", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600517, "uuid": "19771e77-f803-4979-8bd0-2e0f0089340f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600517, "uuid": "739834b9-a70e-4170-81df-5ac01a962aee", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52eef322-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645618973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618973, "uuid": "ff9219ee-65b9-4a13-a2dc-6513620c1ec8", "comment": "Malware payload (Formbook)", "value": "d08d71ef2164f6f96d7e57e359e414b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618973, "uuid": "7dc062a2-be9a-441f-88fe-48cab2fc868d", "comment": "Malware payload (Formbook)", "value": "587db04b7b6cfd24c9c33bb352bbb8a32f069a15853faffeec0d48baf82cad6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618973, "uuid": "cbfdff38-adb4-4548-84a0-3a5fe94ae676", "comment": "Malware payload (Formbook)", "value": "0cb6a2762f2d52c4fbbc0e43fd112e7570b94c8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618973, "uuid": "c78d95c6-1b83-46b1-b393-5946e44116aa", "comment": "Malware payload (Formbook)", "value": "cadfad92a50a7be5bc105b997fe406e7f3d344bd0e850a2552255b350e620ac17b7226f8645bef25147dfdc8dac6b949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618973, "uuid": "2d230d73-20af-49d7-af67-de075b2907bd", "value": "T11F03F81A6896961DC9D47BF86DB0928366367CF10124C18FECF97F29E972223DCC216D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618973, "uuid": "715f7407-4069-4c6d-b092-39585acfa115", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618973, "uuid": "adb5544c-56d1-4e83-848c-72e58096cbd4", "value": "384:ZlEgZL3lJwhblunfKwP3QEulai+MwCKPEH2S3dd0hUADkaq3:ZSglqbey88lsMwCK63deVDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618973, "uuid": "5f910d41-77a6-4bc1-802f-07b3887c6c8d", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618973, "uuid": "b39ad9cf-eeef-4250-9ad3-f5ee485d98d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618973, "uuid": "844255c9-c9bc-4469-ab8e-87efc6a97378", "value": "ADNOC RFQ 97571784 - GHASHA MEGA-PROJECT REV 1@2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ba7888-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645619192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619192, "uuid": "3ef3031f-53f3-4a6a-9b40-b4d6287128e3", "comment": "Malware payload (SilentBuilder)", "value": "df0d8d024618e215321557d3a77c327d", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619192, "uuid": "105ee808-27bf-4955-a7fa-dba1078ba4dd", "comment": "Malware payload (SilentBuilder)", "value": "58a20563c578bb4e91d4aa20dcd8f7630dd132844069802d534b53c2ecce989b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619192, "uuid": "7653f2c5-c475-4dc2-a0bc-2f190e454ea3", "comment": "Malware payload (SilentBuilder)", "value": "51b91837d1aca33725186434be10612440360128", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619192, "uuid": "d6f2d486-5819-4f34-8029-60cc4d66e5c2", "comment": "Malware payload (SilentBuilder)", "value": "51697343bec2fdcc8370cfbe5ae9f61c61aa71621f15aee5467c8004e656c371f9a0d53632f390691edf0ec7c3f8dfb4", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619192, "uuid": "4b6055ca-7e36-4a5f-94a7-e00a1fc5218b", "value": "T1B853184ABA4A991DE51587358CE747E96732FC104FAB0B873A49F3257FF99D04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619192, "uuid": "cb196c0d-e47b-4681-9d46-a039658bcfb8", "value": "1536:sp+KpbdrHYrMue8q7QPX+5xtekEdi8/dgJ5+4kKF3XOCmGanK8oWI2:sIKpbdrHYrMue8q7QPX+5xtekEdi8/dT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619192, "uuid": "a405d044-3a54-4234-b3ef-dd47bb0434c1", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619192, "uuid": "6d594bfb-09bd-4f2e-8039-dea33a8223a4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619192, "uuid": "99bb6da3-9add-414e-9661-ad254c9c58aa", "value": "Kommentare-2302.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab1526a-94bc-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645629750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629750, "uuid": "96782265-a66d-4745-883b-f32dc92f6cf7", "comment": "Malware payload (SnakeKeylogger)", "value": "78a632bcd3605ebae72b1f1e765c07ad", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629750, "uuid": "e601fa57-5291-458b-adde-cb57ad0a95c7", "comment": "Malware payload (SnakeKeylogger)", "value": "5a8959ba79fc23053cecc9574ba752d08047f945b4491efb55e6a84f7bd3f361", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629750, "uuid": "cd30f6e9-adb4-43a3-b6a7-7916306129ff", "comment": "Malware payload (SnakeKeylogger)", "value": "0dce293a8c1db6e6b05378980037e7082770aa10", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629750, "uuid": "fed1601b-f4a2-4292-88bc-31289790b259", "comment": "Malware payload (SnakeKeylogger)", "value": "b8d72c75b6abf64e5fcdce5610112af2b91af0fd720280d319117f02c8326c524a1275d911be974f52b6624a84eeada9", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629750, "uuid": "586d7982-53a8-4bf8-bcc1-fb7ea58b3a22", "value": "T1A605C04939AB5F3DF1B18BB24DC5EC70BA99FA331C18B37D78552246C691B908C432B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629750, "uuid": "8151a74a-fb0e-4098-a096-2b15a5e1069f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629750, "uuid": "8c88eb1d-05ab-4761-9b74-ab86d4feb778", "value": "24576:umtpK777777777777oFW7gOk5VNWAwjIX0EqmVJYboeu:S777777777777o2ViNyEXquJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629750, "uuid": "9e7c2864-2712-4eb3-b78b-90600914c309", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629750, "uuid": "3b0b44a7-9259-4b04-b37d-84e8d0f90372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629750, "uuid": "642a3cde-cd34-4aea-93a1-68ebf999b763", "value": "Order150222LC.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d01d14-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Neshta)", "timestamp": 1645619385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619385, "uuid": "226663a6-f193-4ea2-88c8-4c67d2a69028", "comment": "Malware payload (Neshta)", "value": "f201c71f9389d996a80ce65a17353cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619385, "uuid": "d5f46093-06d7-40f2-b91c-a9f25cd56e1c", "comment": "Malware payload (Neshta)", "value": "5b3f2d209915f215a7a52f93f9103acdbb0c3164a43076656763e3384a50bdce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619385, "uuid": "b1fdf0d3-803b-4c99-aea3-26368128072a", "comment": "Malware payload (Neshta)", "value": "ba660d35e0e7f9e0ab84cdb6d869463c5bc77c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619385, "uuid": "298c4fae-09e4-4cdb-94fe-626983471982", "comment": "Malware payload (Neshta)", "value": "f4683ccdd93145269a2bf4449b6a8640df0af4a57053a51bfc9209608455bfa133b8af24acc2bcb35affdffdfe818128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619385, "uuid": "780c3012-f41d-4bfc-bb39-d087c0528454", "value": "T1B704AFB6B8D38431D0266779EC2593EAE12F39103F31D1BE764D2DCB9D392C69938846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619385, "uuid": "317139f4-10e8-455f-9e60-aaeeae17800f", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619385, "uuid": "3e8007b3-05ec-4e92-b4fb-cc3fb5cda6b4", "value": "1536:JxqjQ+P04wsmJCH/by0IVSsQp/rpv4oUx1DOOO39e0CIJtZo:sr85Czy0I7QBrpNUxVNotZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619385, "uuid": "61213599-2ad9-4044-9a05-ec560af6da68", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619385, "uuid": "c3d6f427-2aa6-4ba3-90bc-5c6eed714b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619385, "uuid": "82dd332e-71f0-4cba-9708-a6ab3a993ab0", "value": "ExpServer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69216e9b-947b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645601830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601830, "uuid": "9e5771d4-4fbb-4726-be79-a16eccc642c3", "comment": "Malware payload (Formbook)", "value": "9e3b4ebbefee954931ad052523a00fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601830, "uuid": "9beb4372-afae-4e65-9971-c31f01458cc4", "comment": "Malware payload (Formbook)", "value": "5c291b48b03f7208a95902a735edb8ff29b7fb241d7451b1ed0fbe49f537f3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601830, "uuid": "705f43af-abf2-4090-83ec-ee6c6b938471", "comment": "Malware payload (Formbook)", "value": "5bd391b05d999b0a7b0d722fddbb63a44ad8b16c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601830, "uuid": "832f4418-8d51-4a70-aff8-5333d589f3d7", "comment": "Malware payload (Formbook)", "value": "92acbb947345b6a797234116220c90e3a687115f065e30502c9380afe8e0bf73acfb90f1e417f7f7fd657e6296b391fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601830, "uuid": "82bc887c-ffb1-4738-a37c-68b1e120bf54", "value": "T12505C044396B4F3DF1B48BB20DC4ECB4BA99FB331C08A3BD78516656C6A1B808953776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601830, "uuid": "6b5db25e-6f78-4b06-85f0-5ae1f52cb080", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601830, "uuid": "e3cdd42a-1789-40db-a819-319a7b070504", "value": "24576:fIK777777777777x+2prvk8MgiLB+cAo7FZxZ9n43eL:Z777777777777c2pTk8MgUnvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601830, "uuid": "0872687a-1300-404e-8f6a-6e4e8a0d4f76", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601830, "uuid": "80725310-fd71-4ec3-a56f-8daa381e13e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601830, "uuid": "56a69a90-f672-4e27-a54e-77fc430841a1", "value": "R5ves5fgxxu15Z8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c0e3f2-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619405, "uuid": "86e8327d-461e-4757-8fef-9ac9ae826bbf", "comment": "Malware payload", "value": "4123694b6e7634c0df9db67feaa3863d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619405, "uuid": "8f2ddc77-2f63-4d3f-b4bb-6bb1e582eb11", "comment": "Malware payload", "value": "5c6ec4323e87a3d6ac18e98eedeef2ab92125be53947a9d27bba323133652ca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619405, "uuid": "d2142617-09ff-4624-b446-a2d46cf0d223", "comment": "Malware payload", "value": "0a44af1e6630a8395933e3d4bc7563c41754cb51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619405, "uuid": "98b09065-ec9e-4653-bcfa-d314bf1e5ff5", "comment": "Malware payload", "value": "395fc462021de22e420982c627120fe9bf60c70ac8f91c61f740d416aafcb60afe36b3323af50588aadf0f95d9746c8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619405, "uuid": "15d71325-f9cf-48cc-9f49-8a7bb6507c16", "value": "T162263324D478670C09B66AF223AD930F81686C807A5DC7F1138751BFA90F4B9A7CE76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619405, "uuid": "64894873-4071-49dd-8fb0-176f17bfa50b", "value": "98304:MAdWvNRiCxlnt+nhzp7t1basjRhRUOPcF2Ny/HmyrtBYIo7MUhkszECSKGa:MnlRNxL+VtbHRhRc2eHmyrtBpyHGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619405, "uuid": "6caddc3a-a194-4b7c-b169-af85008e1e1a", "value": 4552590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619405, "uuid": "d91115d9-bc24-4d1d-815e-2ec7f7a40871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619405, "uuid": "b882216f-f519-442d-8530-9543d1bb9684", "value": "4123694b6e7634c0df9db67feaa3863d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3850d1-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620307, "uuid": "16aa426b-9f93-468f-b676-edbca405f520", "comment": "Malware payload (Heodo)", "value": "eaade1d69c7feaa9bf1aa583cd01d49f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620307, "uuid": "4bb4596e-ed54-4071-aa8c-9ae0f1bb0bb0", "comment": "Malware payload (Heodo)", "value": "5d2503d007c840465f74f91ad8b9a8ae9de02b5a88124f411996db2e40f22932", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620307, "uuid": "794fce48-1776-4771-a71c-44fb893c5a60", "comment": "Malware payload (Heodo)", "value": "71896b1fb21873a6635beb88f355a4ad93728902", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620307, "uuid": "3f2902a8-7e59-4de0-96da-a5892058276f", "comment": "Malware payload (Heodo)", "value": "31997d6635470976612440b0e4ad642de742fff5cf62b4a87db0a90bf78a89a63b4273901b16ca4212ad8590be8afbee", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620307, "uuid": "90a52bad-3548-40ac-9992-92abeb5b18f8", "value": "T1A924AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620307, "uuid": "567e701e-a192-4f6c-84c4-6a610ace2041", "value": "6144:2MyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:tyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620307, "uuid": "2e9da543-43a7-4b43-9c77-e3f5444cafff", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620307, "uuid": "2a948b5b-d322-4fac-8b8c-fcd63c1451cf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620307, "uuid": "d526b57d-88c5-4088-ac59-62f52d02b65c", "value": "Insight Medical Publishing.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036ce71c-94a2-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645618410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618410, "uuid": "f1af4344-9e9f-4996-b9ed-da16bae336ac", "comment": "Malware payload (Smoke Loader)", "value": "a8999030ecf89567824477c92449d323", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618410, "uuid": "2e772386-c23d-4412-8879-7dbf396b3d91", "comment": "Malware payload (Smoke Loader)", "value": "5d45566376f6d2724f2a799784589f52751abf462064bbfb9f5bab134ecd120c", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618410, "uuid": "51d2a036-9cbb-451b-a7c5-58f02207fbd2", "comment": "Malware payload (Smoke Loader)", "value": "40961b3f3fe534a2406bec6450f8ac091e5ea2a0", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618410, "uuid": "b15f06f8-a6ad-4ab4-9902-cda7ef6b88d2", "comment": "Malware payload (Smoke Loader)", "value": "49ec94aebd72a427acad67fe4bfd8fd368b9a97f749cf8fa4d8d9d397b68818605b6ea41ccf31126654c0a03a51591e2", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618410, "uuid": "d1f8378e-280a-41e7-98d6-e6949588b5cd", "value": "T1F6D46D55BECA6EA1EFBF47B78361DA2D1126736D03A0A6CF6603019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618410, "uuid": "387bdaaa-b6aa-4c66-a272-7fea0b0b10eb", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618410, "uuid": "e53e41f4-e214-4331-acb9-623f0b69302c", "value": "12288:I0Ws7IMsR4yVld8bzbBSreLBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqjr:I0bskX17BY4ZyrE7K3yl8PeVooA/AB2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618410, "uuid": "ec359f03-8066-4498-bd1e-a856a6375b32", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618410, "uuid": "2ce861fb-b65a-4333-89a3-325f2bc4fed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618410, "uuid": "89b00947-4ba4-439d-9b6a-c03be8aaeb03", "value": "MegaPaymentAdvice0023022022.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341a26dd-94b2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645625364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625364, "uuid": "3ff7b474-2a1a-4e71-a9fb-39422fe0333b", "comment": "Malware payload (Heodo)", "value": "6db31b853d868b9d9880bf38554dcb94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625364, "uuid": "ac721a87-d286-4409-9a81-4bdabfe22d3e", "comment": "Malware payload (Heodo)", "value": "5d4f214317c241fbe0a382d24b8de3725fc784181fcc342cbe085eba7554ada7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625364, "uuid": "ffe8aaf1-c1e1-4581-b49c-b316476b659d", "comment": "Malware payload (Heodo)", "value": "c6b3f1f9d64efac5eeb27e9f768a46e20abe10ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625364, "uuid": "894684f2-59aa-4966-b7ab-1109a7288d4d", "comment": "Malware payload (Heodo)", "value": "ca9d3a31b313e6834fff11c9617ea60bcee3625e4eb4be23a07d4af8ad8f142a050dd896bec4a7f4c290b688aeb8009f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625364, "uuid": "69f47fe1-dc6d-420c-9892-7995af6d6068", "value": "T1C535AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625364, "uuid": "f23ce4aa-d363-48b4-aea9-da5205e3a720", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625364, "uuid": "6b1b0fa7-bd3c-45a0-b3fb-c80e93d8257d", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNuTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNuT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625364, "uuid": "623a1740-8078-4051-aefe-316d965f0a1b", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625364, "uuid": "b9523655-bb3c-45e5-bf86-c5f15d069f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625364, "uuid": "9a3196fa-7341-436c-86e6-341ee33bbb43", "value": "6db31b853d868b9d9880bf38554dcb94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c213f196-94c4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645633333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633333, "uuid": "92054e47-cf5d-45b7-aa7c-bc6a2a623ec8", "comment": "Malware payload", "value": "af457b37e6034e2bc095d0d8f535ca74", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633333, "uuid": "08d8f0c6-3af3-408c-8ec0-dba15295fe40", "comment": "Malware payload", "value": "5d6df096d246a2edf171b6aad24f93727d2f903cbda8afba0038b9bd5e5d885a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633333, "uuid": "79a63d37-727a-4ef1-ae85-f2ee3ac2898b", "comment": "Malware payload", "value": "884bcfcc2294beeb9db484bf26c2c26abf92d229", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633333, "uuid": "073e6687-f662-464f-931e-a39cdff73dec", "comment": "Malware payload", "value": "14e9a157461855de07626c20eb66769ba778180d69593154dd3b4a1020a7dc0dc48e2eb6750eb5623ed2822565b3c341", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633333, "uuid": "27fd1421-0459-4533-92db-eeef2e181492", "value": "T1C7849E22A7C2D036C36730B086DBA379B6BD8A316B385AC78BD11D355F741D2963C25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633333, "uuid": "80c42986-b402-4530-8955-400e82006f47", "value": "12288:agvTeqrCeX329Soy/O+TCJJU2QyDqXkkl:tviEdX3Y7GTCRhukkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633333, "uuid": "3f9ed370-2967-487a-b811-438f82fac851", "value": 407741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633333, "uuid": "61b4aca9-cc4a-4257-bd2a-0e23fb6ff9b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633333, "uuid": "9fb23c68-54ea-4a21-8681-093419248e71", "value": "emotet_exe_e4_5d6df096d246a2edf171b6aad24f93727d2f903cbda8afba0038b9bd5e5d885a_2022-02-23__162207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c37dc2-9456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645585952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585952, "uuid": "66b30911-89f9-4ca4-857a-530677be54b9", "comment": "Malware payload", "value": "f4bd4a9421a3e021f096c282c5a674ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585952, "uuid": "663dc05f-9602-4cd0-bb5f-910c700e7e7a", "comment": "Malware payload", "value": "5d9ea158e91a3d470de350f8d43905df4ced4b45318cdb49da5a8e2908bd494e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585952, "uuid": "bc05ef0d-9f72-4752-a030-d064b5561d32", "comment": "Malware payload", "value": "13ad2b734c5041a85460d0e471b21ac46e32aa1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585952, "uuid": "49d02794-546a-4586-83f7-80751820895d", "comment": "Malware payload", "value": "551fadf52111b7c34dc1d882fb40b3cba9c5dac542892dc2e7d253b7dbc1ccaa06be7f161177073afca64025449ff302", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645585952, "uuid": "8e0edf7d-7ea6-47e9-9190-949c0aa3b28e", "value": "T17452B741B31D1957D1273FF03A3B6BD0E79FAA512299E6C4725E9A8AC071D3011C1DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645585952, "uuid": "65bf94e4-c93a-4014-8353-8c353b8da9d3", "value": "384:8Zdn1lhRufjmJTaTlgYxP1oUkxgjZmEhL:KdZEfjm4hgKaJoZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645585952, "uuid": "592c5ed3-e2de-4b44-b6fe-1216c6056183", "value": 13492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645585952, "uuid": "4668c04b-6e30-4390-bd2a-9648e764b052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645585952, "uuid": "4fe61b26-df80-4c23-b026-4ae9f5673e86", "value": "f4bd4a9421a3e021f096c282c5a674ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a9f810-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645610471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610471, "uuid": "92b4aa36-534a-4d8c-b0f1-b5b035f4a70e", "comment": "Malware payload (SnakeKeylogger)", "value": "e537eb21aee0706f7cd78a1a048c5c48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610471, "uuid": "751e028e-becc-499d-8612-9b28c93b2b60", "comment": "Malware payload (SnakeKeylogger)", "value": "5ddc93c007ac2608768488f0d249dbfe4f8d75ce19486d44ed8cc2f1f2a4e8b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610471, "uuid": "e8a77308-0f69-4009-9eed-ef9d21508ce3", "comment": "Malware payload (SnakeKeylogger)", "value": "32944bde4572cd20bb2c40f4ccf8ca67255771a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610471, "uuid": "b293c94d-4787-4339-b8af-5a5a1ebf40d3", "comment": "Malware payload (SnakeKeylogger)", "value": "e16dbaa0a5120fbe9b032b54f2460a6816dd97d50e2b6e4d94683c8ac9a63bebef88d7497f372942335a6e50662985dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610471, "uuid": "bf31258b-62de-4353-a808-e15061e74182", "value": "T1C405619831A1F1EEC8A7C875D9681CF5EE903C6AC30B910790273E99B97D857DF160B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610471, "uuid": "5ccb69af-861f-4ee4-b209-f891e3fd44f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610471, "uuid": "32d3fc88-0036-4b05-9a8b-28fcd0789ac3", "value": "12288:hIEcyJ6KcpI3FqbN4qqTdqTYU0rmxOWOenzGXftJ3rfZfbZB0QmcKT50z4OX8Djt:UyAKQcFiN4qqhq//H6j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610471, "uuid": "52d5ef9e-4552-4bfe-b054-974ecce1388b", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610471, "uuid": "61d0df1b-3052-4bb5-95b3-c110addb4b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610471, "uuid": "0ce7b518-e766-4feb-b8c5-b1b4104d4227", "value": "Img.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f73569-94f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645655557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "a94ef266-3e76-43ea-8abd-0f09cc8d17cd", "comment": "Malware payload (Heodo)", "value": "64e4cf269a5697c65bf32ac0ea6cb09c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "b3485208-06bf-4f01-a1ed-685695174eae", "comment": "Malware payload (Heodo)", "value": "5e5b19b96c22d7700ed79ef0f6290b7e3c85c62fcac8745a0f05eb34fb8a9c35", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "f6861e4f-b567-44c3-bebc-d6e40bf83b8d", "comment": "Malware payload (Heodo)", "value": "d47be88bda9aeb0234c87a0e454358d44232cdff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "674610d6-8b0a-4f90-8246-ec7c39b3e2c2", "comment": "Malware payload (Heodo)", "value": "7025bc7a4b1129bbd5cb66ab11d5d2af87efad43e247ae25a134c19064d7b209168008c7610445bbe6efe59c2c762405", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "7100e2d5-677a-4fb2-837c-1c5f3bc1c93e", "value": "T16FE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "900e0d07-cb6f-4711-a94b-a2942a4d9485", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "df95ddc4-f427-4bbf-8b6e-67204fcbe575", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XK3e/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXK3LzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645655557, "uuid": "d5931521-30db-43c9-a169-72e202417d88", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645655557, "uuid": "342cb5ed-f686-4e94-a160-633e8bc2dc47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "a1ae38ca-30d4-4527-80b1-cbc76b94f7ed", "value": "emotet_exe_e4_5e5b19b96c22d7700ed79ef0f6290b7e3c85c62fcac8745a0f05eb34fb8a9c35_2022-02-23__223232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688cae91-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645620298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620298, "uuid": "80037f44-2212-41d1-be4a-929cc5a03175", "comment": "Malware payload (SilentBuilder)", "value": "ad1a2a36238661f1c160a1eaa6969d11", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620298, "uuid": "4f12b482-4542-4fec-9eec-24ce8bd7d57c", "comment": "Malware payload (SilentBuilder)", "value": "5ee8521e0b80707c2c598d83e936b2f4b2cc494c0fcc6ede2ee42f1b6433647f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620298, "uuid": "1dcb3685-763a-4c4c-aeaf-5111cbace566", "comment": "Malware payload (SilentBuilder)", "value": "bdffc36daa20847aa6e60cffaa46526eaacfa0ce", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620298, "uuid": "7566ea17-09f3-456b-92eb-172b8f6b1515", "comment": "Malware payload (SilentBuilder)", "value": "6e6e57a6a24dcee34551a36c4456db10b06404c7f6499b6108f0b339e39f561c0ebbd5649e8879248542e2cb5407943d", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620298, "uuid": "f75999a8-1967-4138-8240-5361cefaaf56", "value": "T14F34C04AB84A5C35FD45C3BC89C387CD84E5AD3A6B5B815E4D28332396B3EF425025EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620298, "uuid": "bc038d3c-2c5b-446a-8fa8-b923118f4677", "value": "6144:DKpbdrHYrMue8q7QPX+5xtFEdi8/dg/ThvsiKIjvl5fd1Xh8rsoX/w/0Y:ghEXs5fXR8rsNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620298, "uuid": "b76c9ac2-d2a9-4507-9832-c9f855d47caa", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620298, "uuid": "ac93ddc3-6cfc-40d0-a3d6-3d3707d97efc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620298, "uuid": "402e0185-1753-4d96-b3db-84cae2771576", "value": "DOC-7.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17431ad1-94d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645642066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642066, "uuid": "ff90c71c-cc26-4eeb-8748-6d83bd11628e", "comment": "Malware payload (Heodo)", "value": "24e438b8c575798b8c3b27fbfe7ce863", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642066, "uuid": "62861ca2-17b2-4baa-b43e-61d2c9bb8470", "comment": "Malware payload (Heodo)", "value": "5f16d6c496530fe5c954d7a5209b1753f10e44f59fa988af1bfe3727924dfc21", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642066, "uuid": "148188c0-d4df-413f-8ea5-d28c59ac2a69", "comment": "Malware payload (Heodo)", "value": "4af36efaed2b102d89e3a6ff5f0c63825ce59ffe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642066, "uuid": "769092b2-3f5a-4738-aea9-68e94572562b", "comment": "Malware payload (Heodo)", "value": "2ad492062a40b5599ba15ab57092c63737e86448e6a16bf206fe308de58b6e329ed337b712aab2fab82f7186ef8a404e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642066, "uuid": "fabbe619-6432-42af-86c0-f100dca2b8e3", "value": "T11593022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642066, "uuid": "3a1c70ea-84bb-4a0a-a8d6-1d894c7c43f4", "value": "1536:jQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:KDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645642066, "uuid": "15ad58a9-3a57-42c4-addc-d75c31266fa6", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645642066, "uuid": "45cbecba-d3d2-47b4-b70c-be0d80c942ae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642066, "uuid": "0583054f-532f-4965-92d0-605a26f12b4a", "value": "Opast Publishing Group.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a382e0f8-9491-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645611377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611377, "uuid": "d2e7e141-ac57-4a6b-b97a-34e5a213ea47", "comment": "Malware payload", "value": "222d6fc84eaa79de7dfdce5ad59bbd7d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611377, "uuid": "f63fe3eb-40f9-4ad9-b2aa-b0a58cc5287d", "comment": "Malware payload", "value": "60e44e20f771c3f017352c966f4bd5f165c11faa178db46c81636d30ab0cd851", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611377, "uuid": "fcf3e97e-cd0a-48a8-8fbe-4eeebc40be6f", "comment": "Malware payload", "value": "36dca412331b19cfacc6942bc184495e52d8b3e2", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611377, "uuid": "c6a7dd6b-cec7-4e7f-a093-73a108ac429a", "comment": "Malware payload", "value": "7b8877a9d9c194b7e4e64b7f5e01d4da08144a21b8acf3262f67ebdab572794bbfa9ba305e24854806e2d9373a138db4", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611377, "uuid": "a066314c-d103-429c-a0e4-1e3404f95bb7", "value": "T1DD23BEB76D42BD64FE83FA79A83AA32001276CD77947904B6289B3CE79705C44C50F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611377, "uuid": "ecb3ecf9-68d7-426f-a908-d36b763b2b6c", "value": "768:V8m78JXbwB97SnvqJgMTiq+In57etOADVj1SXb2vuxHunSTnxRBwggu:VB8JLm7SnAn157efVxvkuHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611377, "uuid": "a58ba382-fc91-4455-895f-66793d44856d", "value": 49592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611377, "uuid": "3d8eb154-1870-4908-8f91-8bb13cd4284a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611377, "uuid": "30dd373c-f409-4b64-b1e7-3841e973a95d", "value": "February RFQ-DBX 2201 ASIA-SUPP - Q1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52f07c9-94b8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645628238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628238, "uuid": "63dd068c-c1bd-4189-9be8-d219fe05a9ca", "comment": "Malware payload (Loki)", "value": "e90858d89312dc9f2918bbc984c4f7f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628238, "uuid": "428e0d3d-d624-4345-9a91-b8c0aad8ea76", "comment": "Malware payload (Loki)", "value": "6159a0d91e56dfba699607d949a35a61c18fb4c760d38fae0cd60ee4d7e01a22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628238, "uuid": "b5b67ba6-6cc7-4b10-b7bb-5543163ffea5", "comment": "Malware payload (Loki)", "value": "7ea567cdd1ee33c8edbafecdc077cc0da559c93c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628238, "uuid": "10516ee0-f325-4fb1-add7-702c33608878", "comment": "Malware payload (Loki)", "value": "5f7cf321288deb6f9c8e1300149c5bae62233172cde5f1d1ee092686ff9f913fab8632a3d2b3a9d3b2cb2015dc2383a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628238, "uuid": "9929cfe5-bb21-4676-bb2c-14f29a7501bd", "value": "T16F758139F968C439FCEF51798B68982DD94CBC61AB0C85D3D1886C974928EE43D72CE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628238, "uuid": "6c1f1fde-79b5-4718-a41f-ce9ca66d3184", "value": "bd884a77f8dfa18c733514a2ced054ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628238, "uuid": "7299ec9d-9ab0-4388-9be2-8a13c973c3ae", "value": "24576:ve7Yh4swXODh91aMtDFkG87WRaIJ8XL3IjW1tXrGbLYX9pNBO:Wch4muGDBYyvU9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628238, "uuid": "04e6422d-bc6d-446b-a43e-ef6033e7241b", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628238, "uuid": "7a07e0d1-5035-41cb-8595-31ef483b6e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628238, "uuid": "0e9b7760-207a-4424-a595-30e49159642f", "value": "6159A0D91E56DFBA699607D949A35A61C18FB4C760D38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cf1099-949c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645615837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615837, "uuid": "b216447d-beb3-44b9-8313-1c47f7868975", "comment": "Malware payload (Loki)", "value": "49d50e6d9f2622f1ff083cc5d62c8663", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615837, "uuid": "f7746677-a622-443c-bd3d-3dd0a3378ca6", "comment": "Malware payload (Loki)", "value": "629cab6f60e0d2f625c3a8c8784407f43f834bce86c1c27ae443e6aed7ec3062", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615837, "uuid": "89ab1b5d-2459-46ab-874a-c0222366a943", "comment": "Malware payload (Loki)", "value": "a0fe5bfd7009b25143bc755fb6cd5f705ef37e5f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615837, "uuid": "b8554cc1-0922-4c8a-93fa-1b05cc248a53", "comment": "Malware payload (Loki)", "value": "b661af4637c37572de393efd988f51eebe02b383b811e7902de830986b4ff6255630ba8007c5590116bac9b49a86165a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615837, "uuid": "786d0fad-3418-43ea-8a8b-135f7d6e42c6", "value": "T186140148F19C18C6D07A8E72E36B4F91F217FF6A79E48727A0F672C485BADC78814845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615837, "uuid": "96858fca-ac12-4a2e-8fd9-144e785e468b", "value": "3072:wOjMbAQc23o+SpeVvuMKIpJWU9M068x1VoVPAnZSy1NlJumjxXAJAVX8fJs8e:vMbAQcao+SpeNu1Ih9M78TmV4ZTJJtvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615837, "uuid": "0ecd9aa1-7299-4522-b9fd-bf905353bb93", "value": 191656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615837, "uuid": "9d735a1a-27bf-404d-bc43-6aa6ee9d3884", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615837, "uuid": "e5d096a5-f4eb-41dc-a30b-bd4c544670b7", "value": "PO466.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fdfb16-949b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645615780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615780, "uuid": "f9f25f8a-2b80-457c-ba5e-98a4a4e722cb", "comment": "Malware payload (AgentTesla)", "value": "03bd6efd777995f64d40797e26d413a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615780, "uuid": "1ede3b92-5456-48ac-ba6c-f8942b3ddc33", "comment": "Malware payload (AgentTesla)", "value": "6327cfe77f10e8206f0a47f6c72a4b86323b2d7a0cd045c46ba05c8512ea8659", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615780, "uuid": "922b2059-0988-49e1-b1d0-a0789086ebf4", "comment": "Malware payload (AgentTesla)", "value": "7b0183db0ebdf04c791e976f0ec3765eaf9dfb13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615780, "uuid": "5b726dc9-b9c4-4fa7-bf0c-2dbeed0c2a7e", "comment": "Malware payload (AgentTesla)", "value": "d995fa113c4ca321bcdfc9c7230e6eb76cf9b3c8e60da93cb54a775d507dc328f57f48c3b9c4e9f9e7653903438dde5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615780, "uuid": "2c34c50f-bb3f-4d81-aab3-914d360844d4", "value": "T13A141268B5043218F42A81B7EC126684ED91FC29F39B570E7F75B30DCD3DC1A9994AA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615780, "uuid": "cb9124ed-32cb-49eb-9fe2-b7e023da5d8d", "value": "3072:uK4voqXet+NzsDFjqbsDENCR4Tq19yIfkMU9uw7ZFuQzsDAQcB1fS/5ypCZKthVy:D4vFGdN4Tq19ffkRdcAHBBS/5yp7Y4UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615780, "uuid": "b7a4e719-e315-4e3d-891b-f27fb767f8cd", "value": 191032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615780, "uuid": "c3bce144-401d-4094-90a9-a7c5a3e23ab1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615780, "uuid": "2659a6d8-cca1-4fd2-a088-53183bae897a", "value": "SN100C Solder Bar (Ecorel Bar.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6947dea0-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620299, "uuid": "ac299c58-4dfb-4ada-ad8d-930e802d78c5", "comment": "Malware payload (Heodo)", "value": "a7df0d44179495dd62a6e7a70fe05dae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620299, "uuid": "5e769ea1-22d9-474c-b6ab-ae536ffa5ac6", "comment": "Malware payload (Heodo)", "value": "6389cfe79ad02a53a756d532e55d665ef7e344af93fce5638461a546341deec0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620299, "uuid": "4a346fcf-547f-483f-9ad6-a70c2150c818", "comment": "Malware payload (Heodo)", "value": "b5d12dac0bf2a88891fdb5f1e5d62fda9942b53b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620299, "uuid": "bc3d0fe1-a07a-4dd1-9b23-264b080e727e", "comment": "Malware payload (Heodo)", "value": "a1952d0a3b9b9a42e34bec3e73f1ff31e5601e4542010dd0e5a8e5a9a307ae48b1fbb29b3a8c06a94f22eb078dc32676", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620299, "uuid": "9b8d12b1-44bf-47c7-90aa-c8dc809f745b", "value": "T14253184ABA4A991DE51587358CE747E96732FC104FAB0B873A49F3257FF99D04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620299, "uuid": "4993eff1-580b-4ee8-b492-4ccf6dd86bf9", "value": "1536:sp+KpbdrHYrMue8q7QPX+5xtekEdi8/dgJ5+4kKF3XOCmGanK8oWIG:sIKpbdrHYrMue8q7QPX+5xtekEdi8/dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620299, "uuid": "da61fc37-3714-4a0d-b059-bbe8df68da49", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620299, "uuid": "0b7a706d-0a46-44ae-87b4-6a7c7ed21c97", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620299, "uuid": "b5c52c70-07f6-417f-8bda-9fb90eef6bf6", "value": "Documents 7.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2a01be-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645620309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620309, "uuid": "a989185c-89c3-4ef0-b1ad-c004bacf8f7c", "comment": "Malware payload", "value": "7c754436428e55a562a264840f7fc7a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620309, "uuid": "9de46a6e-1195-45d0-b30d-5e59fd527302", "comment": "Malware payload", "value": "641726e045898d15c39c11559c01e297aff22924a4cd3543e0ce2e3cdc3c2277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620309, "uuid": "d0e11446-52ea-40ef-b019-b0836b644d5f", "comment": "Malware payload", "value": "3a907c34ade6be35c7bc50544e7bea7c69b1b584", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620309, "uuid": "a2a0d3ec-334d-441a-bb31-c3b659f98a43", "comment": "Malware payload", "value": "ce23b4d59379042ec2efaa5bcf80a598f266916a6a4de4cbdd40283c70bc1701ec0c372309194a1c92d5ef56cc52d74e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620309, "uuid": "2a421340-da10-43b7-81f2-d09ef6f07933", "value": "T18EE49D12F0E2D432D15719389D0B6268982ABEF07E2CE48A4FE53F447F356497A1EE53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620309, "uuid": "e648d809-4876-4546-af8e-e1d6a7c6ece0", "value": "9a208a82f2ac1ed3524405196188a65f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620309, "uuid": "7e0b947d-77e2-450b-97a5-6b69d314e2c9", "value": "12288:wqPCYSx1alrmI6WvcmOEgJCegF63A5WLS2x3pxjsf:wqaVIiI6WvcykBzw5WLd3/j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620309, "uuid": "2f418987-c61d-4e9d-bfad-3a18f5db9941", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620309, "uuid": "6093d9a8-344a-4569-8e8c-f263289c05e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620309, "uuid": "3e55eb0c-da9d-44dc-a345-64189da8bbb0", "value": "Lista narudzbi u prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecabdb0-94da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645642722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642722, "uuid": "59869d29-a2f6-4cad-9a61-92e7be386601", "comment": "Malware payload (Heodo)", "value": "e338685beab9465053a61ef032bb0db3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642722, "uuid": "9cc64f44-3660-49d2-add1-a500480fbbc5", "comment": "Malware payload (Heodo)", "value": "64ac3921657f169bb608059d17d7d736599a4ec7d65726bfbcd35e52d5fa3943", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642722, "uuid": "ef22fedc-abc8-4a35-b0d4-663778e27f9e", "comment": "Malware payload (Heodo)", "value": "ffdeae7ef5fb0a3768de11240e52b5c07ccd0a7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642722, "uuid": "aaa899af-aefe-46a9-8d59-bd862ebbb167", "comment": "Malware payload (Heodo)", "value": "05ebd39a0a7d2b29b145bf3829bc0f75a5cf965d0cadaf2f8401612be188a98cacacdfb248591be8454534ea198f661a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642722, "uuid": "93fd1cd6-afe3-46ee-a4ef-3d95561cbdef", "value": "T16D35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642722, "uuid": "364e0ed1-c2ed-4180-bdd5-82a66e9bc706", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642722, "uuid": "37cecdf5-29cc-4a15-886c-1b1716566f1a", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/lTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/lTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645642722, "uuid": "b393ab6f-2e9c-4fcd-bd84-e8e1378813da", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645642722, "uuid": "57aab648-e2a3-4c71-87d6-f3b898fc3339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642722, "uuid": "bcdebc8c-da18-4590-b60c-c677341643ab", "value": "e338685beab9465053a61ef032bb0db3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16793e59-94d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645642064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642064, "uuid": "e731ff41-39d2-46d2-b398-17fa0690a3a6", "comment": "Malware payload (Heodo)", "value": "4506a3c88d1cffc9551246d676637693", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642064, "uuid": "a08e5619-3488-47da-8ffd-643fb75f7dba", "comment": "Malware payload (Heodo)", "value": "64dc715904e12e88ac10e63b710f1039754c594b572c8f9c09b2d29c663449eb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642064, "uuid": "0e62448a-4909-4e3a-89ce-4e638d403de8", "comment": "Malware payload (Heodo)", "value": "7932a2a1829c53f31cd6ad3f0290f2a27e5ffcd8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642064, "uuid": "4b3b409d-bad5-4ce3-a454-984bf84a0266", "comment": "Malware payload (Heodo)", "value": "57a40d5402a9961aaab7850eabf22d5564dbcc0702ac07dd638fb6f5f47ab3933a0f885543397d1cd06f2467a5944269", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642064, "uuid": "7bbe362b-bef1-46d3-a73f-1b44ad7e60c6", "value": "T18893022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642064, "uuid": "6667cf81-5e6b-4987-b19d-fa419d4b791a", "value": "1536:fQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:2DpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645642064, "uuid": "069e4a1f-dd8e-4c8a-a0f4-6496bc479c46", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645642064, "uuid": "d55697c0-d016-4de6-a424-bf73925edcd0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642064, "uuid": "91463612-6639-4b7c-a08e-fde787b20bdd", "value": "opastonline.com.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9341cba6-9479-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645601042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601042, "uuid": "26049d3d-835b-49d1-8994-0f379cb849df", "comment": "Malware payload (SnakeKeylogger)", "value": "0761eae66dbaaf104e2b761c05f27f79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601042, "uuid": "1039fdf4-6ded-4baf-a306-4141f829e18f", "comment": "Malware payload (SnakeKeylogger)", "value": "6518677d813b1d0a1fe0c45f72f9aa1649c315060cfd98ba28491926b0972ec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601042, "uuid": "d8917f2e-2332-4abe-88b7-9e2d2fda54ef", "comment": "Malware payload (SnakeKeylogger)", "value": "f5e594eff7fd1c36c3b8fc0c1aa916dac2231f42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601042, "uuid": "7e0238cc-3fb3-4c0a-91b5-f5e71c40f21e", "comment": "Malware payload (SnakeKeylogger)", "value": "e7d006a106ebeead37add68ef644e36e6e52d1a2dfc0809faf37e83d03c460a42dbedda373bc6cf0b46981daec096431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601042, "uuid": "03b7db5b-a0cf-4c70-a270-b3643865b224", "value": "T105C49E8AD4405C62F8334BB82031D9B973A76DD55DF46D9A2AD43E633AF3093683681F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601042, "uuid": "8e9b18ae-e8bd-4e7e-b22d-043bd8dffa9a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601042, "uuid": "55876120-3c24-4c3f-9f1b-2d92e0fde51d", "value": "12288:8t9VjWFH1ZS6+cTpdvHDDkE0gX4il4k+P:83VjWFOCjkEIil98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601042, "uuid": "517a3dcc-50f2-4a41-b3ab-9ff6a1f1e055", "value": 546787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601042, "uuid": "01430029-c396-44d9-81fb-86343e3a7398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601042, "uuid": "2b8a73b7-7be1-4e6d-aa7e-4f8f8f52e58c", "value": "Payment request for SOA per JAN 31, 2022.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c29338b-94af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645624142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624142, "uuid": "efa1bf54-584f-4339-bb8a-1fb32de2cfa3", "comment": "Malware payload", "value": "af5e6b9f6a6b8cd7361c3af36680e6cc", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624142, "uuid": "f4d54070-edc4-4875-a64c-fc1be20ecf84", "comment": "Malware payload", "value": "66211838f60e4f05a2cb4fb2ae2e7fbf472fd4fac1f82ac6c4f66656a365c701", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624142, "uuid": "e9334fd9-4419-46dc-878b-0d1d24c25bcc", "comment": "Malware payload", "value": "d16ce2604eaf265d22af2dab6a634c17157946f1", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624142, "uuid": "4cab2fb0-1076-4285-b2b7-87cb7db3d250", "comment": "Malware payload", "value": "038d85544fae997f02d05d47a1864a703c31b800e67b662e5526b40ea6644326752350e47deeacf69a325091a9e31e46", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624142, "uuid": "23394b01-4d9d-40bf-a220-077b92b70a29", "value": "T106B533A0B990D20CE93BA6B84043C9833779975CF254D71EB2CB6B5CF741A44D98BE36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624142, "uuid": "02674078-905e-431f-9b9d-407cc7cb2221", "value": "49152:WaTZynibb8nAjf5Tx7VUw27n6byi/B784Ba86kI5VRploS74WStsUWEjZ:WFi2sR1Kw2DGPBa86kI5Vjj7oeEjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624142, "uuid": "3dbd6735-9dc3-4a78-a3ad-28c7b2b775ee", "value": 2464192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624142, "uuid": "80d2e16e-01f6-4eb3-9225-a54ac03d5f25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624142, "uuid": "adbf5e68-1dce-48f0-a9c2-c468a467a8fa", "value": "66211838f60e4f05a2cb4fb2ae2e7fbf472fd4fac1f82ac6c4f66656a365c701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdf7501-94b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645625840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625840, "uuid": "0e67a943-32b3-4653-9d16-9eb4351af0dd", "comment": "Malware payload (Heodo)", "value": "8ebddc69c10332ae50507cc3c543ed6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625840, "uuid": "e3636875-4b53-45e7-81e6-746b646bedf1", "comment": "Malware payload (Heodo)", "value": "66b28d373cf56e0dad127707d5338db2bc507c0a07e59c2281d63420dd43e3f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625840, "uuid": "3644fd1d-ceab-47ae-9a63-801dfa858028", "comment": "Malware payload (Heodo)", "value": "33b830f594a434643d89e1a84fb25b3a885b958b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625840, "uuid": "7d8d99bb-d2a8-4d32-a5c5-9dcfabfb56e9", "comment": "Malware payload (Heodo)", "value": "9c53f3a50d1c2b40d7e7fb35e91918593f301952fbd61c580b8b41549f2135944db6b2565d85cd9e46e15cbc6e728d4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625840, "uuid": "bd953509-25ab-4366-a86c-20ff5c3ce5fb", "value": "T1BB35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625840, "uuid": "5535a25a-55fc-4e21-8955-f2c607aa495d", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625840, "uuid": "4e53244e-cb85-49c5-a4cc-733cc0070c08", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/mTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/mTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625840, "uuid": "def84d29-4ef1-4bb9-9ec6-0ecb40fa1ce2", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625840, "uuid": "6610fe88-87b6-4296-af5b-d0504205e4c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625840, "uuid": "83d5fa3c-fb28-44bc-967b-e181300a04a0", "value": "8ebddc69c10332ae50507cc3c543ed6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1af7a8e-943f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1645576155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645576155, "uuid": "9171efcf-1b2f-4b84-8ee3-953889b61998", "comment": "Malware payload (Quakbot)", "value": "3fe1ba2e012a387d454da8fd38b470ee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645576155, "uuid": "97763dc0-c0bb-48e7-9dec-b60c4e8f2e58", "comment": "Malware payload (Quakbot)", "value": "67486db1b558b02235a0a8edaa7183ab707c3c8d12ec87231cd12445856e2398", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645576155, "uuid": "bf0400bb-9215-433f-845d-3a70aeba7a81", "comment": "Malware payload (Quakbot)", "value": "5ce7d68717141a0e3445ae12d60e7df390606caf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645576155, "uuid": "d0bac66e-0f7a-4db3-ad2f-52f906e2b29d", "comment": "Malware payload (Quakbot)", "value": "5c73590dc63138d26f5b7b2366f7045fbd47b4f531799fafd5865a13438e69ccafa6b5d29ee7b06bdf78fdcf7956e1ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645576155, "uuid": "70d8dcb1-aa10-4e04-9b3d-f471005d7019", "value": "T1BBF43BA28EA5780DEC75137857B392C4A50B9F732A35C1FF10C374968638314697FEAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645576155, "uuid": "fcdb09b3-e1da-4642-8625-0e363278db51", "value": "a2c4c1cc45cf157e67048505a3f85c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645576155, "uuid": "8b2b6b22-369a-4d1d-a1d5-b2125e81407c", "value": "12288:SWV6nCx78UjtpeoRiYnMYbOZlfn40nBrttUzWHe42KfgT/2zIMg7+YAGnZUwQj:z6nCx78UZViDQOTfjnB5tUzmn2/bsMz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645576155, "uuid": "5ea40731-c77d-453c-a68c-9417e5aac1cd", "value": 724968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645576155, "uuid": "6fc92052-bafc-45b2-a28e-0c3f46495339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645576155, "uuid": "21f8b39a-6aab-4967-bc3f-fd3be77d4fbf", "value": "el1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd5094a-9472-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645597890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597890, "uuid": "47e32a17-064d-4b07-bae5-2ae598355f2d", "comment": "Malware payload (Loki)", "value": "59cbde13c9285fdb0ac3cb85b0e8add2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597890, "uuid": "ae7a01f8-158e-4b44-bc8f-c64c4f22c5ee", "comment": "Malware payload (Loki)", "value": "68d5e9dbf70448b280c8697a5fd76e2eb32f8c007aca38ecee5545ccb7161fe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597890, "uuid": "f5377a6d-136c-49c1-8a3a-70c58cb27b9d", "comment": "Malware payload (Loki)", "value": "57bb08110020607573c23808711ca31f5a0de940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597890, "uuid": "8ac41632-e24d-469f-b81e-9b8ccf3a9bba", "comment": "Malware payload (Loki)", "value": "3e1603037e30b89567a031807df557ea522205ff027b2ff3ad4b27f27bec60b883211b9bf1410d16a9a5ad6aafa17ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597890, "uuid": "0c548e2d-1e7f-442e-826f-43e3e275a87c", "value": "T1A4F4BF4839A71F3DF1B58FB219C0ECB4BA59FA331C08B3BD78516686C6A1B509842777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597890, "uuid": "70baeb87-8715-4cc8-b99c-91805acb5c3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597890, "uuid": "eb75f601-b642-4162-90df-097005a64a58", "value": "12288:MWmSIQsWkdh7jFK777777777777GEXXYkrycPTdDC+s6zC0lxATjbsynANrF7UmR:cK777777777777GsYk3rdDC+7XlbUANF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645597890, "uuid": "7fa0a10e-9214-4f11-bd56-cdea2a824e14", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645597890, "uuid": "830ceb68-11b9-4244-8ccf-d4f7753ecfb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597890, "uuid": "f9c10c3a-2696-4689-9a6c-9183362c1375", "value": "6yUO2GccJjuSKit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554a2210-94b4-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1645626278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626278, "uuid": "d25b65cd-eecd-47bf-b325-028c0f25a798", "comment": "Malware payload (RaccoonStealer)", "value": "7f1036d724c24fd77c0d586e26bb3537", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626278, "uuid": "41d5beed-133d-424c-8731-a7d577a5e9a2", "comment": "Malware payload (RaccoonStealer)", "value": "697d84b625c9e32e70b0f9ff9dbaa5edc59505db6d62ae12df10e2264ef7e995", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626278, "uuid": "4734b9e1-625d-4e05-824b-35701487b7fe", "comment": "Malware payload (RaccoonStealer)", "value": "2b6b4c3c0f776b1ffd91e3219c8d021bb87729e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626278, "uuid": "5de2caf6-8b51-460f-987c-fa5311e8e471", "comment": "Malware payload (RaccoonStealer)", "value": "e2d9051df3bacff3bdc75e03a767fbe2e3184043204bd5ccbd274e2c8f0464b53d6eb8defe0b3e6d4feffebd712efc3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626278, "uuid": "9bbfaf07-169c-4eba-abc3-b5acc85cb936", "value": "T136C4E000ABA0C034E0BB12F949BA937DB62F3EB16B2565CB52D456EE17396E4DC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626278, "uuid": "3b9198fe-983d-4af8-adab-b5e0391a44ab", "value": "791d76659e45e8da008e73b27d00ce69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626278, "uuid": "b0b980d2-aabc-4f7d-9f4a-af01f2277a90", "value": "12288:9msIgz4D3YcJMp7leMhYLjbfjkAGk0bsy:rs3YcCNlVYLPf9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626278, "uuid": "fec18e5b-1a5c-4141-8dba-03f1d587cdeb", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626278, "uuid": "b8e25a59-2b5f-466d-ab35-f0142cfd504a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626278, "uuid": "6187d588-7914-45ba-9c07-d7c91a1f78d4", "value": "7f1036d724c24fd77c0d586e26bb3537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6060ecd-948b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645608912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608912, "uuid": "6992f835-de42-4857-9857-0cdbc088ed39", "comment": "Malware payload (Formbook)", "value": "3442bc360be6b75a8524fbc60c0f6fb7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608912, "uuid": "3b9c528e-f91a-4e67-9449-5741cfc0fc3c", "comment": "Malware payload (Formbook)", "value": "6a612c364e02c35bcf1ebd4c04d6b4f5a9d39bc6a52fe40ae423fdcac667646b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608912, "uuid": "dc75f9fc-980b-4349-8a18-2075b9e7ed55", "comment": "Malware payload (Formbook)", "value": "907df1e927821ed889a04bd33f8373b2e251a2f3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608912, "uuid": "52dd07c9-9cc6-42d9-831c-95bf2d0742ef", "comment": "Malware payload (Formbook)", "value": "1ee3b20b7bd34c133d724a303a8437e54fca7fe552465e76ad8a4587442fd424299f2bb5a94236759ed0440c4f97a42a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645608912, "uuid": "2c5362de-0d30-4625-a743-6b74ee36df65", "value": "T1BAF4335505E7EA660E7409F354E9859F74087BBEE57091ECFA2D828E71090BE93CB34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645608912, "uuid": "c1a6ab93-62df-43d1-9fab-3cdbad76d586", "value": "12288:0GTJCykUr8cfPyy4DKvocVa+UbCOohqRUljDQ5Obf3AG8XETBFe:0GlClU7fKzDKQ2a+vFkObf3AKFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645608912, "uuid": "67d84e26-91ce-4da3-8baf-faa3954195a2", "value": 758974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645608912, "uuid": "bfda14a3-e9d9-46aa-bf9e-eb49b9ff8a8e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645608912, "uuid": "d5b62bf5-5d88-4896-ba19-e8e3b8e83fe4", "value": "Ostutellimus 176.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a627b61-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619388, "uuid": "fa65b960-ccc3-4495-b373-02b18abca4cf", "comment": "Malware payload", "value": "36d91178a6144792556b908e167c7a5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619388, "uuid": "8189b649-cb09-46f4-b15b-63249b000885", "comment": "Malware payload", "value": "6a92554ce4828b16c21979cab799afb814f19a139f2242644c17b541b8448f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619388, "uuid": "974f6d6a-ce5e-4d41-8159-1a48c3187534", "comment": "Malware payload", "value": "db4eaab9c894d75fa5d8b6ed46bb113f12c38f31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619388, "uuid": "d64cbefb-314f-4973-8692-76c68579744b", "comment": "Malware payload", "value": "8b7342fe2af530fc2f64adc243401127ef4dcd82aa5d82d3de9516f3b53aca9e08ef3879d6b0ff42126cb48e549d62a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619388, "uuid": "fb9df0bb-4376-4cc4-bab7-c53d7a7a4476", "value": "T1A0E4AE2F497F223A85BCD79199C4CE2FF8A2C5A63537991C29C616D906167F330D222F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619388, "uuid": "506386aa-2202-4d61-b82f-afcba9cfd006", "value": "12288:opjbBBwbaJt3LcrOwlhAtOZHdUMoTmt0sKH2Fmf4akNJKW8s/q/K3A:oVByWQHlhAQZC7qtblmzk+uaK3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619388, "uuid": "c1b716d5-44be-4dff-b9ca-2882b0ff2e1c", "value": 675886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619388, "uuid": "d447b464-6701-4aa1-affc-81ad9ff96c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619388, "uuid": "bf9660d3-acb8-4610-aee0-4afe60a58204", "value": "36d91178a6144792556b908e167c7a5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c4bfde-949e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645616688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616688, "uuid": "8cb5c611-e473-488d-a660-4998596f7102", "comment": "Malware payload", "value": "8dd74bd2bdbd99b2d1274ab6d6a05010", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616688, "uuid": "eaceae22-0cd6-48ed-8538-51adc3c7c201", "comment": "Malware payload", "value": "6a9a7402b38b8fc57bd278f5785b4325afd9747a0ef02301743c650893395cbf", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616688, "uuid": "9ca08478-aef6-4526-9901-4cdb55604487", "comment": "Malware payload", "value": "5152c6c4189b4f169ea1ff1e54b294738a2d8676", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616688, "uuid": "d5ee265f-4d50-47ed-aa4a-9eed739020b3", "comment": "Malware payload", "value": "95cace5bf42be1dd8bc4fcfd2cbf0831cc79a3ac5de9d57448e1b6853feb3ea0dd64a10692165fd959e2d86aa2736f23", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616688, "uuid": "746f22ef-6f41-4d53-80b0-74f34f8a6ca5", "value": "T14C23D018C5026516C6B3283DD43898F25CA78C17A522858FD2DE7E0B0AB4EDB2F5FBD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616688, "uuid": "3bcd4137-5a49-4f2d-900a-e424bf1aa960", "value": "768:TNRD4S0JS00SneSnjS0yS03S0IMS0bS02SCt+4i1IXtO3FYZsjrAjuhITTet+kW0:nS+oC2uh+WZuVAr2Re1/K8NytsR5eM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616688, "uuid": "aaac7d70-f196-49f5-a636-2308a0272935", "value": 47886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616688, "uuid": "5538913d-9543-4106-8dad-72684de0287b", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616688, "uuid": "395420e2-229a-4c4d-8796-221a2feee5bb", "value": "RFQ List 2.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2517c76-949a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645615348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615348, "uuid": "3d470261-0b30-44f4-ae6a-1ef1a20363dc", "comment": "Malware payload (Formbook)", "value": "f45f33757bd5be411ca08207163924c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615348, "uuid": "cd57c363-fab2-4605-9723-b7bf2e0f4f2d", "comment": "Malware payload (Formbook)", "value": "6aff93a5323c418fe130ad5682f6ac9fc4c93c7b18936ddfd8894f6e7244ac23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615348, "uuid": "1a9faae5-06c1-4117-bf87-cb07258fef2d", "comment": "Malware payload (Formbook)", "value": "ebe4fcdd4dceb6f4cccaa0d3632a0867d5b472fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615348, "uuid": "7a29175c-2234-47fa-b625-2c094160fbbd", "comment": "Malware payload (Formbook)", "value": "4111f4a78bfd112fc27be0d388724b3e9e427eb19af5c5bc1921fd2e605bb0881c90dec8577be376cf299b7ae7553c52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615348, "uuid": "4704113c-ca3c-415f-904b-4988bc4295b8", "value": "T149B4CE93600505E7EAAB39F2F43FCC211556BD4F97A8724A2BA23E1E45F33620057E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615348, "uuid": "7cc47e6c-b540-4c24-be19-86f461736b6a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615348, "uuid": "7cb80973-feac-4098-8c0a-ec6ba4e13e72", "value": "12288:EiDh5Azzsd6+LT8P96Tpcv0wuvglfHkpYm3h:fDMzcYP9UpzqtnAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615348, "uuid": "e6289703-0a81-4f04-9611-3951d12cdaa4", "value": 499720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615348, "uuid": "e65b14e4-ff2a-4702-87c7-186808d43209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615348, "uuid": "b90e7e3f-c4a6-4c53-b0d8-cda0cce26770", "value": "SALARY RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f84991e-9469-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645594191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594191, "uuid": "b322d567-a74e-4bb9-8373-1ddfae6239af", "comment": "Malware payload", "value": "9e3c19ba8cbe6ae22b680948a1e7adf1", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594191, "uuid": "2708318c-b8ad-4b2c-9ae9-bd16537ce184", "comment": "Malware payload", "value": "6b987bd256bda7663930e6bb8379f6500d8f8bef50c3870d037586c3825bd526", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594191, "uuid": "c572f9e9-4002-4d2c-b910-7bf0b51b401a", "comment": "Malware payload", "value": "54be9278687cef502dae7476c413da91402f56e3", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594191, "uuid": "02054d39-7e84-49ec-a19d-2c3324a70a08", "comment": "Malware payload", "value": "a15a4f9acb320230e3aadcac110ebebcdb3d9178377950941fc1cf2f9cc5fec23694711647884b1540c2e34ac6beb303", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594191, "uuid": "b5514d2a-912f-4151-a1da-4e9b600f2653", "value": "T12B81F769034FD9FDB623A8C481D55A43EFAA8236062CE6C0DF607EFA241556CE4F0888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594191, "uuid": "33de532d-9869-45cd-b39a-d15e1a560724", "value": "96:M/cCbMtNsWaI11yQit2zx0GlWC8zTkGNsi6sGjYAoiF3PVdqoM:6cCQbSEsQiw/lWC8zTkGNsJroiF39dqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645594191, "uuid": "bf338c04-4bcf-4a1a-8321-a473e4a68747", "value": 4195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645594191, "uuid": "2e8bc44c-1a88-4ad3-bfda-b69632b03069", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594191, "uuid": "986af403-052c-43ee-a0ab-a279a5b3c94e", "value": "presente_244.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f4d454-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619226, "uuid": "1dc74143-8d5b-4f4f-8245-12c4dde095c4", "comment": "Malware payload", "value": "382b8b41f0d9a054765268b805f24ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619226, "uuid": "86173e2b-1a26-4b02-8ead-d0c2a3f07acb", "comment": "Malware payload", "value": "6bac0d93d2ea27c0efb5d6fe57cc9a0bf8896baa1c22f41670755a52a0fb11ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619226, "uuid": "f34bd3aa-5e32-4cc2-9442-76a0dd189301", "comment": "Malware payload", "value": "47bcf1b0ab8def5ca9db4267e6b58dadb624b108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619226, "uuid": "541c6a66-30c2-4e97-a4fd-71dcc504b979", "comment": "Malware payload", "value": "d72fe92401e5561c101ccfdd3aefbe9c5f40659a30838cacb09820e48d4759ebe0081996c9c61ca7adf3f06863f671a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619226, "uuid": "6127087b-ab35-40f4-97b8-8788385594df", "value": "T1A7A4E010B690C035F4BB12F489B9C37CF92E7AB09B2554CB62D56AED1635AE4EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619226, "uuid": "15bb8e1e-6713-4307-b1b1-a2698e5ec468", "value": "ccd6a4e90a04c24d49f4949717a298d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619226, "uuid": "551f157f-98e3-4fdc-ad42-e54058a8d918", "value": "12288:6XzV7+Gjt5KiYv6dWbZgSU8lL/bEM7ZoBTuq:+PB5KiCAWM8lnEM7ZKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619226, "uuid": "a41729aa-6a87-4176-af3e-ad164ba50edc", "value": 451963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619226, "uuid": "6fe4dd49-a961-4af7-9bc1-9280e05dddaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619226, "uuid": "4d03001d-0101-4c13-88af-1bba9721ddcc", "value": "382b8b41f0d9a054765268b805f24ccd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9a3836-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645611261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611261, "uuid": "bd7c781a-0356-41ea-816b-2951aa7b2016", "comment": "Malware payload (Loki)", "value": "a9199cd199ed0ec86e2fe9962c536e76", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611261, "uuid": "58c99c80-edfc-48a8-b676-6219098b8619", "comment": "Malware payload (Loki)", "value": "6c545434375e199fb72248137325e4871a08ec62eb02f63c2c9a39261f9c2fc2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611261, "uuid": "3a54f05a-8700-475a-ba3e-d3c0641489db", "comment": "Malware payload (Loki)", "value": "88f8b184adfe104c28aa9b7ec266a8ece10cd28b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611261, "uuid": "f17371b5-570a-4af8-96e1-e8f59816ff63", "comment": "Malware payload (Loki)", "value": "427e9d80d7af5472fcb234a23021c440dffe621d2e64962a299b6d2fbf6f5eea819ec35651249fc8fcd3887b72b95658", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611261, "uuid": "3e6c1f0d-cc08-4e83-8adf-61fe2c6f9844", "value": "T1DB14126A71391271ED14B6381DA18A9793349EFF7527DC7BE3013B9310B239F6851236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611261, "uuid": "cb512355-a05a-4da9-b82d-76fffe7ec945", "value": "3072:7fJjfVgDAhxKFvvbEAZZf4EKnjf80yCNRsmUev2wV6AUcdwIBCi/4yAqpXqFumpP:bN2MwD/hcnjfHCmUeuwVV+WeIX2BAu5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611261, "uuid": "e798f362-a0ae-4938-9743-6efd7c238a7f", "value": 190424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611261, "uuid": "06967861-4477-42bc-83b7-7a273e39b00b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611261, "uuid": "11fda5c5-8857-4c0a-ad1a-f7d25ba4999c", "value": "48100200025335.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d53cf70-94b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645625835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625835, "uuid": "6b05ec19-d58b-4ebc-aeb0-0ded546f8e91", "comment": "Malware payload (Mirai)", "value": "3eb06d9fe9423bb2cdd64e835f55e337", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625835, "uuid": "ebd5cd8d-0bcd-4e5a-ad7c-821a89127a27", "comment": "Malware payload (Mirai)", "value": "6ca3dfcd71ea068ce4230cb6b6118889d7cf8e0ffb25391f42bf243839e5d87c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625835, "uuid": "034c7047-5e14-4d01-abdb-564c26873718", "comment": "Malware payload (Mirai)", "value": "f9d45e64cfbf1e56e41c7f9a0a6909749b7ed8e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625835, "uuid": "501fa6f0-6179-471d-aad6-986a16c318f6", "comment": "Malware payload (Mirai)", "value": "1b5ad3b36bd6baada8e7272abca5e99a6650ddcce16dbf95de7517ef2d564472f8330ab711ef4ede8e8972c75cd2c4c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625835, "uuid": "d8050740-2c9d-4b2f-884c-15c5b9ebb4e4", "value": "T17DC2D16DF596CA56DAF13FF1985CF7C12BB23E053A6549B20686FF025D628015704EE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625835, "uuid": "a334f39e-2228-4e75-8190-1578a6e21049", "value": "768:YSIJ1ffHiJvXuT2TyvCE07oSMzoMXxus4uVcqgw0RNWXe:A36sTENoS4dQs4u+qgw0bWXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625835, "uuid": "88086476-3c88-4695-8d0e-6413915be57f", "value": 27264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625835, "uuid": "f8a8dda9-96fe-44d3-8bdc-308e3be4ae07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625835, "uuid": "3d022c05-e82f-41fe-b122-bb9674c8ce62", "value": "3eb06d9fe9423bb2cdd64e835f55e337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4752bdb-94bc-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1645629981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629981, "uuid": "2e1c672f-5fda-46bc-b2d8-81c9b5f5df9e", "comment": "Malware payload (RaccoonStealer)", "value": "5ec064205c786d8ef4bcb5375bf8c7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629981, "uuid": "5cb501b4-4a61-412e-995d-23d63f5f2b6c", "comment": "Malware payload (RaccoonStealer)", "value": "6ca6b7b7a221701518cd240a938af6cfa7dd8257333f03ba0ab3dabeeddb5d04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629981, "uuid": "3c72b924-64d9-4dc7-8446-6b61799b2a54", "comment": "Malware payload (RaccoonStealer)", "value": "ada637900401c1c8df31d3580ecafe80f5e7e6cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629981, "uuid": "28073563-06a2-4efa-866f-31645ebd71d4", "comment": "Malware payload (RaccoonStealer)", "value": "0c1b3c48516dd3d01e3bb2a66b754aa467cdbe3e50381ce8c5b64b74dcb766fe97ca703c1ac6f68f351a571d00d64550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629981, "uuid": "231f8684-3fd8-42e6-ab91-78172ab49c72", "value": "T1C4F402F17680D4B1E4827D309826CEA0542F6C11FD60AA47F2787F4E2AB73E5546A32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629981, "uuid": "871627f0-30eb-4a93-95ac-cc7b22612645", "value": "ac28fe22f41d923696527394756551aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629981, "uuid": "f72f6c6b-4762-4aec-8bd8-1321922bf331", "value": "12288:7BZjsvJIgQeAWb3PwaUiztQ0qctkf0vODOvwl73kDOH7uTE:7B1sBIRuPwaUMt1NcuODOvE0CiTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629981, "uuid": "f2322575-dae3-49a8-84e0-3a5ce27aaa2c", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629981, "uuid": "7b77cf44-e9c3-4e18-a229-355f02a54d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629981, "uuid": "b0ce8a3e-37f9-4e0f-8335-f8eaecce4728", "value": "5ec064205c786d8ef4bcb5375bf8c7b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c54436-9473-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645598494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645598494, "uuid": "86fa5a16-98db-4158-a82e-94b43117589c", "comment": "Malware payload (RedLineStealer)", "value": "c92baaaafb78274139eef17d67587221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645598494, "uuid": "621d253e-d1ae-4a36-b6d5-28f7143a23a6", "comment": "Malware payload (RedLineStealer)", "value": "6ccfc61cf6c9773fa9f932290fa647b5559ff2e4de79d69b0dfe4a114e6c1fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645598494, "uuid": "cbda0a35-4c1e-4334-b212-1388c237bb53", "comment": "Malware payload (RedLineStealer)", "value": "5786396bb07bb1d0104233d0c1275a5a9a8eed9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645598494, "uuid": "975cedfd-332d-493a-b50a-317ec8986513", "comment": "Malware payload (RedLineStealer)", "value": "0f025c675b0cda10b56349a5ef95aad03ab346a0b0b7b645dfca7a36ae12787e2f3c904f0e093ca34f2a605c8f72c330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645598494, "uuid": "6e23756f-b1e8-4705-b13a-df86502de0a8", "value": "T1B4A52302FD816BB6E3E11C305865EF627AB5B2300F3985DB73E48968E9305D27721AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645598494, "uuid": "179182c1-d2f3-4aec-aa4e-9ae90a2af1aa", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645598494, "uuid": "cd434052-f4e9-4943-8e10-1fbba56d866d", "value": "49152:P842wLFzi/luM+3by5ZHCljhJkCt9C25r6cEJyGZoH2aX:Pc0Fm/TqUIjhmCtr5rDeyOoH2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645598494, "uuid": "b558a2b9-67fd-40f3-be42-5e6fabca389f", "value": 2104516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645598494, "uuid": "91373e05-3901-4b3a-8ca0-4def365dfca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645598494, "uuid": "cbe4a33f-3233-4009-858b-61d491343dc5", "value": "6CCFC61CF6C9773FA9F932290FA647B5559FF2E4DE79D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cbbe62-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619060, "uuid": "4296edf4-8095-4d59-9b2e-67dad8626830", "comment": "Malware payload", "value": "3eba8546ef529f961cfec9fcf836b0c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619060, "uuid": "2bc9bd55-d4be-471f-873a-b11654bee77a", "comment": "Malware payload", "value": "6cd35936694146f18ac734938f284cf65fde178cf3fb5b528da0be2818d61f6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619060, "uuid": "df01dab9-022c-4712-a9d2-e9b32b652666", "comment": "Malware payload", "value": "f2764ff591856b8bbd7b78c761d75de7dd5360a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619060, "uuid": "d2a9f694-5786-464c-9347-3df0f1174204", "comment": "Malware payload", "value": "41225e2955e9bd2ac6bad0f266f9b73fd2cdf90aacd82704c3a40629f075a9f56ff5c65984394e0cf44af74ac987f46d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619060, "uuid": "0357b4f3-2492-40d5-a763-1148ff21008b", "value": "T18EE3015632D5C873D9561B7A16B7CB29E3B3C31803250A6B0B845FBB39253D3A706AC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619060, "uuid": "abf3ac3e-32ef-46f2-88cb-66673fe62ce1", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619060, "uuid": "2462dc5f-ce3d-45e4-b5d0-ce8a42050106", "value": "3072:oNyah0mJoJl5TjLPfH4W6TDpqg4gVy3L7djwZXRZ/FnU7l3ghzjN:owBTjLc+gVyXdjwZXRZ/F+QlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619060, "uuid": "f3820cbe-8ffe-4510-b3ed-6efb7a0174e8", "value": 154606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619060, "uuid": "c03912f5-e353-4436-aa8d-d300c9c729c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619060, "uuid": "4ee50923-977d-4869-93f5-f962070b81b4", "value": "3eba8546ef529f961cfec9fcf836b0c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fd5a93-9464-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645591940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591940, "uuid": "9c307098-41a6-492c-8a0b-367012b9f54d", "comment": "Malware payload (Mirai)", "value": "079d82952b8ae7ddedc3120f67bcfcb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591940, "uuid": "547678ba-e2dd-49ec-91b2-6ac5970ccc94", "comment": "Malware payload (Mirai)", "value": "6d4cf600cc0f3a81f80b52789f02b54606be4375a18f704fa6b7c1457db1be9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591940, "uuid": "9d7d18ca-7281-47ed-87cd-713253af0347", "comment": "Malware payload (Mirai)", "value": "73c44cbb7a59ff32c4302fb5bc51db648e409727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591940, "uuid": "562e677d-442d-4026-af6c-b1aeaf6b8b50", "comment": "Malware payload (Mirai)", "value": "66e8e5071b22e71ec9afcaff076d0c60c7261d4ef7b077858035f4783187a68741f3acc6e47e3989e3c0811acfcf3daf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591940, "uuid": "2a725c5e-cbb9-4cef-9461-4727f11d58aa", "value": "T137D2F162A0DF1E35E65A93FE821EACE17DF074025F6A06631A84D7568F5B02C8D34D0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591940, "uuid": "977e9d67-a1a4-4f70-b2c2-ebd8a8323673", "value": "768:Jg4U1rrUzMP6WRfp0tBnkfv+o6GVkwUEeC1Cvl:ZorowP5OvnQ+o6GGQ31Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591940, "uuid": "69c5715b-0f20-4df0-a937-909a4d7fc5fe", "value": 30076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591940, "uuid": "83d4eead-995e-4c0e-85fa-e23683c742ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591940, "uuid": "ebc255a2-2357-43f1-9446-3b85952dd72a", "value": "SecuriteInfo.com.ELF.Mirai-ASOTrj.30189.11973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a290c61-94de-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645644272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645644272, "uuid": "cf057599-d427-4952-b491-85842eca1d86", "comment": "Malware payload", "value": "a717be3d4233e361398f0b342e218a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645644272, "uuid": "771b1258-2a51-4a60-a218-06b7449c9820", "comment": "Malware payload", "value": "6ed4597153654e9526d066d62bbf7cc0e7d7e0660049f9e3b826475d3fa71abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645644272, "uuid": "500a32f6-a6b6-45d1-8de5-98bd4fe789c0", "comment": "Malware payload", "value": "70de6f78a7f089de188e762f2d91bc32d47d343b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645644272, "uuid": "684183d5-27b4-445c-b369-59204f5d2e44", "comment": "Malware payload", "value": "a8c20fc7eb3ee5829e4171c59460b2dc339826025f7a35c4dce8581200139a925d6dae303ce10dca07d118ee67ec2a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645644272, "uuid": "b9d018f2-622a-4be2-9b7f-f7bcc6254ea1", "value": "T1DFF4CE2039AF24DDF1739AFE9EC8E9B1CD6EF13A250D75BA24840F175B41A40ED42636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645644272, "uuid": "9abc880d-6314-4e30-b2ea-95094f6de1d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645644272, "uuid": "be705b0e-2323-4c7c-ba54-f2f842f03694", "value": "12288:rEJgYYz0y2fqeDsiqk0iLqojO45+GADjA5dgilvssTHMY8W8m6IIty:r9WCZiNnLqzjq+iGsTs68m6p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645644272, "uuid": "3a9e49ad-b1c4-4023-8399-afad9d754fd3", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645644272, "uuid": "830caa17-c194-426c-80da-4cc091c37559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645644272, "uuid": "1979d7fe-163b-4d9b-80ca-74d0b8cc06ac", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0797e1-94e2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645646261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645646261, "uuid": "b8c962fb-d9a2-4f76-8435-f910e4dff054", "comment": "Malware payload", "value": "ffccccb0a161647642e4c89fbda283d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645646261, "uuid": "713aaba5-8c9e-43ce-bcb7-e5ab6a5f05f4", "comment": "Malware payload", "value": "6edcc4330e164f011e3833d6d62943574e279e3675d504e1db6bf333bf233b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645646261, "uuid": "1b8a3c88-9557-41b7-8035-5c6d4c357005", "comment": "Malware payload", "value": "2fc98ab661c59ccbde304a261d89c2e3b7433296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645646261, "uuid": "c79fc19d-92cd-4eaa-a6ea-b99c4756bfa9", "comment": "Malware payload", "value": "11e5700444faca345498b9895b4c719646442126e52f3111ef8eea61148e442e7f0363a934a296900091a200e1d87558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645646261, "uuid": "29c84c07-8a47-4ab1-90b7-7446320cb748", "value": "T13DB35A9151C3436FC994F5B1E68D4680D5CF6E22386ACFDAA50E343EDC3A6A503BBC19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645646261, "uuid": "0a98b3a1-346d-47cc-ab24-317236d1f414", "value": "36a6792cc90d8602ae9a29933c8892f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645646261, "uuid": "4951079a-a057-440b-b2c5-78093a0afe48", "value": "3072:1c4Horf5X/n8eXZHTFGAfU7VKXHGHggY:13y1/n8YpDCVKXHGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645646261, "uuid": "fb5f2e16-e77c-4dad-a100-b52468ada4ea", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645646261, "uuid": "9cea5085-8f7d-4922-bf97-9ee4647269aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645646261, "uuid": "1d91ed8e-3ef5-46a6-99f1-0297b4583bf4", "value": "SecuriteInfo.com.Trojan.Inject4.26587.16189.19066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bb6603-9478-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645600650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600650, "uuid": "8bae9728-13d2-45f2-8190-ef1224e50dd4", "comment": "Malware payload (Mirai)", "value": "54197f0abafe071ee55b49f2331a4bc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600650, "uuid": "14b42b1c-ff28-41ea-9797-fdadeb9c4720", "comment": "Malware payload (Mirai)", "value": "6f7caf75499baab74572715ddec013c3fa1b58aa46eab89421008fe59f82c2f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600650, "uuid": "626446e4-5f62-4229-a06c-1a88f5ac97bd", "comment": "Malware payload (Mirai)", "value": "5f15f92f79861432f4357b1ad54c0b5d6ff12385", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600650, "uuid": "3bbd5d89-d553-47b0-9af6-452ce323d6f8", "comment": "Malware payload (Mirai)", "value": "ffd589de452e4291728ae32fbebbcf8ceb341fa86fc9b83970493208b747e782f2315a071b50f313fd19af54ba262a04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600650, "uuid": "302ff314-1ac1-48ac-8478-9acba4f9d911", "value": "T17AA2D07A778964F1C4700D39E2BE1547630F77F4E19F30698A1E2B187EA440A973A6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600650, "uuid": "fc6137de-caec-420f-9d1b-9ba7d056ee70", "value": "384:4X8US+c3CH373C/1KTHYjuMr7lBqNWkpmdGU5E/t:4X8US+s+3C/1KT4K6JBqT3Uct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600650, "uuid": "13e87566-3240-4723-aa4a-ff27b7b3a5cf", "value": 21832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600650, "uuid": "897bc8d1-74c4-4cc5-97e1-2ff4a3377f72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600650, "uuid": "ef25bdcf-b321-4174-980c-cd31a6c273f2", "value": "54197f0abafe071ee55b49f2331a4bc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d9af88-94ab-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645622514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622514, "uuid": "89516db3-845d-406c-890d-e3e2fd04c74b", "comment": "Malware payload (Loki)", "value": "d26b79f2653547f7d7b4a5580a47d969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622514, "uuid": "16386f45-698f-499e-ba28-23fa239e2442", "comment": "Malware payload (Loki)", "value": "6f975378cb65fa40e27b22cd6676e4385b46cdb0df3111cb94530a8615516281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622514, "uuid": "ac95afaa-908d-4ef1-af21-5fe4e52e4b56", "comment": "Malware payload (Loki)", "value": "6e82af7ed6970fca7e1be62cf653742d072f1fba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622514, "uuid": "877e6cd7-5514-4d2a-9176-3f0c6ed19b16", "comment": "Malware payload (Loki)", "value": "193a09c21614cb438efd4f7b2a45a3930d8308df6712c64005ef572cd16bf3d1b16ef8736b08e09d57a2a74c9a7c43a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622514, "uuid": "9eaa0caf-376e-4875-84cc-9612fdc6bddb", "value": "T1BB54CF11BAE3C831F1631E3A8C34C3A4967BB8626A705197F7A86F4F2D353D15A39316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622514, "uuid": "d2936949-6a4a-4096-9eac-6c9aae96a08a", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622514, "uuid": "46b43f07-0d7a-4cda-8d60-462fc11bb77e", "value": "3072:sr85Chq8fMHCsrWVtJnrggGFh9eBEtsxkgaBChgpqPRueq8fMBn44ib09:k9c7vQJmfYpigaDpqc7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622514, "uuid": "b2295614-5845-49db-80a9-f894cd9a9301", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622514, "uuid": "0918cb81-8f25-42db-ab58-441e7b61dafa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622514, "uuid": "b3cba4b6-3d52-488b-a1b1-ad71dc9e43eb", "value": "d26b79f2653547f7d7b4a5580a47d969.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb8d08b-94b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645626289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626289, "uuid": "e46cbbd4-2291-4991-95c5-948666ac46e6", "comment": "Malware payload (Mirai)", "value": "78e0ac06aa65df0746d3e6a7c1221af7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626289, "uuid": "55df0cbb-71e6-4f41-8696-b799d75a16ae", "comment": "Malware payload (Mirai)", "value": "6ff852068b05998749fb29ca3b82205cedbe6ea017c3b5f98eb925b9b792afb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626289, "uuid": "3b115e06-9709-4666-b3c9-967e44bc1626", "comment": "Malware payload (Mirai)", "value": "4088f13175e62474366f23c6484a6512777a2cad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626289, "uuid": "c4b69854-7095-43a9-b0ba-e3b99c747f04", "comment": "Malware payload (Mirai)", "value": "ff40e3b15adfd2efa19c730c2cba278c02a5bd4135e1f5350327103cebfd056aa1f41f60525b8974609b274bf0e9a51e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626289, "uuid": "fed6d37b-1618-418e-85fe-a8778e4bc252", "value": "T110835B0376580E07D2930AF4243F1BE187BEE9D026E0F289555F8B664A36E37158AFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626289, "uuid": "5dc56f32-d364-4fc0-a2fd-a6c7ccde4e28", "value": "1536:5y/RmzSzJnjsu0U/rR0lzM4bP8d8keDRrNEHP:5y/0zdigzM4bmUDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626289, "uuid": "f19debc8-1b99-437f-b2c3-c03f318e2bcb", "value": 84544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626289, "uuid": "0a467c86-978f-45d0-9e38-1b588821159d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626289, "uuid": "0b2e1d7f-10ba-4b35-ac84-2adf803be0f2", "value": "78e0ac06aa65df0746d3e6a7c1221af7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e365ba3-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645624441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624441, "uuid": "49f674d7-9280-4f58-a989-963e45bde7a4", "comment": "Malware payload (AgentTesla)", "value": "07a1031cdecc92fd478072771ced3923", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624441, "uuid": "f7fe0317-ff91-4ca3-8c98-53f26d73637c", "comment": "Malware payload (AgentTesla)", "value": "7059762099ba6305d6840c56644eca59ede7f3babfce852d87a4f4963221b5c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624441, "uuid": "9b6d84d5-52b1-444c-bd20-703e23edb4d3", "comment": "Malware payload (AgentTesla)", "value": "ed5cf8616958ce53fce6c9caee35418bbf3cda49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624441, "uuid": "f37e60cf-b1b2-4b00-a1ec-e6c1bfb2f390", "comment": "Malware payload (AgentTesla)", "value": "6b1888072fff8a8f52589c59761bdb4c63552b4e522793309502cbd2fd100c9bf3c1baede95ed9068c536c4cbb68b4fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624441, "uuid": "25302f7b-a064-4657-8b28-31a7c95258fb", "value": "T107F4AE19E7420AD0EEB8467AD5F55311239AFF708CDB860B719D797EC5AB3A82F8014C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624441, "uuid": "5b13db94-e7aa-4181-b982-9bbf756c4f14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624441, "uuid": "aacb7cd9-6e69-45ef-9f41-fa3ddba85892", "value": "12288:XoyvisEAXoJH22qla5w/yXbxlihpgXOwwgZ5BskC/gCzwHJe:4yvisfXoJH0MW/Ibxlkw9e/gowpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624441, "uuid": "85caea68-140e-44fd-8e51-b19c446a6acd", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624441, "uuid": "1b832420-b3c5-4b72-b62e-4d967de4e156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624441, "uuid": "befe2b13-681b-42bb-857f-e263809cc7f6", "value": "07a1031cdecc92fd478072771ced3923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1a6c04-947c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645602375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602375, "uuid": "059bec33-79ba-4a44-a914-e092696cff43", "comment": "Malware payload (Loki)", "value": "de3f094ccc797944539d0f74b1550d42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602375, "uuid": "3d392ef7-4d06-4495-b2e4-d343ecc66891", "comment": "Malware payload (Loki)", "value": "70cdadc6f79700ff1536ceac6d265707c61088bf0c210208d26829c070ae8710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602375, "uuid": "09d401e6-9de6-4720-a082-77af506ab299", "comment": "Malware payload (Loki)", "value": "25088389888cd40aef11fbecbcc1c303111405ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602375, "uuid": "ccc24561-021e-4723-8db7-ea7cf34d20dd", "comment": "Malware payload (Loki)", "value": "b24b6310ec2a1fa543c4cdbc1d0d0831e66e8b7f333bdd5746b75dd8e96ce461e6ff9e2fcc46c0a318c5606f8309404f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602375, "uuid": "c25110ea-a0cd-42b5-acdb-62973b063326", "value": "T18DF4BF0839A74F3DF1B18BB21DC4ECA4FA99FB271C08B37D78516686C6A1B409943677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602375, "uuid": "341fe3cf-1480-4dee-953e-906711144ae3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602375, "uuid": "ad48fbe5-d6f9-48d0-8c5e-4237be187cbc", "value": "12288:MW4jZ5vZh7jnK777777777777GV7vfJWIKX+TQuZk5c/wmIjO9r8Jgome1IPJngT:kK777777777777g7HJWIKX+TQR5qwmIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645602375, "uuid": "f01a1901-2779-479b-b07a-a7c4cb827497", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645602375, "uuid": "12fe7bae-36ec-4d28-a47d-9789210ae1f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602375, "uuid": "d2f9c6c8-04ad-4a28-b22d-5454f165c68e", "value": "Purchase inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19b85eb-947c-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1645602408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602408, "uuid": "b4db630c-a4ce-423d-ad3f-1f62d4802053", "comment": "Malware payload (DCRat)", "value": "d514f33db3569e17b94e82ed9876667a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602408, "uuid": "e754ed19-bcc5-48e9-92be-9757ca04e1a5", "comment": "Malware payload (DCRat)", "value": "7116e1d0fcfc076ed5ecdae3791d659ced95c1e57468168243288ddd46616306", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602408, "uuid": "541b920b-fadb-48f9-9a4f-536d2accc29e", "comment": "Malware payload (DCRat)", "value": "8171aed85db4b567ded45b2ec1d301c5f7b98ca5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602408, "uuid": "6c471cd4-fb3a-4c64-8bf2-a3ac5f16fb5b", "comment": "Malware payload (DCRat)", "value": "d2ee5089b092de077aa5f5dafd8124e34317ee504568e8c83fa9752617dc05ba45863384960a6cc217849467ead6013d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602408, "uuid": "e7963d89-7cec-4962-a917-d88b81a673ef", "value": "T1F11649167A58CD12D0251E3BC8EB822847B8FD517667D72A3E8A336D5D223A71D0D2CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602408, "uuid": "12d3beda-3678-4ed7-96e9-c86502aa1784", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602408, "uuid": "94d16e1d-e348-489c-901d-32f5d85c9329", "value": "12288:nqnO2w+UCzJ7NyvNwVUcCHzuQSJueps3eBgoUKbtNIuGkSx2qwIuIAwfnwvHdt+X:n+ON+eKUnoFBxRKDhfqHfiOPXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645602408, "uuid": "41d79191-b37b-4562-88ea-1e40f8437fe6", "value": 4342960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645602408, "uuid": "bbc2eec7-002e-4bad-b0c8-58b2899e6c77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602408, "uuid": "da8de3e8-bbf2-4420-a105-9918f77572ca", "value": "7116E1D0FCFC076ED5ECDAE3791D659CED95C1E574681.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e069a6e9-9443-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645577979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645577979, "uuid": "16c56df7-fff1-47c1-98db-917bc41bfebc", "comment": "Malware payload", "value": "26f663daa327e9f720177d01a83b05b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645577979, "uuid": "5b7ee509-8ac7-4229-8637-cbb2c7e7b060", "comment": "Malware payload", "value": "719916c50a4b7a17582af45ea60042098cd5d61ab5c92f29606b2dde6e2a0955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645577979, "uuid": "c3d6c9bf-6a2c-487a-a0b2-cd423c31f1d4", "comment": "Malware payload", "value": "d82f57f17761db7e61baad660fc1f3d377d7c977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645577979, "uuid": "052cd365-4609-49fb-a058-b74393a61200", "comment": "Malware payload", "value": "ef9848947963077e8d36ea7afe40dac0c3bb58fe8ca621172ebb835e6e3ea7f2f8d260a27dac77a41cd914f09170cdfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645577979, "uuid": "c3b9c2d8-44b6-436a-a6d0-85c9c7d07b50", "value": "T139F30107F5044237E4448771469BD2B82BB1BC2ADB7679162A69F33C3E75E5223AB3D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645577979, "uuid": "5884829b-4fef-418a-97c3-49b40992aff1", "value": "3072:nBnMP0H8uMtxIYF+D/4pOsRENSyr01DZnPW:BnMP0H8/UQ+4RiYZPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645577979, "uuid": "5af26f76-43a8-4a07-ad2a-8fa81d3c7ab4", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645577979, "uuid": "1fd1358b-075b-4e4d-9c46-220a7c44e33d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645577979, "uuid": "dec60e4b-e661-4f2c-a01b-6090fd7eaf2d", "value": "test.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99810a85-94b8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628111, "uuid": "e0d4187e-3112-4f92-b0cd-de1ebd8e1d76", "comment": "Malware payload (Heodo)", "value": "573b628728bc21155169c6f9c42b067d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628111, "uuid": "6e70a011-035b-4725-bd23-c08ea4c31462", "comment": "Malware payload (Heodo)", "value": "71f16f56d2cab55e82e83a10ea2cf7c9520c715042344e05200f47ba0b3d9102", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628111, "uuid": "0589fefb-cefa-4dbe-9083-19988305cc0b", "comment": "Malware payload (Heodo)", "value": "d88bffe654b2f8f41fcafd02542dbb606dd37969", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628111, "uuid": "db82c532-c3f9-427b-8dd7-ccb9f99d295b", "comment": "Malware payload (Heodo)", "value": "aeeb3fa4bf40732f7bb0145e68da4f977d8e281e0025a42a3f2ced9e88e683d8fce3260dfb04eba30d14aebac2f72c96", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628111, "uuid": "8a5fbf61-386d-4c96-ab32-6aa0f7c71345", "value": "T12E35AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628111, "uuid": "a70eae27-b1b2-41ec-9898-8c53e93ff829", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628111, "uuid": "c0f38f45-2982-4b0b-901e-94cd59689b46", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNATEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNAT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628111, "uuid": "d9456ffc-1318-45d4-91c3-39ea169f2d0e", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628111, "uuid": "7db1038a-d210-4ade-88e8-29f45204c2d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628111, "uuid": "1d270362-1a90-4b89-b09f-76ab91d86565", "value": "UG8uOm35xu5A29WdQH7cSNiGtMh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bc77ed-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645611027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611027, "uuid": "caf634b3-9439-4249-9805-88abc27ac2ba", "comment": "Malware payload (AgentTesla)", "value": "a9ba9ec98514156c6e3265952a5e382c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611027, "uuid": "7deb505f-e337-4ee1-8505-1f426f0d2cef", "comment": "Malware payload (AgentTesla)", "value": "723ddbc407846594b215a8c71da2e1219827d2ce65f837646fb5e86828c77e0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611027, "uuid": "4a98bc22-4c13-47fa-a385-41d430211efc", "comment": "Malware payload (AgentTesla)", "value": "f1dea6987e9e663912ea5284ac2a90d4c9149e37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611027, "uuid": "31620f73-4178-4883-a5a6-b091ccc98f0f", "comment": "Malware payload (AgentTesla)", "value": "0afbd1610a02ff67e81fa90b9cffb229dfde7b087f8b456ac1a5b406caa31ce8a97e255ba215bbbacacf6d802a8271c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611027, "uuid": "800d6c4d-3a3a-4605-bec7-adc6d5aaab0d", "value": "T1DC1402C572C61558F56DF2758244D606C7F2ED100BB0C982AE4B379DBAF6ACD03B287A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611027, "uuid": "e42f02f4-d422-44a8-a743-21ac2433acc3", "value": "3072:TXdhpfKLOKxQRpfsCNuXXgEdaUWRaMC8wI7h58ymZ/hpeWQclca7f959ogvafXgw:7dhcElsCNkg6apCBAh58/9hp7Sa/ygvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611027, "uuid": "fbed7d31-2bef-412e-8ba5-27dc36af3ece", "value": 191112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611027, "uuid": "b52bdaf4-32b0-4cac-8d53-f0ce92e9b606", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611027, "uuid": "2e1ca749-b876-4f79-bb46-a61434053638", "value": "Revised Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ec433b-949c-11ec-9275-42010a9c0029", "comment": "Malware payload (Neshta)", "timestamp": 1645615896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615896, "uuid": "3c2cc375-ec8a-45eb-bf33-5c3d992bbe89", "comment": "Malware payload (Neshta)", "value": "50ec47d421db7fdbe536cbe1e3da08e1", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615896, "uuid": "5a834dab-684f-4ac9-a2eb-37c954ad692d", "comment": "Malware payload (Neshta)", "value": "723ec9f9adec4d73a61d585531c7bc06d3b10ea246828b44cdd97a3c9aaeb6d5", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615896, "uuid": "54f904ba-e2c6-4a17-9dd7-69481d251baa", "comment": "Malware payload (Neshta)", "value": "e5073e9cd75af5f085b693a223e9d6f7aa80effd", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615896, "uuid": "e31876ac-7806-44f0-a3ef-c16c94ae20c9", "comment": "Malware payload (Neshta)", "value": "8adadcc26b4d938b11c24f8618c1f72f248e3930280c0ca0efc7ab2e2d8606561b4f182763109e2d341d31cc901284f4", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615896, "uuid": "633809ee-96b5-4a02-a07a-26e5dd998667", "value": "T10814025879B09578C9853F7358225995026AFC80BDC8AECD7870F7C521F8C33F54BAA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615896, "uuid": "17e4308f-fb6c-41b4-b405-ddf56a1dde4d", "value": "3072:gpTgaaoODjaZ5BnvFr+PzR4/0ZU1A63JiOcXIiXKmY5KSpPxCsZN8PY:mEaaJDWULm/wkAWJPcXNNY5BHZN8PY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615896, "uuid": "d45626e0-dbf5-4083-b73d-44911defb091", "value": 190968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615896, "uuid": "0eb5c18a-5696-4c6d-a89e-ed8793b9f0a1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615896, "uuid": "42496fdc-e5a3-4d47-99dd-58e49979be9f", "value": "\u0391\u0399\u03a4\u0397\u03a3\u0397 \u0393\u0399\u0391 \u03a0\u03a1\u039f\u03a3\u03a6\u039f\u03a1\u0391-1_2022-02-22_10-56.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ccb8f9-9456-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645585963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585963, "uuid": "f5722971-4c63-4f5f-9e0a-dabf80be14c5", "comment": "Malware payload (Mirai)", "value": "d23caccae21d4885ca5f4bf51f04820a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585963, "uuid": "5f5f54ce-1096-4ff1-9f43-84de3100b79d", "comment": "Malware payload (Mirai)", "value": "728e099702ee701f80156b90a843069ac8dfcd7f9ea82fffa0f254e35a945326", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585963, "uuid": "69855c5e-8fc6-4814-96f6-982ba1a85531", "comment": "Malware payload (Mirai)", "value": "ab9b03467545d52e7a1f0de8474a6420bb37cd7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585963, "uuid": "a43d05de-1bda-4305-b316-e21133af7710", "comment": "Malware payload (Mirai)", "value": "89dd54a001a10c5074ef41bd30e7182a78f4c3ff4b10766a914844e0900e9dbea13cb1dcceab4fd5205e786a2417efce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645585963, "uuid": "5f399f08-10b8-49ca-b11f-409abadbe9b8", "value": "T15752C7E2BD459E03CAC46237FB0E839D7F265748F2EE33036B1B6F5166079170A6640A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645585963, "uuid": "65ea64c0-48b0-454b-b1c1-d23f75d705ae", "value": "192:93ytjn0s/uG5hsQa9ZBiM0b85M/d6YrGooJHb5B8okEZx4ewEu:93W/Wc49iMU8rYrC3B8oFx4eNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645585963, "uuid": "20ceb9df-3219-4038-8917-6eb1537eae27", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645585963, "uuid": "d7ea3145-6fb7-40ff-82a5-56268a16e825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645585963, "uuid": "b6ba0558-0c8e-47be-b9ec-4b8a943285ec", "value": "d23caccae21d4885ca5f4bf51f04820a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6c8634-949c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645615905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615905, "uuid": "6eca3a02-86b5-4931-8815-36ffb18e3602", "comment": "Malware payload", "value": "e2b4a4c078d8a0eaf1ac20e1e058a1fb", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615905, "uuid": "04a04807-77af-4829-b8a1-06f8fd6bf1ec", "comment": "Malware payload", "value": "72bbde69b38b2cfa107bc4e70f738153e148cc5127d7fb02c56bd5842bcd6db7", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615905, "uuid": "ced8da5b-5a32-48ed-8d8e-101ce737d801", "comment": "Malware payload", "value": "ac1e5443e0705bbe4607ac6a365e77794441ee65", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615905, "uuid": "c9ac0d91-d6d8-4855-9980-d74e8fc6aad3", "comment": "Malware payload", "value": "cffe4e0bda2dcc49dd6ffeec8bc3052cf144e6a593448cf0b9419e7d7457360edeadc404996964b37ca3b286c88fc9b9", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615905, "uuid": "34a0a2f0-755d-4cd6-ad18-bd77251e866c", "value": "T15D04125BE7011932DBDA467915B54F382951FCB9DE2D80F12A4C7B0A723742CFEB2622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615905, "uuid": "c6725adf-8d39-425c-a000-06e76cfe4d6a", "value": "3072:s5Sil7JFtT4f8qZyV0VnKgpRviMMBKHgiARcMnq6pZX+KjbWaLrEc+m5TE:WSiLFtT4Vs0VK2xeVdZl+KHWaLr+mpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615905, "uuid": "4389bbdb-1d2b-48bf-aab9-f595704e2042", "value": 190248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615905, "uuid": "d4c9e235-6817-4907-97e8-12cfbc05ab1f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615905, "uuid": "5c3bf469-56eb-4e37-854a-75f1033c2a71", "value": "Delivery Manifest.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c5db17-9475-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645599093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599093, "uuid": "0ce1951b-800f-4133-9bef-ba82565d6131", "comment": "Malware payload (Loki)", "value": "0a4d334016981fff3d77ffb54ceb2fb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599093, "uuid": "e56a3ab2-b0ec-4c40-a9f9-3a17d92f2a66", "comment": "Malware payload (Loki)", "value": "73995d6f305bc8dc5f718ee1703cceba021b5f80f1acdd526e647dc20ba76d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599093, "uuid": "e2182304-8c1a-441e-9818-1ed25bbc0255", "comment": "Malware payload (Loki)", "value": "76569d0f8cdd2dcc0b4066fd513cc49a3a792a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599093, "uuid": "250b8d64-03c1-4043-8187-22653d43efba", "comment": "Malware payload (Loki)", "value": "51a2ca1ebeba5e04a6d13c54639bcb0fe498eb248e411faa6e93b086b7b44f5b10e400fb1c71430a134ad4875c28bc02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599093, "uuid": "b349d0e0-6248-4c12-ad8e-8ad4ccddba42", "value": "T13AF4BF4839A75F3DF1B19BB219C0ECB4FA59FB332C08B3BD78512196C6A1B409942677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599093, "uuid": "5af3e021-4c0d-4181-8991-4e4d9de7b4ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599093, "uuid": "f6ba9763-9308-426a-b869-95c493276886", "value": "12288:EWj6FgZlh7jeK777777777777rLhOJHHd18TQ8zdxl9PlZozpfhvMwe6QYXKAJ8l:4K777777777777rGnv8FdxvPlK9hc6Qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645599093, "uuid": "37f436f2-3c01-4e76-aa19-1a97c772aafe", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645599093, "uuid": "ddb01b76-ed11-4038-b788-0a9efa5024a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599093, "uuid": "00e79d4d-ade0-4340-95be-2852ab1014cc", "value": "Il792d0nDqpen5E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c826ff-947d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645602663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602663, "uuid": "def661c3-d3cb-42f0-8904-70ab3339119e", "comment": "Malware payload (AgentTesla)", "value": "4879391545d83fde9401b165acc3e457", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602663, "uuid": "84431838-aeae-4f04-b748-f33c56331772", "comment": "Malware payload (AgentTesla)", "value": "73cf8d27d858a648a7ee129cd250fff60307630d717325c8f7a525dd9645ea28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602663, "uuid": "3d7d73e2-857d-41b7-adfd-6833816c8d07", "comment": "Malware payload (AgentTesla)", "value": "e25550ab485e9217c43fe6990efe579380797353", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602663, "uuid": "7b2c7eaf-cba2-4f89-ab15-c688b447257e", "comment": "Malware payload (AgentTesla)", "value": "f5fba1b89e9b6643084224294dd6c1e442471a4e7e4b9aa444e374f8853817d591a369a3a187e7593d65f2591ee8b85b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602663, "uuid": "31b21a20-a355-4c99-9505-ec47d6af4b3e", "value": "T11325A49831A1F1EEC8A7C875D9641CF4EE907C6AC30B924790173EA9B93D953DF160B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602663, "uuid": "7594b296-bc17-4e6b-b3a0-61c1ca9d7da1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602663, "uuid": "629531fb-f491-444f-bb71-0d26f1160b1b", "value": "12288:KptrAL/gv+JRLRAB5xQxltkHSGTslDz7/QElSoMTw5JKYT6vIY+26c0ZVsG9kr0s:KpKLYWPR47SjHzlShU1J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645602663, "uuid": "b84afe46-1614-40be-8425-9b2d09b88a4c", "value": 1022464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645602663, "uuid": "76c6eb60-2002-4fdd-a1a8-c57e77f802b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602663, "uuid": "0a519b67-9ca4-4a65-b45b-ab971a216196", "value": "Proforma Invoice Documents No.42 for USD 78116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf6a007-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645611364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611364, "uuid": "0013a473-f9dd-4ff5-8f48-af8ec5824fe5", "comment": "Malware payload (Loki)", "value": "f1cc3f05a1f70b1989daf942f698f7f9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611364, "uuid": "3cb3a3b7-41d6-4efe-bd33-7a744a533a81", "comment": "Malware payload (Loki)", "value": "743833855ee3de704fbe1d7f35169054e35f8fe691337ce8000bf9da79aae4db", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611364, "uuid": "05695504-92f2-435e-be8b-b8f470aceb42", "comment": "Malware payload (Loki)", "value": "23525fafd704320c23b8d290b12b2c74f2e1b598", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611364, "uuid": "507ca64b-467b-411f-8e67-f8722f2e69b9", "comment": "Malware payload (Loki)", "value": "e0f3fa8278a94abac5b9560208d36dc25dc718563036d7f5f295b717720bf4b9f296e43b7ad0f1862498073e2c3f7827", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611364, "uuid": "8e1be4c9-8802-4c8b-84c9-1c21d76d9b36", "value": "T18A1412402058BD24F8A4F679EE4DDE302891FCCB6593C995B22BB3987970FD39273586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611364, "uuid": "d12235cb-aded-4671-821a-ce7410476a76", "value": "3072:3yfnOBtYj9ppTa8SGALsNhAiTbcu0xl1fNLzY7iqpQLGEZHNNZevxNIoBA0K4FR:muts9/lALE2w0BNLzY77xEZHnkI0Ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611364, "uuid": "bac3cdd2-aa61-44e0-aa4f-3b78195f2c7d", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611364, "uuid": "e7a816ab-7b97-45d0-9889-6625b6d98134", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611364, "uuid": "64ba7005-87f8-4b2c-84ac-0c4815989ed5", "value": "lod1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be852200-9481-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645604550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604550, "uuid": "dded111b-aed0-4a0c-a6da-7a038b5b8ba8", "comment": "Malware payload (Formbook)", "value": "2b10c9ddb8f0f4bc8db7efdf6985a350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604550, "uuid": "ab939ecf-deee-4c84-ab90-7fafc121cc9d", "comment": "Malware payload (Formbook)", "value": "7488424703be23fa6c9b69275679b6f7617958756fcfd7ae3af0ccc7882c4d0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604550, "uuid": "3c146d90-6d63-4db4-9a60-0849773d3bd1", "comment": "Malware payload (Formbook)", "value": "14ecf74c1e2e1c081deb0c11e74ad89fb4578bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604550, "uuid": "634f9140-c0f5-48fb-ad61-7ea52dde5291", "comment": "Malware payload (Formbook)", "value": "33c7735e0d034b1a3152f6a2f55c4053c5f35c545259b55676881da296c70d01f74dab75945e13ba22d337f9b357a6c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604550, "uuid": "b6f33365-ce22-4bbe-b5da-610728162b43", "value": "T19D641241B1C190B2F5AB0E7184BBAF78D67AEF18384621879BA17F1716333539B12397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604550, "uuid": "0ef374d3-71f6-47cd-9ff1-36c721092897", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604550, "uuid": "41f35f2e-cd97-4a0a-b5b2-c226226f0670", "value": "6144:/xDhU76BJztevxNF0HVAlBBPmVvr0NnGxwnMO/0VVSphs:3U74evbF8Vebyrlaf/0nSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645604550, "uuid": "3e58b8eb-80dd-40a8-8d29-39ea5ee49915", "value": 310362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645604550, "uuid": "46eff720-8ea8-4618-8729-1a0ef52c73ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604550, "uuid": "ca3d5814-05ed-43fd-94f7-7784bc11fb0f", "value": "payment of ($288273.63).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfbad97-9464-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645591933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591933, "uuid": "35d1b984-d403-4ad6-9944-a9310d1d70b2", "comment": "Malware payload", "value": "6926821bc2e5752ba29623c8764e8b24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591933, "uuid": "95d5a82d-74c6-4807-80f9-b79d9e76f658", "comment": "Malware payload", "value": "752be6658d87da2eadfe7c1bf8d626d614aecf3677fb42d7252a7167c6c01728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591933, "uuid": "43ba09aa-8f48-4bd1-85f5-fdc144f72b8a", "comment": "Malware payload", "value": "9351e7a809199d031bae1fbeba0cf1fb2f375f92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591933, "uuid": "2f3e5b94-35a4-419e-847b-21d1220c5f14", "comment": "Malware payload", "value": "c996cf59deb5ccb17f7f49439728b137f691f71258bc20974d92cfcc07af8df46ddcc5ac0acf810e02dbf5c2863e4ad6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591933, "uuid": "b28a8613-7442-4a7c-8626-bb863da530cd", "value": "T16C13F1099F21EF559F0108A32D9D96AC99BBB75A0B7F347198E0BD4F83A61972C5F300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591933, "uuid": "3798f11f-d57f-4f28-9209-802216d657e1", "value": "768:pwkyTc9pHiGJ7bLxlpuYPW55oXnOsUkAtkgP1NjSfLL5UZmVelHOi:pxpJNlEYvXndUt/afLuZmVelui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591933, "uuid": "5c6982b4-e3a7-43f8-b9e7-7fa0fce2aaa7", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591933, "uuid": "da020dca-7dfd-4b23-af4b-c27aa6ab6fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591933, "uuid": "04e54ccb-b96c-4252-81ff-7ab36a4db29e", "value": "SecuriteInfo.com.Linux.Siggen.4218.10927.21806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796b6388-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574799, "uuid": "c57a4521-c3e5-4b6f-9327-22dc257204e1", "comment": "Malware payload (Heodo)", "value": "1b161f0f80fe48fb327cb321ca45ea02", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574799, "uuid": "73958f9b-c6f3-424f-b13c-9cbce6bc0a0c", "comment": "Malware payload (Heodo)", "value": "7538101ab7748fa4129fde835ff958b9dbab892db85f608aad6d15e9c02e1715", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574799, "uuid": "e186fa50-41ab-4465-ae9a-ae7c23bf93ac", "comment": "Malware payload (Heodo)", "value": "d891721d53d826551d6eb5e6a545671a64652111", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574799, "uuid": "bd390b0b-f1a6-40d2-8f90-bcafca4da12e", "comment": "Malware payload (Heodo)", "value": "3210214f0030040ff8b878558088ab89908b7ecc87d3c2630e4b29597ec4cc501eb1ff23cf3f5def487a69f57608b61e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574799, "uuid": "b77c26d6-0139-472e-b2ce-89904b5417c1", "value": "T159B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574799, "uuid": "2c00fd14-93ef-445b-ab29-dcdcda8018ef", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574799, "uuid": "9f2c1af3-41ef-4775-b419-d36c0d8ae509", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wTIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWEzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574799, "uuid": "69ed5040-cfc7-4f9e-9c06-3f178cebdb08", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574799, "uuid": "9c6c83c7-80ef-47c9-9448-9fc921abf19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574799, "uuid": "26cef4f6-8c2c-4a0e-bb44-46adc1ce6722", "value": "emotet_exe_e5_7538101ab7748fa4129fde835ff958b9dbab892db85f608aad6d15e9c02e1715_2022-02-23__000635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf39517d-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645623906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623906, "uuid": "f59ff590-e7d9-41e8-b2be-35392723db87", "comment": "Malware payload (Heodo)", "value": "6d49929dc082752edecd697e4c954839", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623906, "uuid": "c940a53b-7c1c-4fd0-b5e1-84591584d487", "comment": "Malware payload (Heodo)", "value": "75e11de5eccbf1db38360aa481592cfdedf2565f6623f9ba462ea1152105cf8f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623906, "uuid": "33f69ee2-3403-40ea-b79c-df641ff9ba5e", "comment": "Malware payload (Heodo)", "value": "96ee19207fd2baebddaea0ced2ac68ccfa5615cc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623906, "uuid": "92adc5cd-2705-45ad-8c4c-28cb6a685370", "comment": "Malware payload (Heodo)", "value": "3a4565c9d2d5ecb64c40c1edbc74e2db8db92a8d42a00171f903228cd5170688502521645119482e3fc26837b2f46b89", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623906, "uuid": "ae1fe346-4df9-484c-8983-882558c7d58f", "value": "T1A593022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623906, "uuid": "70b72cd5-877b-4bfe-bbcc-4fd85ba65e20", "value": "1536:fQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:2DpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623906, "uuid": "994b0791-0cd2-4fd6-b690-60b8e089e78f", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623906, "uuid": "aa692e19-05ba-4980-83ae-f60eab4b790b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623906, "uuid": "66d628df-d69f-4654-8591-df950b022942", "value": "2022-23-02_1423.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f788907-94a7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620819, "uuid": "263a7169-b672-48e7-b24e-79ff3d41b47e", "comment": "Malware payload (Heodo)", "value": "2882acc2a2c54011d505b613c5da6e12", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620819, "uuid": "53a6473c-5e93-42c8-add2-5c979121ce53", "comment": "Malware payload (Heodo)", "value": "75e1d758d04cfbc9e35e75ac2df6f7221f49b7f326bd0b3b81d2c5237c418484", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620819, "uuid": "7a29c364-af1c-469d-91a2-e2a3845a028a", "comment": "Malware payload (Heodo)", "value": "d1db3f1594304ed112b6080c367d41a66208ba78", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620819, "uuid": "dd07670d-801e-465b-b500-2eb34f0fb6e8", "comment": "Malware payload (Heodo)", "value": "65b0134cad4a6decca7c3765ab72949abbe31fd3a5619d4e7c3c8b729bdad5e8b09fb95a50783077fd569b188ed835c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620819, "uuid": "17b3d128-f2ea-41f1-8b10-80f4ed637e27", "value": "T1E135AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620819, "uuid": "e83c826f-6075-4f34-800a-7af3a756a80f", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620819, "uuid": "d815a937-95b0-4c38-9ab8-0e8ebab09c80", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNLTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNLT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620819, "uuid": "ee100914-d941-49f6-8bde-48db6b3509ee", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620819, "uuid": "77a4c242-ab0b-4580-860f-c11889d90726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620819, "uuid": "f0ec21a4-e6dc-4bfd-81e8-73ea1c300e72", "value": "dQ5M7o45ZyfSrwmq0zWUTdb20yee.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f3a1e0-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645623754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623754, "uuid": "0a958bac-c843-47c7-9d5e-f838a17e504c", "comment": "Malware payload (Heodo)", "value": "3c17bee9bdb6cb0d5038f79c89513a39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623754, "uuid": "03aa0de3-7ec6-4754-83da-298884331b81", "comment": "Malware payload (Heodo)", "value": "767fc8319ff3d712e85cd5aca8ad53b4d726568de52e3a107b3a318cd76c5d5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623754, "uuid": "131ecf98-c90c-4f0d-8219-f44b194940d1", "comment": "Malware payload (Heodo)", "value": "0a75a6e329d58757ca94240e431b71f71f554cbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623754, "uuid": "9c30f0c1-529e-47d6-b4fb-df1228a547cb", "comment": "Malware payload (Heodo)", "value": "f1b2a9bc1879111282964510c5db4c78ab572e01640d2238f7c557f62b63ec579bb2d660d8da835e7054eac0ffd621fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623754, "uuid": "9fb6be1d-6cd3-4c0f-a2ca-218e716ea31c", "value": "T13735BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623754, "uuid": "7391cc93-88a5-42d9-ac37-532a03c7a125", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623754, "uuid": "224c3d33-92db-426b-98c2-cbca33b01183", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/ATewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/ATeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623754, "uuid": "4632b215-2af9-4afe-8afb-e1e5271fc5ab", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623754, "uuid": "9c25102e-5611-4f13-887c-1945f878bbbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623754, "uuid": "681c1eae-2b16-455f-8548-11b869298133", "value": "3c17bee9bdb6cb0d5038f79c89513a39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba3c2e7-94fc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645657347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657347, "uuid": "c7a2b6a1-34e0-46a5-987f-4fceb9740394", "comment": "Malware payload", "value": "156dce214e549910327a6c39d92d9994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657347, "uuid": "9ef0452a-cfff-452e-a1d7-abde39da6845", "comment": "Malware payload", "value": "76a0305e482dfeb256570e1c6f7007eada280bb42c27a1730fa5f317effa89ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657347, "uuid": "038f4045-f711-4416-b4c9-a4dbe441d5ea", "comment": "Malware payload", "value": "2ace70aa63a667363cda5dce08d071e870dfd589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657347, "uuid": "64dc5a39-0188-40bd-a117-fd5939d44dc5", "comment": "Malware payload", "value": "ccf75322347434ed1a6fc3fcf1d37c6687c106fa9d8f9e51dcd964fda9c506375196962199926ac958a834f76bd01c2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657347, "uuid": "abe1bf70-bc71-4050-a7bb-85f804ccdd78", "value": "T1BB7623ECB580379CC41BC0758423E909E7F1952E1BD2A5FA7AC77EA0BB9B434D901B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657347, "uuid": "d90b368b-6a58-4722-b66b-a9f27bf2cd13", "value": "2f084553d02ee9faa371daf024a1480c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657347, "uuid": "2940e272-f4e9-4646-8d15-5679777b3952", "value": "196608:wTXAw3nCfCgq9siFhyamzCfeJjrAeV4A+9A58TyBpW:wbA8nCKp9pAK6HVj+aMcpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645657347, "uuid": "4f2e6720-4419-493f-9249-682a25bf930c", "value": 7614976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645657347, "uuid": "008da877-193b-4d75-928a-40e88011fdca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657347, "uuid": "ed4691c8-f935-451b-8312-6663b1ee9651", "value": "156dce214e549910327a6c39d92d9994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaa8221-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619155, "uuid": "a74927e6-a004-44fa-af00-5266be8c2e0d", "comment": "Malware payload", "value": "68bf213f06788f9e6b675f0480607024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619155, "uuid": "d35d40c4-c717-4912-bbc3-d5e2ee14c963", "comment": "Malware payload", "value": "76d5979174bfe006eae5e912b7ecab5f40dde075f20f0582e531e3d639206a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619155, "uuid": "181b3a7e-d456-4412-81dd-bdd013ce4259", "comment": "Malware payload", "value": "7689cf15029df3edcd41cc88a55714422160c6f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619155, "uuid": "85c72982-f29c-48a7-a849-e323113b9d29", "comment": "Malware payload", "value": "efd0c4dce428a51a968433b8e4e427550604f0c72deb2ad0859c8f76368ad9563fbedfe53ae5dfb49f005ae2ba9e8a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619155, "uuid": "ea03d28d-4ea3-486b-b6bb-ee9d67d6af2d", "value": "T1D62633C7F9F2853ACB064AF8A42610DDE52D1F5146378137A5DB149FAC886BCD30E36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619155, "uuid": "370d9bd4-ee4a-44d8-bc18-c9edfd36a3e5", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619155, "uuid": "742b7fd2-0257-48ce-b563-5c60225084a7", "value": "98304:J0deaIj6VibW3TxhLZXmWO9/idyp3+++XN8paVT5aPwcTn2cpiXCKd:J0dHIj6Qb6hLFOgGpvT2+iXCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619155, "uuid": "3366565a-6b8d-4316-8381-308b38f0ec3c", "value": 4855073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619155, "uuid": "b88c4f87-ad3e-4946-92c0-56941b07434c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619155, "uuid": "46ae1cd2-2227-46d4-bc4d-c4bf8b972ab1", "value": "68bf213f06788f9e6b675f0480607024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb931d9-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645623719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623719, "uuid": "5b5e4571-f6dd-4a2c-8441-26d545f286fd", "comment": "Malware payload (Heodo)", "value": "047bd662bf621c53dba8987e9533e2a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623719, "uuid": "541a2fd4-f22e-43f3-82ae-114b472031a1", "comment": "Malware payload (Heodo)", "value": "76e3f1d8221a179efdc8bbfc220893c71f78fb68484f75f60c080ced0db7d3fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623719, "uuid": "22e1ce6c-95e3-4ced-866a-44e42f60f381", "comment": "Malware payload (Heodo)", "value": "42f769613c79346aae044baa616d720dec84ba21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623719, "uuid": "6d95d2a6-d155-46f1-987c-6ebd6b452956", "comment": "Malware payload (Heodo)", "value": "2d9f1fb108591528792e1ce7b17b7cc91e07b9212b9c258b526160bc0cd95fa437d58e0a9952068e1a3030c1b696f040", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623719, "uuid": "7c8a109a-c63f-4b29-8cd9-e5ae6da920fb", "value": "T18B35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623719, "uuid": "9c8d90ac-1309-4a9e-8ce4-8d66dcc6c193", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623719, "uuid": "1e58fcb9-19d9-462d-b901-a8494324ab64", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/yTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/yTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623719, "uuid": "ce7eb2c3-95db-4148-97f6-5bc1a254ea05", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623719, "uuid": "98a94dd1-a428-4aa4-9273-e2b29579dd62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623719, "uuid": "e70dc2de-94ed-4946-85bd-0df5efab3069", "value": "047bd662bf621c53dba8987e9533e2a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c300aa5-94ec-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645650207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645650207, "uuid": "11a6b280-e731-420f-b500-9022cfaa4faf", "comment": "Malware payload", "value": "1079c5fdc2ce64f7d1eba7b2dbebff30", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645650207, "uuid": "03d07e7f-779c-4ce7-86a4-792842a3c35f", "comment": "Malware payload", "value": "76f43a6b9dd06c2e8a7dbb64c67646edd050ae5591111177da4e15f6c2db16e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645650207, "uuid": "f16419af-4fd6-4803-8538-95df209facb6", "comment": "Malware payload", "value": "4b360fa41765d545c1f1135bfac44d700e84adec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645650207, "uuid": "e30ba805-b915-4c67-994a-766e332266eb", "comment": "Malware payload", "value": "91d2720df1e5309cc0f5895fedf809e589863029bc92f21dbf6bb8321709ecc83c0f968b428509e8a561dd29c2579f9e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645650207, "uuid": "a3bb9e3f-75cf-4273-aff7-3415372349a1", "value": "T11F64AF02FAD2807DC34710B11A9B971AB3F99B540735CEC3EB85DE1A6E366C2E235B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645650207, "uuid": "90bfd5a9-6728-4b52-8033-8253086dd187", "value": "6144:DLn1rffg60h2JIn+Pbk12XY4Htqu5UYur3PqzhEm2G+R:Djhn0h2iub22/tqdbP0EJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645650207, "uuid": "435b0155-a9b8-438f-b637-15baca370fe9", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645650207, "uuid": "e9290e0e-e2a3-47ba-9cac-f07bf1196780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645650207, "uuid": "d6aec3e8-e4ef-48fc-833d-7d7d58f6fea9", "value": "emotet_exe_e5_76f43a6b9dd06c2e8a7dbb64c67646edd050ae5591111177da4e15f6c2db16e5_2022-02-23__210323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0de0ca-9466-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645592787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645592787, "uuid": "064753a2-5f45-45fe-9856-8c4e3236b252", "comment": "Malware payload (Loki)", "value": "c32cd37a991a66e5079eefb1ead5e1d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645592787, "uuid": "eb94d35d-9b2f-45d0-8b3f-1b9d31f2485f", "comment": "Malware payload (Loki)", "value": "770333adbea9af02e2d2f545beadcb817caa5c62e66c5ce6fe7d4b32fa75a04e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645592787, "uuid": "fd1e9929-85ab-40bb-b2c8-ef5bc56a3cc4", "comment": "Malware payload (Loki)", "value": "e1597fa28c3739f6aa7dad00663488f58357fa60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645592787, "uuid": "1a2164f0-a142-464c-a5e9-347d7b7a5949", "comment": "Malware payload (Loki)", "value": "011fc61da91acd6bb66d4ed04f024516c8caad113569003b45b9fad4c9cbc5e47084126eb401698087a3cd06bdab4264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645592787, "uuid": "c7196d8a-171e-4315-a8db-e94b99599cf9", "value": "T1D2F4AE5631FF1056C7A29BF10BD8ECBF866AF977120E753931813B4A8376A40DA42376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645592787, "uuid": "9f52d958-8c71-435d-bff9-727f12f2db4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645592787, "uuid": "65d829bf-6958-48a6-8db1-5b1f5b834f04", "value": "12288:65VkoAbrlI1ouzwlj7Hmx+Duil7aGzx6DPLXz0Nd3UJfT72AHeXXINSeio:JbrlINz+j7HrDuURaTz0NdCNy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645592787, "uuid": "27d22a34-bfc5-4e92-b6c2-4bbb2add34ca", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645592787, "uuid": "02d05e25-12b6-48de-b34a-ad0d3726e907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645592787, "uuid": "d872ef66-f6f3-447f-bc8f-128301e32f09", "value": "c32cd37a991a66e5079eefb1ead5e1d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9b024d-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619044, "uuid": "3f3e465a-5ba8-4a31-93c0-84345d176e30", "comment": "Malware payload", "value": "cc3646a82c9ea4978c2a266de0f9f35e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619044, "uuid": "b5e5e2df-7696-44b5-b45f-8392ee797243", "comment": "Malware payload", "value": "770f8cd0cae0a7525234dfc5b25f21b90090513d3f80fa06e8c22107ca8bbe01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619044, "uuid": "2f3dd7a8-7d32-473e-86d7-59a325f8a133", "comment": "Malware payload", "value": "504dabbb94be4e24ed35baf5e35b866ac346976c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619044, "uuid": "273ff12c-a264-4401-ba07-07036f6634bf", "comment": "Malware payload", "value": "d6e4b7cfda635f519080745b0e39bdf9ec126d0d04d56f2378fe5d3f041b2828e6bd0efe20787be6c8b4ae787bc2b27f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619044, "uuid": "bea85810-b9c6-4b00-b9c9-2947c11dd46a", "value": "T100D4E010B7A0C035E0BB52F485A693BDB62E7AB16B3461CB13D516EE47386E5EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619044, "uuid": "d7190efb-895f-4646-801d-ae7e2b31dd16", "value": "791d76659e45e8da008e73b27d00ce69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619044, "uuid": "10ec3020-5b3f-4515-8b0b-cccfb9a4dac1", "value": "12288:4nmsgWR0nROREA9x3o3yovuGMZihKsrsnkHV5u0XGaInd2g:8SnROK8xm/mi8Qsk1c029B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619044, "uuid": "b83e1e4b-c71a-47c8-83da-61b980eb1940", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619044, "uuid": "3cb807be-18b5-47fa-8b16-84ef8e0661f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619044, "uuid": "6499fbf9-9270-4cba-b5e9-beb625fa42bd", "value": "cc3646a82c9ea4978c2a266de0f9f35e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5277779c-9487-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645606946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606946, "uuid": "85d28d5b-cd08-4c0c-a8db-5499ec921084", "comment": "Malware payload (Mirai)", "value": "f77a0be4d05d4b84df673bf575c34a5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606946, "uuid": "67592ee1-4e11-4362-9ad2-84f46a2e91af", "comment": "Malware payload (Mirai)", "value": "77122cf0d8c859728a54bc449e2ee5e664b8e4230177818d681bcd889a7c405d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606946, "uuid": "d5f0282e-b746-4731-ba18-23961004c6dd", "comment": "Malware payload (Mirai)", "value": "39ca1bca25a960750b37a54058612191fb1e2137", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606946, "uuid": "ac5a1676-d735-4656-8a76-45c010a568ec", "comment": "Malware payload (Mirai)", "value": "314b2291dcb00909a295c50452379ba55d489f7e803f2dbf34a84ff93d5d8310c010737e23c2761630cec35196cf6c86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606946, "uuid": "666e9c96-460f-4630-8a34-511487af199d", "value": "T198D2E0917A006BB3F7B00D3BE8363043776B4FFC989720A6155907A9E9C6A4B67F2053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606946, "uuid": "56e0b3ef-3e99-4205-a603-b63950281ade", "value": "768:J2r+hbyXShVDo6AwpIuxAVBcv8ZaGFFwKsq3UIN8:J2rmESHDNAuIu8B28Za2ukC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645606946, "uuid": "67541527-3fa6-4b63-8a3c-bc220af7fe6d", "value": 29276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645606946, "uuid": "7df684dc-9756-413d-96b5-cddf0a4eda91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606946, "uuid": "a690ffc0-1043-4f5d-b6b1-fc4c2ea6eabe", "value": "SecuriteInfo.com.Linux.Mirai.791.8450.6949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aac980b-9490-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645610691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610691, "uuid": "777c1fdb-a941-4152-8669-7ccaed3becfd", "comment": "Malware payload", "value": "1e30255d9eca3098dea84d133c6bf8dd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610691, "uuid": "9687e0ca-42ef-45e9-8e3a-80f46795fc27", "comment": "Malware payload", "value": "7779d62261110f25d55afedc111af026cd79bb8fb350c56f70d42be498e4622b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610691, "uuid": "c3411b8d-1035-41ce-8836-787bea6fc772", "comment": "Malware payload", "value": "80f3b4e1324b6b1010a489351767fcf6d2f1d23e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610691, "uuid": "0a6d809d-c0ce-451d-b3a4-5923ccdeb1b8", "comment": "Malware payload", "value": "c11416990b67e586921d6bb2b87ed09bfb8a210538fc77850b174e32d4a7cbf9b20a5f8c11fffcb78af9ac3a2a8ad210", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610691, "uuid": "ff1d2477-c598-4d26-92bb-6f3a76bb594b", "value": "T1E395A831B1317A87C3161465265FBE8A430CBD47B2CA5F8C905DFBF82CA68E79306D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610691, "uuid": "a3da49d2-9bb9-4c0e-86c2-fbc2d5236b92", "value": "1536:2b8BvBDeTeUeceUeMeUe/eUe7eUe5eUeWeUeMeUeTeUedeUeDeUe3eUeneUe5eUf:PN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610691, "uuid": "c3155a32-cc5c-4781-9c49-c2b308f8c7f2", "value": 2051496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610691, "uuid": "eefb7794-d946-45bb-a251-8ead40d31118", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610691, "uuid": "a015fb02-8028-44dd-b30a-0a8cf20b7508", "value": "the bank slip copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04718dd7-94a2-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1645618412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618412, "uuid": "6c879134-a7f7-471a-ac3e-6fd2d2ee7c89", "comment": "Malware payload (RaccoonStealer)", "value": "d94a57d0295c095c7d77abab1b4fbbcd", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618412, "uuid": "f5bf1060-a65f-411b-993d-5bb5e365a76b", "comment": "Malware payload (RaccoonStealer)", "value": "77a97f255e0384065209c68afa5653d0329ff73535e3447a738925de8e666c44", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618412, "uuid": "3db0bceb-3aed-4d26-ab1f-125eec373339", "comment": "Malware payload (RaccoonStealer)", "value": "ba064f002989b1a91a9fdccbdf7609f9c4038aa3", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618412, "uuid": "efb1fa6c-6793-4d2d-91b3-53ff9b2d13bf", "comment": "Malware payload (RaccoonStealer)", "value": "9c805db380b5bd787f43b931eb1b488842c68ec2bc4f363cb9711b6eafffaee9c94d96298c970f362795b0d9fcd6ad1d", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618412, "uuid": "af3d67c0-3662-4a8b-8e5f-08e489719a26", "value": "T101D46D51BECA6EA1EFBF47B78361DA2D1126736D03A0A6CF6643019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618412, "uuid": "5d6e8836-762b-4fa1-9c75-1be919c86c3c", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618412, "uuid": "8c46aa99-1f18-4702-b2b7-33689c9f0ea6", "value": "12288:U0Ws7IMsR4yVld8bzbBSretBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqjw:U0bskX1dBY4ZyrE7K3yl8PeVooA/AB2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618412, "uuid": "ef127786-59c2-4819-89ea-5e0efdb5c984", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618412, "uuid": "22082468-c26e-457a-8c73-b01bc5516d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618412, "uuid": "146387f8-8803-48fc-ae81-baadac2f47ae", "value": "DOC160222-16022022123336-32.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e65e62-9457-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645586546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586546, "uuid": "7b1a6bb0-5b70-413c-b33a-af8197aa78fa", "comment": "Malware payload", "value": "aaf740577aa25415f2bf7e64c64cee33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586546, "uuid": "f45c8cc1-3fac-4900-b240-bf17aa154efe", "comment": "Malware payload", "value": "77afc221fbdf9223e1b16ea40ab8436a6c4bc654c826641a4804660cc0494dee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586546, "uuid": "8c4267b9-3028-402c-ab05-b95246fa22dd", "comment": "Malware payload", "value": "5dd9625f57bacadc03f9e8f0eaa9fbc306e217f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586546, "uuid": "b42a1b83-cf0f-443e-9c52-0b1b8ff0e7d3", "comment": "Malware payload", "value": "49cae63c3853b5019484a24ca28c7fa013a4013068403c7b348f4dbce649608e73fbce140e8bf5e3d70761fe9bd83942", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586546, "uuid": "7fc85144-9fca-4222-a495-d12c4fbb5a41", "value": "T13162B7E2F516DEB9F80DE33F84474906B170B68A46831A3263B7393BDD762841477E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586546, "uuid": "9cb42fd7-aad8-42a6-bd4f-ef85fd405395", "value": "192:6N8DTX/3FpQcAerUkXad8krXHvknaLFOhgjyzBQ7HW11/A9ywAQ4nbfuQGVnjM:6N8DRpAV5dhrfkaxt46K8HAhb25jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645586546, "uuid": "c575fab0-d7cf-466b-908a-2d81ea74ebbd", "value": 15704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645586546, "uuid": "4f818d39-8f8f-4e48-be3a-5409ad633cc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586546, "uuid": "a00aa8e8-2354-4fe4-b0c8-24f1ba0a8652", "value": "aaf740577aa25415f2bf7e64c64cee33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0642d36a-94bc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645629582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629582, "uuid": "e7717e59-3e38-46ed-bdca-69f077e35216", "comment": "Malware payload (RedLineStealer)", "value": "b0bf3916fbc3a5e273bb9e2dab209d7f", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629582, "uuid": "4590e7af-1969-4eac-be2f-17207a59763b", "comment": "Malware payload (RedLineStealer)", "value": "784b57a228a2f48425e7bbb078d32b1fed781703235408f0f5596a5a9fa85de1", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629582, "uuid": "9b786495-fc9e-49ff-b284-99b67663ee81", "comment": "Malware payload (RedLineStealer)", "value": "a0afb17ac14fa897babbc333a3db519af6d71c18", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629582, "uuid": "c577d067-78cc-445a-9fb2-f56ee5914b68", "comment": "Malware payload (RedLineStealer)", "value": "afef932233b9c2c59e3672628d0a2d01425f0716e2dc9affe6d31bb929b53cb44650d250f6ed2f74309266f9b9aaee60", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629582, "uuid": "f2da756b-ec11-4e00-8e87-bc4ba72f717a", "value": "T102163371D785BA88CE49A5FC340AC0297F5103247935266E11AEF8404EEDCB859BEF9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629582, "uuid": "17c3a9df-8435-4243-9e55-a721d9aca7de", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629582, "uuid": "b4202a55-aa07-4355-9807-a93a091aa9a7", "value": "98304:eU8Qy5HlfLUNj8eL/ynHGDame4yZadocqx/S4y:v9WfLUWeL+GD3SZi+x/hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629582, "uuid": "8878d56e-4ed0-4180-a44e-bd5932494c1a", "value": 4064712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629582, "uuid": "0551adee-e1fe-44ac-b3d0-ffe795f300eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629582, "uuid": "ab07843e-4e9d-49a7-8940-388b0c4187e6", "value": "RunGame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b895a5-94a7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620825, "uuid": "59e8467a-388b-481a-b1bb-3b67f9a15cbf", "comment": "Malware payload (Heodo)", "value": "00c1b44a69a9e4c0a4179a64ac8411e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620825, "uuid": "707aac02-2dff-41f6-a28e-7a55286d5b7e", "comment": "Malware payload (Heodo)", "value": "78e2d1647a75eab7b7556418b85ac06f13e851a9cf66255177c18cf084b2f23b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620825, "uuid": "fa409f9b-9297-478e-8872-546b26c236bb", "comment": "Malware payload (Heodo)", "value": "1967f09c423dfc199c11a39d7ba5f557df70a332", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620825, "uuid": "6c09eab4-f36f-4c99-8ef8-b52aa9a35bf7", "comment": "Malware payload (Heodo)", "value": "67c0638c16e8753305ddd6ae546f54d7b7be0ec781e02ceeeac2b9cf723fdd187477eb1ab60ecb3311a1db12c02b7e67", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620825, "uuid": "a6192ed3-43cc-4aed-989a-9dff7c30ef71", "value": "T1EA35AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620825, "uuid": "0823c9b1-901c-4aaf-b0db-52d1ede61683", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620825, "uuid": "f1379ee5-7d62-4da4-9314-36a9ffc8344e", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNNTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNNT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620825, "uuid": "5bd91fcd-a817-4ed3-af26-6f37fce0bc2b", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620825, "uuid": "1b08b9e9-d7f5-4794-b748-5a0edbe1196c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620825, "uuid": "0fa379e4-164e-47f8-836f-267137c0a3f4", "value": "XN3F2IX5w9J0HCPJsHR.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce5d8c0-94bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645630989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630989, "uuid": "5f52dc71-b615-4e5f-94eb-03fc93a511d8", "comment": "Malware payload", "value": "58b6696496450f254b1423ea018716dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Equation group", "colour": "#735DDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630989, "uuid": "e4b5c073-7431-421a-b917-d6b8619a12d0", "comment": "Malware payload", "value": "7989032a5a2baece889100c4cfeca81f1da1241ab47365dad89107e417ce7bac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Equation group", "colour": "#735DDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630989, "uuid": "cf6bf720-146a-404f-9b03-ab79930d67f6", "comment": "Malware payload", "value": "ad0197db424b35314a479552875e18893a4ba95a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Equation group", "colour": "#735DDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630989, "uuid": "223e4f86-fc15-4dc8-9d8f-ccb116971bb1", "comment": "Malware payload", "value": "4af985a34adf9506dd20289098a20e91765c8e178c972821434e92147b41c92f00378ec6fcb06d93b86562072e095c04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Equation group", "colour": "#735DDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630989, "uuid": "dccf1f65-8992-4c73-9870-33b7f569465a", "value": "T14A54CF56920390F1DD370170224BFBBF4B61A232F411CEE9EB849C6AAD77C92761E725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630989, "uuid": "59cdbc59-4a6f-4943-92d8-ceeca38c3d3f", "value": "6144:QY+fTAAWqZgyjxquUHc6/AXaS0sap0YE1swVgCVwk9jSbhY0:QpfTAP2jxquUHc64XaN4CWgCSk9whB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630989, "uuid": "a109483c-2cc7-42a6-9ffd-48e99a11f576", "value": 299148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630989, "uuid": "67c0ca85-b365-4c09-a626-1aca97c16a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630989, "uuid": "45c9f20b-d329-4151-958b-b406b255c9c1", "value": "7989032a5a2baece889100c4cfeca81f1da1241ab47365dad89107e417ce7bac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b13f31b-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645619416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619416, "uuid": "1a71885c-942b-4dbc-8c57-cacf0576f7ca", "comment": "Malware payload (RedLineStealer)", "value": "e0149b299e7295b128b1718310805095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619416, "uuid": "9211266c-b50d-4e74-b7fc-1f9c41ebeb41", "comment": "Malware payload (RedLineStealer)", "value": "79fa3363eeb543f7b97729d016d926820156b2a549a78000899a2a3b44721c8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619416, "uuid": "03cfd47f-1128-423e-82ea-c5c772022481", "comment": "Malware payload (RedLineStealer)", "value": "ac23422e9538504f173a9e9fade0dcef6facd4a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619416, "uuid": "7ab4aa4a-8f98-4c47-8f2f-ef4e1288ccc0", "comment": "Malware payload (RedLineStealer)", "value": "e5548573fa347d436573db8da9cd4c912c27e3209066813d465a3f42c7778ead68137a9fb531c9bedf29c584c9400d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619416, "uuid": "2988959f-7bfc-4c49-92dc-5d456bde9144", "value": "T1ACE4F110B790C035F1BB02F4897AA3ACB52E7BB15B6550CB66E556EE5A347E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619416, "uuid": "a954af41-7749-4d4e-a0cf-87209581d599", "value": "32f2c538eab8007c123c6eaeceead9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619416, "uuid": "13b05bf8-d754-44ad-b692-4b228e130d9a", "value": "12288:iyGWYLmIp77GuOgYGAvJH4/m+mFb+oo8nwhLfL2W6o:be77GV9pp4/sHo8ni7qW6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619416, "uuid": "72a1cedf-a99d-4026-bbf6-99f47fbe8ebd", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619416, "uuid": "8f51233b-1d90-402b-888e-f56219820aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619416, "uuid": "aad5c4ac-c0f4-4bf4-9a8b-dfb1131d8421", "value": "e0149b299e7295b128b1718310805095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b382f8-949d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645616401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616401, "uuid": "4b9721be-eba7-4fa3-bc86-7330542aa1e7", "comment": "Malware payload", "value": "d0fdfbc23e8063b9d92e4fd603007d94", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616401, "uuid": "183e1c6d-2eb3-4a7e-a9f8-91012099670d", "comment": "Malware payload", "value": "7a3d393811d8f34814f3074f8466aa7d15b1a96c6286bd52f471ee9f14e1c336", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616401, "uuid": "a6e5aacf-696b-413c-a0b6-e71c5b9b7cac", "comment": "Malware payload", "value": "044217ac993e24116ab661bb2b9058673240a7f2", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616401, "uuid": "bba0d4b7-8797-4b03-884c-2139dd895c26", "comment": "Malware payload", "value": "57c7ae90efde42825acb1490b48859a14d35a699a1bc16a4e70c693171505e54aa5c057602af8a1fa93f7fd427e9ad96", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616401, "uuid": "9dbe569e-e82b-4314-8daa-f8ca772191da", "value": "T14123D018C592265AC673243EC478D8D04965CC17B12185CFE5EABE8F16E8ECB274FBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616401, "uuid": "14cc033b-50c9-4b1e-abfb-77541322fe37", "value": "768:Y+hRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTK:Y+/JqHt7NJECQFfqA8eN5Zpm1/K8NytU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616401, "uuid": "aa2689d0-ff8e-4b0a-acb3-ab8a07d1ff49", "value": 47983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616401, "uuid": "24f092a8-054c-46ce-9ea2-60b89e816cba", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616401, "uuid": "5dfb368c-983a-4dff-ad06-95fb444d0182", "value": "RFQ Feb.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9e98cc-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633803, "uuid": "46db6084-5f13-4a3f-8240-ee4b89ad7774", "comment": "Malware payload (Mirai)", "value": "4f317560bea8072a9c3643deceff7756", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633803, "uuid": "93c4441d-0056-4a1e-a62d-e8f6dd4f86c0", "comment": "Malware payload (Mirai)", "value": "7a815745751525258471a5d16d4075e433e4baba3cd940d0aafa9b8eb9608438", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633803, "uuid": "0fbcb694-90d7-4cfd-bd69-bc86a66c64db", "comment": "Malware payload (Mirai)", "value": "66afd77cf8ef943b7933d1584ad112edc53a717e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633803, "uuid": "2a88baec-6a09-4d72-b7ad-16d69fbaaa58", "comment": "Malware payload (Mirai)", "value": "d96bbca4bee7ec24c7df507dddba7fdf7b615378359f8cdc93caf8f70fed1806e4868c6dd421f30e535e36aa3c674e06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633803, "uuid": "b2b5ae53-1b91-4172-bd50-446930cc61f9", "value": "T16D933A86B880DB24C6C612B7FA1F118E330247ACE3DE72538D149F6477CA96B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633803, "uuid": "635734cd-8bc2-4fca-b2e6-7dc1d18876ea", "value": "1536:ZjRn755PpsZtFqE6225NpQmaYoLmpMguHcUZDVUHalw7WEuH0fsfClvsLpvBbCz3:Zt5Rp22LB5oLmpMguHcUZDVUHalw7WER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633803, "uuid": "835c7501-81da-42f6-83e0-95e2b90c272b", "value": 91436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633803, "uuid": "339697b2-5bf0-4a48-8902-1b46567df7ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633803, "uuid": "39594e5f-eb26-4800-968b-93a818a2ce36", "value": "Zeus.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae567d7-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645610987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610987, "uuid": "3cc92f39-b3a5-47a4-8331-b6266f016e89", "comment": "Malware payload (Formbook)", "value": "36dbecd61527e45c5a536a61f2ec0e44", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610987, "uuid": "846f547d-b3c7-40e6-83b9-2b249160ee26", "comment": "Malware payload (Formbook)", "value": "7a9925480e879e79bbf7babe40202f4a3de087bc7d4a044f4be44d910a63a890", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610987, "uuid": "3377533b-62ec-49ea-b418-19a9bd5fc3ae", "comment": "Malware payload (Formbook)", "value": "aba41d5e9c4d81db8ed46780fd1d7fef7c6036e2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610987, "uuid": "7b9be9eb-643c-448b-b297-32d9f72cd849", "comment": "Malware payload (Formbook)", "value": "d46dd3671891cf9671301bdf46d33d7954338a6dc16d855564bdd2237d729cd5138a12133c53a27240ca21f2691f8192", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610987, "uuid": "4f72e526-ed88-49ec-ba7a-af12f3861e84", "value": "T16D140268A6249738F56B69F4F281C64DE2BEBCA14E0279615C4FF1D1CC3F6ED4483491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610987, "uuid": "ae314a00-0bde-48c5-aed6-81fd07846086", "value": "3072:f/ofueIAJpb9+NdJWZkwPg+WFDI4TiNNyQo+xAXlCB6Xu8j3m5SStIH6ssbjNu9Y:3oHIAJ9YFCgTtI4uNUKAXnXJj28StAhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610987, "uuid": "9a8b69d9-1fe1-4e30-b239-4836878a13fa", "value": 191288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610987, "uuid": "95d419f0-4e0a-4863-84ca-cbf947b5200f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610987, "uuid": "42e18b0b-df0d-4882-ac1d-2cd9bb56021d", "value": "voicenote.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b14b4d-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633824, "uuid": "5d5b0cd3-2bc8-4518-aede-b92338329f48", "comment": "Malware payload (Mirai)", "value": "acff20e18454bc0046375f6f14667429", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633824, "uuid": "98158e9f-b9eb-41cf-9d61-da52f2c7b241", "comment": "Malware payload (Mirai)", "value": "7ad30065af9f9c909192c14f7e22cb345d136c017878ff4675ad632a530a378b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633824, "uuid": "fef41d81-d0b8-4071-9cdf-be905e2955c8", "comment": "Malware payload (Mirai)", "value": "c2eeac81ac9282f91c31e12618d7a40168334ac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633824, "uuid": "974f3ad5-8018-4571-bbce-306fda4554b3", "comment": "Malware payload (Mirai)", "value": "0e940048ff38fa7aa34e0be4a97e1e2fd3be71f93b47d0032028c2f6afa1f93219fdc1bd85d88fca4c1b4e18de5319ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633824, "uuid": "c379a51f-e45a-4da7-80c4-546c4da80285", "value": "T118A3B40AAF711FF7E8AFDC3309EA1705648D551A21A97B75BA30D918F20E24F19E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633824, "uuid": "3ccb841e-8be5-43c6-8d24-25225fa0d7f6", "value": "1536:9x7f4BjtBD2FOlQw3SV5PDaIDP6SBvhZWUQ/hi9Dm8:f7f4ZtBDPlDUvhRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633824, "uuid": "fa2c790b-cd32-4b7c-9575-0c32278bfda6", "value": 98896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633824, "uuid": "5606ef45-5e3c-4f7b-a06e-480fc1643dd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633824, "uuid": "9affa948-bcd1-4403-b61c-4a3fe17aca11", "value": "Zeus.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa61d6f-9464-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645591936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591936, "uuid": "c7a3a1ea-f0e2-433e-aa24-1a401d41b920", "comment": "Malware payload (Mirai)", "value": "73aea66a01d26862f01760e44a77e2b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591936, "uuid": "3462d398-8c42-481b-b74e-f706e862d546", "comment": "Malware payload (Mirai)", "value": "7adea4a1dc84ce0df8399f1ba27940d270032341e36ee29ff9ac4c15bf49a9ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591936, "uuid": "85e49461-14a2-4ee0-9bff-300edf684c52", "comment": "Malware payload (Mirai)", "value": "c225fdbc2583b46cd5b051ff7aa2fc1021584e73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591936, "uuid": "1ce700e4-fb8f-48d7-8481-cf59346b676d", "comment": "Malware payload (Mirai)", "value": "d17cf4d51abff4289542eaddfaf099f1403226ec8bf60eb38183cbb797b932aa69820d0ac5aea57e9088bdc3d749b09c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591936, "uuid": "5ec452d5-769b-462c-ac4f-005e4017c057", "value": "T16C03F238C1A35977F2B02C78B5B410E2A2FF3B79500574E765E52EDA29E01435FF89A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591936, "uuid": "ec114390-9b31-4d09-b8fc-7b5da2288ec3", "value": "768:p6p5gTiWiC4yiKMW7uB6B+jUVmJjP3kZq37FNY5K8pJk1sr9q3UELfw:+5ihb4yiDW7uB6BMIObx37cRclLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591936, "uuid": "f1800012-3079-4d5c-9b13-8599bd21e4ce", "value": 38584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591936, "uuid": "a74f0840-82b4-4b47-9bce-bca99c22173f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591936, "uuid": "4f1740dc-cfe4-4a22-813d-cd213dbef3fe", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.8696.18970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94349f0-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633828, "uuid": "d2ee4644-66c9-4cc1-9ff8-72b7537bd5ea", "comment": "Malware payload (Mirai)", "value": "cf347a515fce5d0da4f701c9513c2ec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633828, "uuid": "39159139-47a0-4aa7-ac7e-0107227e8a10", "comment": "Malware payload (Mirai)", "value": "7afe94bae6ec907583be7127e835081ef0c74282f702e0396b8d110314176d65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633828, "uuid": "35ad3ff8-982b-4e80-a39b-2823b13903a8", "comment": "Malware payload (Mirai)", "value": "30acabd0d7ca9e5076df02fadee5a36c6a8fe234", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633828, "uuid": "61b4a84b-5088-41c1-aaa1-a4df41e29ac3", "comment": "Malware payload (Mirai)", "value": "25d9fd114d21f43106076ec05f2c83c0e33c31883b2e7e9dfe3ab33c6f7446feb384cbc859afda674b01b593af49bda0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633828, "uuid": "f1a83e8b-3f52-4a7a-bb67-2f0de3288f36", "value": "T15A735B01B3588A07FA962DF4283F2BE153BEEE5015F1B685684FD70A4231F73556AE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633828, "uuid": "1fbcdf6d-442b-4a9c-9a42-9a871070420a", "value": "1536:iDIxR/Pv5NdVU/s11WKPVGFSn8sCRpGfREIxI6VfD/9YY:mIxR/Pv5NdVUWownLCR2xIHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633828, "uuid": "74c9ff92-e8c0-4c2a-a6cf-ed8bcec81840", "value": 74840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633828, "uuid": "7192e54e-5a3e-44d1-b96f-974d88030b60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633828, "uuid": "4a511b5c-180f-4d6a-acf5-21dab780bcf9", "value": "Zeus.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3381758-94fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645657333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657333, "uuid": "24e4e098-6d62-410e-95e6-0ff7d09657b1", "comment": "Malware payload (Heodo)", "value": "e26b34072fad69d1ae00c330e5769e62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657333, "uuid": "b45aa23e-5eee-44e9-bd6e-3f474b51a321", "comment": "Malware payload (Heodo)", "value": "7b08b7ca77eaff4804a40b6bacedeeb3591d18be25a071ef6863de8e5e79a6fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657333, "uuid": "4c08a0cc-21a5-4cda-8879-41b2fdb2c739", "comment": "Malware payload (Heodo)", "value": "46820888e224d3c70b86bb2e8292ea317579c4d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657333, "uuid": "135efac9-0d42-4a6e-b598-d4e530332cd2", "comment": "Malware payload (Heodo)", "value": "7ce04ff07b443617fde9fc7f8563a9991c5c21a7c6935b7f343f6abc5189ccc5d54263c51649375153efc54203699509", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657333, "uuid": "27e20d4c-ab39-4896-9048-66cf876a2c0a", "value": "T1E1E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657333, "uuid": "446692d2-ef93-46ac-b808-ec891e05efb4", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657333, "uuid": "696788d6-4d90-4299-9c00-6b3339780153", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0dhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfvPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645657333, "uuid": "314496d0-f765-4197-ac70-e183ee78a1d5", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645657333, "uuid": "b460fc4e-d4ae-4b32-ae1f-d73e7e83b1ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657333, "uuid": "df88d897-0586-49f3-a031-370e68df2d34", "value": "e26b34072fad69d1ae00c330e5769e62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3605ea2b-94bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645629232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629232, "uuid": "068cb700-7ba2-43fc-aaf5-f84b7424eabc", "comment": "Malware payload (Formbook)", "value": "61e064dc883c80dd132ca307a82ea29e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629232, "uuid": "47183b95-aabe-433b-b701-a626c2d60482", "comment": "Malware payload (Formbook)", "value": "7b4b92d6eefbcabd5c2af244e8f048e5d11d1cc2f0c967ff244457aae3844adb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629232, "uuid": "839eef67-296d-4966-8d95-e9374dc02854", "comment": "Malware payload (Formbook)", "value": "00cf60c3a49581ca218be378138c94a5e7b0e209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629232, "uuid": "6a5933c6-4442-426c-ad17-eb65d59838a9", "comment": "Malware payload (Formbook)", "value": "77c2d872dea325b07c9abbf47036988415f915a7bac97347b4bfb77800d9c0a51891d9a10f604343912a58e7d80244b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629232, "uuid": "18c51e36-5425-46b6-a0aa-94704bf7f73a", "value": "T12605D00439A74F3DF0B19BB24DC5EC74FA9DFB232C08B37D78556246C691B9049826BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629232, "uuid": "8eaba608-a7e9-42aa-a331-45e629ffce42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629232, "uuid": "c0e8e0d9-15f6-4468-9d28-c51984b666ce", "value": "24576:VzK777777777777MLJkbgo7/H0rSuWW+8wmXrDWxXy:k777777777777MLJkbgo7MrfymXrsXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629232, "uuid": "a6ff094e-b89b-4bc7-a928-664633c816cf", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629232, "uuid": "b561554a-b0d1-4ec0-a10b-a11609af7999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629232, "uuid": "b0b2a69e-07e3-489e-848a-6135ad6e8df9", "value": "URGENT REQUEST FOR QUOTSCAN COPY_PDF_______________________________________....exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed9937f-94be-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackCat)", "timestamp": 1645630562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630562, "uuid": "18609cba-c5ab-45f8-a642-60d42a4ac4da", "comment": "Malware payload (BlackCat)", "value": "0a4972d168134c2d103e8e1424ef1501", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630562, "uuid": "cb475932-5f02-425e-8be9-4c3f57517ed7", "comment": "Malware payload (BlackCat)", "value": "7bb383b31d1b415bc067e612203cc6bda53e914f7ca5291299e92f59d47cabf8", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630562, "uuid": "5e5aff6f-5646-4c01-b126-933ce841fc72", "comment": "Malware payload (BlackCat)", "value": "2f5a40010e455c51e2ff59e2624f46a2563b00a6", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630562, "uuid": "aa576987-3a82-420b-9c60-c697e368f668", "comment": "Malware payload (BlackCat)", "value": "3a8c542fc6c0eb26e5756fe9b41a351d498a1479c3580e6f1667a412dd6e73a1eb1562e2154f00a4710dbfd3b0938715", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630562, "uuid": "c9206fd4-9005-4e63-8580-1573d4d49ab1", "value": "T1F1E5AF4EF99392EACD571A70389EB33AD6304918011D9EA3E7FC5E24BE3E71059C861D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630562, "uuid": "993c314e-1d0a-41d9-8c1e-e728841ad3bb", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630562, "uuid": "c863698e-ac48-4b07-8daf-4b74e2f9be95", "value": "49152:4dwE1vCCeShiBHJFIPiEPE3bvk6Ca89388YhwjfJNH/RgaJ2wtb8:WwE1253IPiYE3bnCa8Hzj/vwwtb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630562, "uuid": "be0eb5ef-7adf-429d-a348-367b0e6e430e", "value": 3073547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630562, "uuid": "f0358cff-a485-42c6-afff-e54c5b009d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630562, "uuid": "6600f40c-906c-424c-8ebe-66fb9f78597e", "value": "7bb383b31d1b415bc067e612203cc6bda53e914f7ca5291299e92f59d47cabf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a05ebfa-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620300, "uuid": "cd2a4f6c-1a26-452c-9ba4-11568b848535", "comment": "Malware payload (Heodo)", "value": "7938aacc6aac70567f510850657dde63", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620300, "uuid": "88a9f7c4-3c54-485c-ae7d-ca154a32f503", "comment": "Malware payload (Heodo)", "value": "7bc5282c2563075391c2e5218a9e78bce832181fc488e454499e9033be81de6b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620300, "uuid": "79ef1a6d-556b-489a-b511-8755d513d81c", "comment": "Malware payload (Heodo)", "value": "c08c7a75b0349a8372cd2e0885a3791e72c67dce", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620300, "uuid": "7933d8d5-54e7-48e1-bc28-f1928124efd2", "comment": "Malware payload (Heodo)", "value": "cf1b5d7cd028cf0ad8ea14615fba0996a1afc567b2ac34ebd357fa43f643236a1439fd54f4ed2fa49c8acbe0cd4f25e0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620300, "uuid": "942d679b-52d1-44db-87bf-459bc36d57ce", "value": "T15553184ABA4A991DE51587358CE747E96732FC104FAB0B873A49F3257FF99D04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620300, "uuid": "cf9b4aef-f234-4c3b-8836-f56db0e3d87f", "value": "1536:sp+KpbdrHYrMue8q7QPX+5xtekEdi8/dgJ5+4kKF3XOCmGanK8oWIq:sIKpbdrHYrMue8q7QPX+5xtekEdi8/dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620300, "uuid": "7fef0e7f-7ec1-4a11-bb75-b571fd5d1b6e", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620300, "uuid": "2d64d429-6ccf-461b-a5b4-4ed371c07827", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620300, "uuid": "7224729b-050b-486b-b564-62a13025477a", "value": "DOKUMENT 371528190.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a3b11f-94a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645617816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617816, "uuid": "767c57d6-5695-4ca2-a8b8-560e5a869f2d", "comment": "Malware payload (Formbook)", "value": "00b429a954694c1e25e2bcd437a1b6d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617816, "uuid": "b13e452f-4343-458d-ba85-46c61f1ed50f", "comment": "Malware payload (Formbook)", "value": "7d7ddc78a2b3b293d02ec1038c1583cbfd86085d3ab443b34c8d6e09c4993ed1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617816, "uuid": "b3787cce-bc7f-418f-a602-17800d06aebb", "comment": "Malware payload (Formbook)", "value": "0d48fdb46206ed4693d3d72d588beb46af7c492a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617816, "uuid": "95c7352d-b47e-4995-b881-91f6b24a327d", "comment": "Malware payload (Formbook)", "value": "54238042db30525c94804fdeff431cdd4cd9280a4211006f73a3ef14d9373f5ecb8dfeb3e5dc6466926c518747a36f0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617816, "uuid": "11b1a3f8-f93e-42f3-874d-b4ea961cc4ae", "value": "T14F05CF4839A75F3EF1B18BB21DC4EC74FA69FB371C08A37D78512296C261B40994367A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617816, "uuid": "c3499cc6-ae43-4863-882c-898c6db346e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617816, "uuid": "b69a4ee8-3931-476e-8cf3-f103a2cf6667", "value": "24576:mCK777777777777fu0aNJU98Z2sXIH7EzL2JgRW+aOy:Q777777777777fHaNJUTWTzLGMWlOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645617816, "uuid": "dd285d31-a155-45cf-a168-ab127f023bc1", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645617816, "uuid": "472a1516-80b3-4cc3-928c-01db3f48ed89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617816, "uuid": "fa9c8c20-6234-43c9-8e20-84aae5e1297a", "value": "yeni sipari\u015f pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f820f3-9464-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645591941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591941, "uuid": "16f9bd57-dc2b-4873-a700-62abb3a25f9f", "comment": "Malware payload (Mirai)", "value": "c09d066e4a8338027c64e19e45f75efc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591941, "uuid": "69eb9612-899a-4c8d-951d-1be0fa41de5b", "comment": "Malware payload (Mirai)", "value": "7d8e484ec49b839fd5c967692125264561d90f92ec2fcd32de7a089f39593044", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591941, "uuid": "cf8d7b4e-aeb6-4c2f-86c0-e58eb0794f8e", "comment": "Malware payload (Mirai)", "value": "f8e3ca0228caf607cf119dcaf039a045dd2973b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591941, "uuid": "55f21de1-32ae-44ed-b069-a7ce44737284", "comment": "Malware payload (Mirai)", "value": "8b1b7e47e5ffd62ba6c405e971e29aec93a760e27a10d95a1e10d81f978de84e95cb68e28ab73d6ec1881a7cdaf9cf8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591941, "uuid": "378ac0d6-021f-4ac9-a3d5-fec81ec212bc", "value": "T10EE2F12095296C32C4708676E9BCCB4292D121EDF535347684388F74E46668B5FF1FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591941, "uuid": "7725cc65-248e-457c-9af1-8b007daf4eeb", "value": "768:IImDXKxdPYvDspwUtU0DEfGXGF8w0Voavas3Uoz6:IImLKx6vApwUtU0AF8savz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591941, "uuid": "c3b44821-a05e-4335-8ff8-c751c5ef0561", "value": 33332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591941, "uuid": "c8e49b0b-45b6-4a32-834c-29d6104b1a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591941, "uuid": "45ffedce-4e0e-4f7a-8c7b-fc6bb25c8073", "value": "SecuriteInfo.com.ELF.Svirtu-AATrj.7494.28673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b608cb53-9486-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645606684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606684, "uuid": "82ca8a81-2a33-4f42-861f-443f0309f560", "comment": "Malware payload (Loki)", "value": "02ed8526ac054fe86cd0ce8433a2eb38", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606684, "uuid": "ffd67c6b-5151-40c9-95df-6f21aa8204f5", "comment": "Malware payload (Loki)", "value": "7ea31c41f9dbd2373ef2dbe2abdad8e95e4c697f114180c120c45ce9fc394722", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606684, "uuid": "236e19a6-8bee-434f-bbbe-a76629c9c383", "comment": "Malware payload (Loki)", "value": "4a7c1eafb29fc3f100f4620a1427e4f9369ac333", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606684, "uuid": "3fa3e7b1-f8b4-49b5-8bef-ea8b1df21b16", "comment": "Malware payload (Loki)", "value": "dc653e6cb9d1707285d008ddb1a3793b8295966fbde6227ef1738125182bdab3b25153f5614d31caea6bf0b877bf2d05", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606684, "uuid": "b8831735-ba2c-48bc-9d0d-16e8f18fc9d9", "value": "T1C81412582F93CEDEE69176BC6657C0E4282BFE32F8A2C63562047E1505B3C58CF921B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606684, "uuid": "299ff775-d689-4633-9a71-4a5af2f5ec32", "value": "3072:giRvX5OggZefZrU6DAfKH0K0aSAq6Ae6g5AVjApDThoseQwmwT8GZhvxgoPYtyRE:7R/5OzQ46Uf3K0aSGAe6g5AoThwQqT85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645606684, "uuid": "6f2c2079-4756-4321-ae3f-5fd57df0d48d", "value": 190872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645606684, "uuid": "0a99f22d-e4f7-43ad-b833-59e1d681b685", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606684, "uuid": "831873fa-b58f-4c1d-b07c-ff379b55ec5b", "value": "MT103_Swift Copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f3c636-94b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645626788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626788, "uuid": "a6b64a0a-f450-4932-8746-e47186c2a16a", "comment": "Malware payload (Formbook)", "value": "6e2c63c5921d1d776e4d5d9ae35a6984", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626788, "uuid": "c4fbcffd-bb26-472d-b038-5bd2ce66d317", "comment": "Malware payload (Formbook)", "value": "7eb60b42eb8755d31d411c32b45f7431eb9e084fb0749d92c83ffe2598b6564c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626788, "uuid": "96a44807-02c0-4e0f-afd9-61c242c4ece0", "comment": "Malware payload (Formbook)", "value": "d8eb1e9ca3ab413949d5fe873e28719680406b09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626788, "uuid": "1d9ec1a6-b3bd-4414-a2ef-c5559bfc9fbf", "comment": "Malware payload (Formbook)", "value": "ea1a1652ee5c7cde00a911e997a6470e02ee063114e7f7e1a867f81dea853be923c39b919cebe6956c4ffdc338eb4b92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626788, "uuid": "c002d95a-854b-4eac-a670-a8d793e0b386", "value": "T1BCF4232E2FE840C9D1A50E37E7292E529988BAD0565DFB5F04C960922413F35EDD2CFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626788, "uuid": "ab20d9da-72e6-42fa-bd92-1c5b0deb7cdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626788, "uuid": "9dab7439-6ee4-490d-af67-3dd9a4558781", "value": "12288:ICxPK0vuYkgmWiGXsT24YlBo+ElAZvtd8tsfNg1F0IrM3RGyM4eiK1XhFKt1S3bk:ICs02HKTHPE8dDc++fvY3HedC7Sra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626788, "uuid": "f253060f-bb54-4f2d-83f6-0093e7c33793", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626788, "uuid": "4851ebde-15f7-4e8e-b391-812d8339c80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626788, "uuid": "3189c5f0-1855-4db3-9bf5-a582106b26d6", "value": "6e2c63c5921d1d776e4d5d9ae35a6984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffaa908-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645619532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619532, "uuid": "394f3f4a-269c-4875-9ac2-e0d0c9f5021c", "comment": "Malware payload (ArkeiStealer)", "value": "1509f47c51c2418eb1f7bdff583a1c65", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619532, "uuid": "014ac08a-a110-4c17-a14e-e60f4e4af580", "comment": "Malware payload (ArkeiStealer)", "value": "7eb856072b72ec289be32ed29ba6145687602ee1c5fbdf6b19cb2bf2fbb2da4c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619532, "uuid": "61c09835-d771-43a9-9abc-1d750b1b7266", "comment": "Malware payload (ArkeiStealer)", "value": "6587e6db073a16f5022c0fc70a3a5d2dd9b7f187", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619532, "uuid": "95bc5f11-25d5-4877-921b-74bfa208892d", "comment": "Malware payload (ArkeiStealer)", "value": "1c04dadef03bf98dec3553138548921d9ac8aabf97476652d881bbfe2cabdb2cba6ff01953771b7a03165ba4338c2d0e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619532, "uuid": "5d564a63-4eaf-4443-b9c5-4f3de7c93ded", "value": "T1FAE401E17181E531E051FE35857ACEA20ABFAC42DA549207F6746B9E3E323C5172A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619532, "uuid": "a0986119-ebc9-49a0-ae7f-fbff486a47e2", "value": "622aecbc6a87e451af6fafa81e56b136", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619532, "uuid": "4ce511ff-38e5-4ebd-9fe4-264b58928bef", "value": "12288:O9mNQijobSinV5B8EhzLrtpE4G7IL07ComQp+vxKCD7uT:O9mOijoblB8GvrtpOI8pQgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619532, "uuid": "f61516bd-494a-4c06-82ff-5380f41d4bf9", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619532, "uuid": "582b65a2-4188-48b6-abbc-bc8660fcc13d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619532, "uuid": "6f7166d2-5697-467e-b4f7-7a7bda813538", "value": "1509f47c51c2418eb1f7bdff583a1c65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37ee131-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633845, "uuid": "0512baf9-bca2-4281-9978-63f59cebde4b", "comment": "Malware payload (Mirai)", "value": "f1d06583b95fba50cf547f700b4f51f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633845, "uuid": "dba8b5d1-b182-4b97-a950-80b12f0d23a3", "comment": "Malware payload (Mirai)", "value": "80388980fbe4307878f2670e5b2b6451052ee7b2c32b38920f4833816b1fd2be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633845, "uuid": "0fe45b24-ebbc-405c-a9f9-b26c8b348b6b", "comment": "Malware payload (Mirai)", "value": "8a9cfdc74eb6ecaf610e3ace7f4425528e283310", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633845, "uuid": "edfae4ef-9c8d-41b7-aaa4-9b70cd300b9d", "comment": "Malware payload (Mirai)", "value": "a95b9ab429a18318e25612d13f5392686cdc0e62d607be73421bf8486b1aefd407f86b33b5286b87328b2b3bbc57cb8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633845, "uuid": "f9962367-7da8-43fa-86eb-4d30cdcf2ef2", "value": "T182632ACCB183E8F6DC50057E346EAF729EF3E63EA176998BC3E4553B9501202910766E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633845, "uuid": "2e73e101-6235-40c8-ac8d-a98547c30ba6", "value": "1536:lm1gZVASriHNJ64LG40WH9SW5/0l6Xt/ruT9zzn/G:lm1gvitJ64LG40WH9SW5/0l6Vrux/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633845, "uuid": "91de84e2-976d-4e3a-84fd-64371b4fb745", "value": 71344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633845, "uuid": "3bcad9ca-81e2-449a-babc-9ab808a8cb82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633845, "uuid": "1a443764-dacb-4663-924d-f12e42f58f57", "value": "Zeus.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093abdc5-94c9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645635170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645635170, "uuid": "7fe6f140-4078-41f2-8a13-f9913aacf307", "comment": "Malware payload (AgentTesla)", "value": "f0d5efbf0b343a0a268d4fa56d5979bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645635170, "uuid": "e945fb76-8127-43e0-91be-5338ffc13755", "comment": "Malware payload (AgentTesla)", "value": "80712b4089c87dcf156c53419eada7ac68e63c97eabbb6872ae2ad611057f6c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645635170, "uuid": "fd624947-c666-4a43-9cdd-3a20f17cd70f", "comment": "Malware payload (AgentTesla)", "value": "69cee26cc447a8dd7f4c7c03a3102920aba2980d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645635170, "uuid": "e9070611-a9f7-41e2-8f3c-44757b329d29", "comment": "Malware payload (AgentTesla)", "value": "1c2e0a4b6d829577fd9d7db802101742b0f1fd60dfcdda1c26aa41ba84ac2c3ca8a0d1a36a7745b48eba1bf8ab98d5e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645635170, "uuid": "5d8a0267-0f92-4b3d-bbf2-124898963f4c", "value": "T13905C04839AB1F3DF1B18BB21DC5ECB4B699FB271C08B37D78516246C691B808982777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645635170, "uuid": "44d01f38-aeb8-42f1-87cb-e7de155ec50a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645635170, "uuid": "9fbd959a-1585-4be9-a1db-4514f08030f8", "value": "24576:/K777777777777XFRDCJwQvE+Knjqn9mx/g0iGvr:i777777777777XFRq829mxLic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645635170, "uuid": "4b409700-e05b-412a-ab6b-3f3da79b7660", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645635170, "uuid": "9d839ce6-8616-490e-948d-348257e8ac38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645635170, "uuid": "2c06e400-b991-4e04-80f9-6ce4daf38d75", "value": "Purchased Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eff302d-949e-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645616792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616792, "uuid": "eb2ac0b7-77bf-4faf-8952-0863f739b7c3", "comment": "Malware payload (AveMariaRAT)", "value": "ae5587f58d3832d52ffe321c7be00b5b", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616792, "uuid": "80afc72a-2b34-4d6c-874e-8af50ce7daf5", "comment": "Malware payload (AveMariaRAT)", "value": "8085ce0eb0d0a7c435f25ce274ddba9f70c74403fe2f5582c8d2cd87312610cc", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616792, "uuid": "7b6cd384-c33c-4000-95f4-0457f5114285", "comment": "Malware payload (AveMariaRAT)", "value": "4d7ecb508e4fb801e3c8b53666aafa542d5cb6f0", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616792, "uuid": "2e1a00d9-371d-426d-bd40-5f79e8214b0d", "comment": "Malware payload (AveMariaRAT)", "value": "e5388f99961efdc16e3eacf71730cdaa8eb3e130c15b479797cf847b1f27dc80b99131d930841744366eeddb1422c4ed", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616792, "uuid": "d77496a8-6f1f-4716-91c7-9f52f877accc", "value": "T1F223D029C5411546C6B36C3EC07998E119A69C47712A448FE5EE7E8F07B8F9B230FBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616792, "uuid": "a73629d8-fda0-403f-ad1b-94a9611453ac", "value": "768:e+TRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTy:e+FJqHt7NJECQFfqA3zCiDdV1/K8NytD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616792, "uuid": "cb00fc04-5ba8-45b4-b038-300ba25a6acc", "value": 47984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616792, "uuid": "55cabec3-b7ac-4d86-924d-4007d3e002d9", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616792, "uuid": "9d93e806-4389-40ef-9d09-6002dc5a3a2b", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14dcc007-94d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645642062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642062, "uuid": "61a752c7-5222-484f-87d5-80913e32070e", "comment": "Malware payload (Heodo)", "value": "942216790fff84e9ac548ee182710bba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642062, "uuid": "12ac64e3-8e66-4a1d-b1a8-d3c5fe050455", "comment": "Malware payload (Heodo)", "value": "809a8c36346ee4ec52676f3a82c4e540366165169da7546f55721907a338afa6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642062, "uuid": "604d7ab7-2297-48e1-b647-c7748706689a", "comment": "Malware payload (Heodo)", "value": "e5d0b9d37f797bf63ff8aaf4f89d245f0f777a0d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642062, "uuid": "5246a3ac-2f1e-4f6e-a11b-80b3ceccbe93", "comment": "Malware payload (Heodo)", "value": "5b3e45aa5fa49a78604a66b3b2693343d5448d20163b68f19bd8ca76215f7e870f06af6213c6d2a1bae970bec06a2d2e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642062, "uuid": "2650058a-07e5-44ad-8849-5d776488277a", "value": "T1BF93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642062, "uuid": "c1448ae6-5f43-411b-afa4-396f621e0469", "value": "1536:jQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:KDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645642062, "uuid": "5da38eaa-a7ba-44c2-992a-2725397f29f0", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645642062, "uuid": "1232c40f-5857-4753-95a7-c8c94b912ae4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642062, "uuid": "e99d442d-8008-44a7-adb5-ea7b6ee2af3f", "value": "OPAST GROUP.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da4fb1a-94f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645653834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653834, "uuid": "efcb3f2f-ed7a-4486-afcc-cf85a96c7f88", "comment": "Malware payload (Smoke Loader)", "value": "f556e6b16e85811de359115fa95f9fce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653834, "uuid": "fbe789a7-75ef-48b6-878b-617eccd8c7c4", "comment": "Malware payload (Smoke Loader)", "value": "81158169a9868527feaed169deb8e4cad232e33721a96075797d86fc1a782142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653834, "uuid": "8fe1a730-95c4-4217-9c2d-b7a78fd81433", "comment": "Malware payload (Smoke Loader)", "value": "a055f68ab7b2d53e81aa77e3a3820319c6b25376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653834, "uuid": "2d6a8eae-cc11-4eae-9b02-adf3e3670d83", "comment": "Malware payload (Smoke Loader)", "value": "8d393ca578e26048e5a6625ecd9a3f254cb6236d01ed20b22385754e9e5237e1e417136a3252ada187687db5b4646900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653834, "uuid": "fedf6ac8-f80c-419b-9a67-715c7ebed078", "value": "T17954ADE132D2E872C5D2B5718825CFF09A7AF831D9E1955733793B2F5E602C0B6A6306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653834, "uuid": "742002b6-2340-40ce-8743-4032e09a7900", "value": "28f93ef4de3d596c8c8216f36a80794c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653834, "uuid": "8944a1ef-6cd3-4604-9ece-43a0230548d4", "value": "3072:c3xQIPSmRPSn0jLX3fvlupZJdsCcBz3AEX0jCVggjcGkNIVqI:EtamRPSnujPMvyhXj7ITsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645653834, "uuid": "1c4a068c-fca4-4d68-a63e-747b5bf9bbfd", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645653834, "uuid": "ca56e4c0-9779-41a9-92c2-16ce489e2162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653834, "uuid": "ada4d442-e9df-4e4c-9b39-a5d0f169d1b5", "value": "81158169a9868527feaed169deb8e4cad232e33721a96075797d86fc1a782142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4431dd71-949e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645616801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616801, "uuid": "410de685-40e6-4f75-90ab-e8f015d64095", "comment": "Malware payload", "value": "e0bd943a5d9099b761cb8eab0fe03764", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616801, "uuid": "34bda9a5-8fdc-4413-ba65-0b0c3ec541b0", "comment": "Malware payload", "value": "8144c185a6f41f4536913498c3d649cac0b01cc668d9308375d38b963d91c958", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616801, "uuid": "e8780b1d-ff7b-4065-b061-0ba31c71dacd", "comment": "Malware payload", "value": "5764acf6718c729f0f13c4d4fc623dce7d0c9b94", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616801, "uuid": "bce23e80-550b-46ce-b70f-f1de8162fbd5", "comment": "Malware payload", "value": "f3c8ce435612b94d785bab24d378815b06e3e8d8547825196bc4a60072cb4a01da1798ecdd228b78db3abf93eee0f27e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616801, "uuid": "6c50b073-389c-42a5-b9e9-25873d80fa0d", "value": "T137165A32F345763ED49F0A3A9533A2509E3B6772A562EC5747F4098CCF3A880277A647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616801, "uuid": "8b76d383-aae2-4f67-a4cf-239702a80fe3", "value": "49152:9QP46OVrLotCTCmvp/SoJUqfhweXSOy16yXItvf1TSLuwNomEhYLEA:oFqXTV5SYyOo3rEhYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616801, "uuid": "2072160d-997c-4663-a423-b57254db3e07", "value": 4299264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616801, "uuid": "8c16f38c-e76d-4848-8e0a-2892f596eda4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616801, "uuid": "e29d4aee-998e-4374-8995-26220c2aeb68", "value": "EndesFact2302.Archivv2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd21485-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645622935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622935, "uuid": "b2e05fd8-6505-43c6-933f-5ce726c5e491", "comment": "Malware payload (Heodo)", "value": "25945a0633cf12ac2ea08b3a175bfdd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622935, "uuid": "586e2a28-780c-461a-b7ca-243341c7824c", "comment": "Malware payload (Heodo)", "value": "81724a588236810c2f302164aa22fe57dd3c20f8e8e053d049f1218d0a1ccb2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622935, "uuid": "c04310a4-8e59-44bd-9e8c-02d13aebc34e", "comment": "Malware payload (Heodo)", "value": "63b5655e046b3c2cb42aea25e1a3325e0f508690", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622935, "uuid": "1e29d86e-c456-47d6-9cb7-73641b8e1a20", "comment": "Malware payload (Heodo)", "value": "42e44fb548cd1086be5d34fa4a48bcf2f4417995e693ea615693de3565a6b13d62c81810ada6a4be2c496e9a96b46103", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622935, "uuid": "096f05d1-37e3-4bba-88a7-1ee733e7d853", "value": "T19935BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622935, "uuid": "7e92aaab-dbb3-43d9-8b93-d6e2868be4c7", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622935, "uuid": "b67c1245-a4a7-4157-8490-c46457735b22", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/PTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/PTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622935, "uuid": "fa609861-512f-49c3-8a3c-bdb1caabe3b9", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622935, "uuid": "a5e01fdc-e75a-4c5f-83a9-4d872a3a51fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622935, "uuid": "2694f826-4790-43ef-8b69-5fff1d8e5b25", "value": "25945a0633cf12ac2ea08b3a175bfdd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9399ef1b-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645622947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622947, "uuid": "1bd19cd0-bc45-4f22-b32d-c6566b222920", "comment": "Malware payload (AgentTesla)", "value": "44f05d81f361971156e543bdeaf04d86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622947, "uuid": "084eac07-2a93-4119-9b04-2dd81fb352fd", "comment": "Malware payload (AgentTesla)", "value": "8180549a22a72478ca6caf24424a9d84f597efa78f85d10d8c8dc32a37fcb04b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622947, "uuid": "4fd2c045-48f5-4d11-ab5e-6b460cc03f2f", "comment": "Malware payload (AgentTesla)", "value": "1b7817c1a6a3b6464c151515a74ac058a72a06b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622947, "uuid": "746d84cc-7744-4669-94ad-02c6721ef536", "comment": "Malware payload (AgentTesla)", "value": "bbdb0356e7b54d50dfaf6556359785ccd6e6b7acf644eaeb107bea9c61ba6a4860b3f938f7ec8937e38ee5dd872adda6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622947, "uuid": "d33ed387-e38b-4e0f-898d-844ed977b40f", "value": "T15E15D00439A75F3DF0B18B760DC5EC74BBA9FB272C08B37D78952246C651B908D426BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622947, "uuid": "59793556-2264-44bf-8879-799cdf99d173", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622947, "uuid": "ae0f671f-bdd4-419e-8486-87c88da95412", "value": "24576:2pK777777777777C+taFxahvFETbiNtDf7HWTy5W6OaOPed:j7777777777777wxaZFEXiNtT7HWTbaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622947, "uuid": "60bb1396-6313-4280-90ff-54b46bf331f0", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622947, "uuid": "dbed6fe7-04a9-4bb5-96e5-26d927f19c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622947, "uuid": "24bbdfe4-5e3a-412b-aafd-d350d29d24e2", "value": "44f05d81f361971156e543bdeaf04d86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb804cc3-9488-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645607632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607632, "uuid": "f1a7c10d-a44d-4f7f-8a37-adaa6adeffa5", "comment": "Malware payload (Heodo)", "value": "311d8f13142c6dcdc7fb783d9b6e6950", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607632, "uuid": "d66af888-c4fa-4335-b247-b91dcd6497e6", "comment": "Malware payload (Heodo)", "value": "81a667f96ab8fc23974d3db7eb6ca3922e0a175028fc4ecba3ed602e2b31c781", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607632, "uuid": "9f1c80a8-19f6-4fdb-842c-c92f23f039f7", "comment": "Malware payload (Heodo)", "value": "616c2f4ec095b2a75f609955f28c88258cea235a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607632, "uuid": "05a07e4f-d1dd-479e-b40c-c71eed4a3312", "comment": "Malware payload (Heodo)", "value": "d8534fbb8b1a6c4190332200bba9780be4245ec03846cb18ce929c3ec612c8d20b99309d51a792149420a8102badb905", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607632, "uuid": "e0cd2f0e-a002-4f81-9498-aa36ec2f667a", "value": "T10835AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607632, "uuid": "baebba72-83a4-4398-b1fc-f825862d0de0", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607632, "uuid": "fc7fb79d-1b86-4f30-84fc-f4b32a9e0ca5", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNyTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNyT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645607632, "uuid": "93fd0408-8481-497c-afca-a7e4da95e34a", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645607632, "uuid": "719cde78-1e95-4af4-a8d8-2f29be517341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607632, "uuid": "737f0366-70ae-4a44-a550-ca9232f9e342", "value": "S6Cf3goCNE72onUP0PZaapdz1P2K2CfBz.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d6e0d3-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633819, "uuid": "453da22a-e6b1-426d-831c-ed9dda242781", "comment": "Malware payload (Mirai)", "value": "1ec3bfdb62afb64f56400ea0897057ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633819, "uuid": "cebfffa5-5ae7-4ad4-a897-77eb2c8b1d34", "comment": "Malware payload (Mirai)", "value": "81cd862d919e91a71932a4cc4ea9e063f107e04c842008c295e328bb3e6ee34f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633819, "uuid": "890e62c3-2e46-44c8-adc7-2d2eb815746d", "comment": "Malware payload (Mirai)", "value": "8a412fcdee019a13957fb38934a75e3bc92c1ab2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633819, "uuid": "6d3dc06d-1e60-48f7-95eb-2065ac2603de", "comment": "Malware payload (Mirai)", "value": "11cb3574d0c79870e3fdfe747fb2dfb32db73d57552a8110eac8e11f0728dc0d7b358e51f97234868e1cdf4c07d1d9f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633819, "uuid": "93713ddd-94ef-4682-9ea6-9e2c4b460468", "value": "T19D93934E3E315F7DFFAC823987B78A10664923D626E1C584D19CED025E7038E742EBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633819, "uuid": "bcdccef9-d36e-4a9a-a547-79a6c7356bd5", "value": "1536:ilK/IGXvqS8cfnuCLJJTjUaol0v/HSdLvlLTqL0fsyJmbQU97aW3n:iyXSS8KnuClJT60nydtTqL0fsyJqTaWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633819, "uuid": "dbc2af06-39a2-40e2-bab6-eb344cdcc4ad", "value": 97360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633819, "uuid": "20f35f6c-f582-4356-9ebc-58970ecdf793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633819, "uuid": "8a27e348-0b15-4501-92df-541d8776ac16", "value": "Zeus.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119548f6-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645624447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624447, "uuid": "9ff8071e-abb5-4d94-8f8c-da0da0418f10", "comment": "Malware payload (SilentBuilder)", "value": "3a3504437869aaf46f12bdda37f60dc0", "object_relation": "md5", "Tag": [ { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624447, "uuid": "6bafb979-e43c-41b3-9a02-9742812ac0e5", "comment": "Malware payload (SilentBuilder)", "value": "822650904111645fff62438d08c732ad9b91dd5a194c6f2d3e9c785610ce3463", "object_relation": "sha256", "Tag": [ { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624447, "uuid": "b0ab363c-4bc7-4b45-9a7a-58d6c71eb58d", "comment": "Malware payload (SilentBuilder)", "value": "5e88d9971c45798fefee4f13e831bc64b1218b2a", "object_relation": "sha1", "Tag": [ { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624447, "uuid": "14a49b45-697e-4905-9133-e15aa17e23d2", "comment": "Malware payload (SilentBuilder)", "value": "0a635e6b6f13ebf2f4504d4db9b70f218288ff3108d2f845bd49cc03a49d8894313c3c712839150ab0972b5c00366035", "object_relation": "sha3-384", "Tag": [ { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624447, "uuid": "05238cee-3f50-410d-b59a-20d05831f678", "value": "T17DB3BF5AB21EC86DE965873048D747EA2737EC114F6F4B873A49B3227FF89904B1341A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624447, "uuid": "c197b2e2-6d53-465b-adf0-ccf6c22db97e", "value": "3072:VfKpbdrHYrMue8q7QPX+5xtekEdi8/dgVyVIBk6h2bsllScQjnxA:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624447, "uuid": "d7a60c1b-8cd2-4376-8d3f-39b00e1daf26", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624447, "uuid": "15508eed-b084-4b21-ade9-db5f91884b78", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624447, "uuid": "0264e2c9-437a-4dd3-901e-c14b59cb271e", "value": "lista_175.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4484c8-947f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645603611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603611, "uuid": "1d38b8e4-4016-45ea-b179-c7ec466c7c72", "comment": "Malware payload (Loki)", "value": "4bb27259987ba2ea68a99516a87199b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603611, "uuid": "f7366187-eed6-4b8f-94df-db5938859691", "comment": "Malware payload (Loki)", "value": "825f2961b1117ac59f007b2cfb230192814bb726be89325758b7020a21ba70da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603611, "uuid": "7610b5dc-68ae-400c-97c8-4c5afdc7a43e", "comment": "Malware payload (Loki)", "value": "36561dff4e9c57c480b77668dfb0df625c417b78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603611, "uuid": "01d7299f-72d3-44bf-a031-0b6e7aa9e17d", "comment": "Malware payload (Loki)", "value": "8efd965cb91fee2f1d9731f25938b5c3df24a6c0d44352e900520c5bc1d033114872f4e674ee79f6be76495a88ef77fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603611, "uuid": "e079a666-5d02-4515-9738-78dd71b679f8", "value": "T129F4BF4839AB1F3DF1718BB21DC4ECB4FA99FB231C08B37D78516646C6A1B809942677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603611, "uuid": "1aec46bc-f6be-4a0e-a0f4-f27508e50518", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603611, "uuid": "96ab6424-448e-42aa-997d-93bf74a68bd1", "value": "12288:oWSWtUXih7jGK777777777777NvHmbU+G7B7zjTHawY0+hqUPt7HCDECSOEF3o7Q:+K777777777777iU+c7PTHawY5qOtksJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645603611, "uuid": "85f44270-d76e-4267-a8f1-968c2415b0cf", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645603611, "uuid": "15604eb4-5128-496c-960f-fab6a5f661ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603611, "uuid": "2de1e0a5-99f1-4cee-8fd7-82f2f93cb77f", "value": "RFQ Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fa111a-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645624447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624447, "uuid": "535c46d8-5e1b-4c9a-9b34-2ab9d6df50e0", "comment": "Malware payload (AgentTesla)", "value": "6b6782c5a550735ef0939f13b1e42b7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624447, "uuid": "615c782c-8438-4d13-9bce-d432ae905721", "comment": "Malware payload (AgentTesla)", "value": "82a9142ae8e93f4cb4d723ea393084a2802bead7267ea3d7cc2dcc86c35ed9ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624447, "uuid": "8959b03f-6b73-4cc9-ab87-8d2daa8b718c", "comment": "Malware payload (AgentTesla)", "value": "3f67cce560c6bbadca33695ab43b18cc1e246dea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624447, "uuid": "ce260aca-ef76-4830-b4a0-b1607cd94385", "comment": "Malware payload (AgentTesla)", "value": "2fa2bdccae376be4203bef631cfbc23713572090fcd17064c71e71b679f44cb84f9a6f8dde5f77009a88515f3221d664", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624447, "uuid": "c547dcc4-3843-4a06-81e7-c1243ea6763a", "value": "T1A115CF043AAB4F3CF1BA4BB658D1EC64B7A8F7231C09F37E78511596C652B508D822B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624447, "uuid": "2fd4cf1f-b02b-441c-9f3e-9b787198ef84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624447, "uuid": "3a247c26-281f-4aab-a1da-a9665614a872", "value": "12288:DgB6vcNzh7jGXUMQmSXVCuSEM1+bLxfCO1Ejf9yPDGBw9jHhK9lixg+5+FW:HcNAXlBaFXM1whrck7+QxPkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624447, "uuid": "565cd96b-a4fe-4f8f-bf95-d18314383a11", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624447, "uuid": "9b467f7c-eb94-4570-b144-957e15ea397f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624447, "uuid": "266a2509-caa8-4af8-97d7-b7d3b211edaf", "value": "6b6782c5a550735ef0939f13b1e42b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74b71c6-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645610954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610954, "uuid": "db0c8e3e-8442-4d29-b1e4-2d461ab43f03", "comment": "Malware payload (Loki)", "value": "95cdd40c5ed065df6ac762a78902b40b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610954, "uuid": "fa0e76cc-e108-435b-9d13-5c0f95fdc331", "comment": "Malware payload (Loki)", "value": "8314c46f12e364e004677df837c1a1e1a347ce3771d79c74ee8b746d5d26265c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610954, "uuid": "45ee44b9-61ec-4b68-8af3-cf93410c0f60", "comment": "Malware payload (Loki)", "value": "0205c6db9518b0463cde100609871fd8ea511ea0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610954, "uuid": "2a2cda1d-92f6-44b7-b06f-ab7418a30417", "comment": "Malware payload (Loki)", "value": "0d634eed7d9d04e7969f870fbbe8f785ec90075d5e5bacaa051a644d61d773a1fdc01f02de4600f7087e62c2bfd33459", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610954, "uuid": "f528f665-cc8a-4a42-93a1-2039da46ff70", "value": "T1D41412093CC0FEF8D5619AB332E658098965DFA098649139781B72F48E3FF6475B872C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610954, "uuid": "4a6dad6b-ed8c-4a51-a49d-493ee65fd1fb", "value": "3072:mOBriSBcAEmL3wM3fNwTGyKHHELg/yOHYsY2CkWgnnUBA4QBUFDIGSGIB/uk4OdF:fBri9bs3ZwAHkLkfHY4HnnUBAF36YcVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610954, "uuid": "64d2817b-b09b-453d-98b8-89d2adf140f3", "value": 191080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610954, "uuid": "61889ace-ab0b-4b12-86f9-eb29a0c705b1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610954, "uuid": "ca661606-b58b-46af-ade1-b9cf012873a4", "value": "\u0391\u0399\u03a4\u0397\u03a3\u0397 \u0393\u0399\u0391 \u03a0\u03a1\u039f\u03a3\u03a6\u039f\u03a1\u0391 23-02-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816af083-94b8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645628070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628070, "uuid": "a630a34f-c53e-4ea9-b7f1-c6ea33eb8748", "comment": "Malware payload (Formbook)", "value": "ebe9f0088ca1b2466ff96453affd3792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628070, "uuid": "c3266ae9-a64f-4a1d-a0e1-56f91862c97e", "comment": "Malware payload (Formbook)", "value": "831f79faeff5bd6704c5aca840f3067b4762e5b6e6228b04221ccf351b146da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628070, "uuid": "824ade4e-a726-4638-b94a-32a66b1e48e2", "comment": "Malware payload (Formbook)", "value": "4e308193cbfbd8fcb9db9bc4f54344d5e211aab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628070, "uuid": "7d3ecddc-9abf-40e2-9111-84b8c05b47a1", "comment": "Malware payload (Formbook)", "value": "f7ab8b96bb939cba3d9111d2d08be88ea7acdcbf830c451939852fbe9f16fd1d577d4d08c5e61df86593b77422cee54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628070, "uuid": "cb8f8d3e-d542-4ad6-a428-5483918f0f62", "value": "T1D1F423F15BAC137ED5630B72C1163B6263ADA61BEC4EBF1805B264BD1C026854E13DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628070, "uuid": "9d6476fa-eeb8-4edb-9b38-7ccf9bb949ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628070, "uuid": "41eb7081-8425-4cbd-9b33-0d5910ab991f", "value": "12288:JFiMwITspGFz4B9ECZMG8jOJbsqSblneISTmU9PQWPJuRBkui2obOS/21ly5VeOr:JFcITUQz43pkjO9sqSt2dP3hunwa1NPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628070, "uuid": "2fa87b89-8b7b-40c7-a6db-006e416d3907", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628070, "uuid": "ab71b6ac-5111-43a1-886e-1829f6b146ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628070, "uuid": "a4b13779-6efb-4db8-8e18-5edd0ab5a4b9", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dadaaa-94f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645655559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655559, "uuid": "7f0492e8-a537-4523-83be-85f86bb0c011", "comment": "Malware payload (Heodo)", "value": "4c9f6dcab65a69da44fdcddde935b0c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655559, "uuid": "4424eeba-6eb3-44db-aa6b-3440e0b754a7", "comment": "Malware payload (Heodo)", "value": "8381fa23294905d8d407639c2c0bec09338f62ea782c7c1f8166572512e73e9e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655559, "uuid": "963e75c3-91cb-406e-a61d-858acb1efa97", "comment": "Malware payload (Heodo)", "value": "a5f3834c9431b18092498b2bf0c86fc1e2f47698", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655559, "uuid": "29426446-f476-44be-a101-5add3d097615", "comment": "Malware payload (Heodo)", "value": "1fa3078fef398e3dd3bab51dc3ec7c170f8a1966e1b1d131d5dff40cfed85dc8c2c3341b1b66f5699f0ed96b7bc572fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655559, "uuid": "5ed02262-43d8-4af5-8c4a-311c16300ebb", "value": "T1F3E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655559, "uuid": "212e271c-0cce-40ee-949e-ed26953de52c", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655559, "uuid": "19b7c4f2-68ee-4705-8792-456bbf746aa8", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKxe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKxLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645655559, "uuid": "fa50c707-5fcf-476f-946b-b3cc38a6859e", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645655559, "uuid": "36094d48-632d-40ac-977e-ac67f21f4ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655559, "uuid": "4c5fd20f-4967-4027-b9cc-a9f44958cae0", "value": "emotet_exe_e4_8381fa23294905d8d407639c2c0bec09338f62ea782c7c1f8166572512e73e9e_2022-02-23__223233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5443d6fc-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645611244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611244, "uuid": "1c1e4057-d6f7-49e4-87e3-9d394f870bb8", "comment": "Malware payload (Heodo)", "value": "156f0007b758ad63252095526a4f2e95", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611244, "uuid": "8e30b767-6344-48b7-9906-42642d92d885", "comment": "Malware payload (Heodo)", "value": "8429ac746dc7f61e49e705086541d791abda1da8af7c31e507e6610d1add2fd6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611244, "uuid": "ea7df5d9-d8d9-4c6d-8872-62d68497f242", "comment": "Malware payload (Heodo)", "value": "a473b2bddc42dc45e455d1e6d16b20d8b7f0e5cf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611244, "uuid": "4f337467-0b96-465c-a125-1288396eb799", "comment": "Malware payload (Heodo)", "value": "78c74339068b25db8a8fbe8396c7fa297062ff1a85b8de48fdc896960f49f6bf41f210f65bf7aa8718d3653919687fa3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611244, "uuid": "9bc8ad11-68e3-4123-a82a-ee16b15124a7", "value": "T14793F769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611244, "uuid": "2d7bb2a9-944f-4fd6-bc8f-ea4a227a3b88", "value": "1536:Zyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQLBkWvgrPE4nWHPNc2AZ:Zyehv7q2Pjx45uoDGTj+5xtekEvi8/dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611244, "uuid": "92692069-8725-41d5-b39b-a118effb45f3", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611244, "uuid": "b7052f1f-c749-4f06-b42a-5ca3b99b7a57", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611244, "uuid": "17872422-3418-4ca2-9a0c-c65b5f684f97", "value": "TVW740270790US.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadb1ffa-949a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645615389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615389, "uuid": "c70d79a2-427b-4edb-80ea-d8ed5229db3f", "comment": "Malware payload (Heodo)", "value": "967cf52d9692e614f7683b92eb39bf56", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615389, "uuid": "f87bacc9-64d6-4e8c-8ad9-15db4db970d3", "comment": "Malware payload (Heodo)", "value": "845473237a5c33c2401b85624cd70278d5f3e4a3756c5bd29c980602f642d70f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615389, "uuid": "ee326908-9ff5-430f-987b-4754e6edd0e3", "comment": "Malware payload (Heodo)", "value": "27b97013b13f38fc0fd60be7c330eb977ac253ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615389, "uuid": "96ae641c-76ee-452e-b65c-6daaea954d71", "comment": "Malware payload (Heodo)", "value": "b144e66632f938c82dcbcf48302157444ab374d07527e34eaee38d90277a6bb94b67a32d6ff3d486917139e584530ae7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615389, "uuid": "b01a6075-3432-4409-9752-98363796ae0c", "value": "T1E935BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615389, "uuid": "556b3727-ba9f-4381-bb34-132dad15e296", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615389, "uuid": "07c813e5-30ff-45b4-9e11-da72e39c5046", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/cTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/cTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615389, "uuid": "9de55886-e112-4a4d-953b-2eb3a904bf60", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615389, "uuid": "e77eebf5-80c8-4bfe-ae00-081814aa8cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615389, "uuid": "0c380c0c-7081-4a79-91fe-7662c465a616", "value": "GeR.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cd7aa2-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645630116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630116, "uuid": "95d60fd4-8649-4b52-9604-bd878b8a74fe", "comment": "Malware payload (Loki)", "value": "d5cf93758186271a13cae7d5346fc919", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630116, "uuid": "fd0fb7a9-93ce-44b8-be1b-0eb2d7018489", "comment": "Malware payload (Loki)", "value": "84b5ee66ea253f7ec794ae337b20b8b8b269c1348942a55ee0bda65b5839b693", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630116, "uuid": "9d0a48ff-beb6-4bb7-96b3-8b3e685b867d", "comment": "Malware payload (Loki)", "value": "1489ed741df6453c55c935dff823f843f5c9db72", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630116, "uuid": "367a95e1-ba17-4273-81d3-fd9ccd493e25", "comment": "Malware payload (Loki)", "value": "2fa2cabd704b5335e9e286d484b77ff1a3d362924a06a99f3ee1a1906cad5074bf6e86a9d17dc8a1716a2a7c6819e892", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630116, "uuid": "155d2476-9470-4af5-9283-534654ab7608", "value": "T19AA41675A0F26AC9F896CEB29E21E64AFFE70D419A41421FD23439F61133785C2491FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630116, "uuid": "d93b977f-f18b-445c-9cf2-c7aed18813b5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630116, "uuid": "f43d89ee-92e0-411b-837b-6f81f9fefebe", "value": "6144:oxDba+ujyaftD42WqB3fU2dd8eOcH0MjPL47HgPUeK7uk9T8:cUD42WqJU2vx0iL0HgPUlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630116, "uuid": "d6df6b88-8a45-4784-a7cc-8201cf3afd7e", "value": 456743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630116, "uuid": "f4919bd9-ba39-4c7d-b30c-a2d36aee40f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630116, "uuid": "13b37b91-1293-4f8e-88ed-2c7dfb2be95b", "value": "INV-DHL202038658530 TRI2060 2012YD0007 O38000026053.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963cdff7-9469-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645594175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594175, "uuid": "2fda1d5d-cb64-4bf1-92d2-7f6835a3ba89", "comment": "Malware payload", "value": "f4f4bbde78b8f44adfb1336586ab8422", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594175, "uuid": "18d1cd72-ffcf-4acd-b5b9-c9696ed94420", "comment": "Malware payload", "value": "84b980fe26979262acd02db2695a978d79b0adaf462d5dc4e2cea043af1a21a0", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594175, "uuid": "fea0a0eb-4c36-44be-a127-ad764e79ab6d", "comment": "Malware payload", "value": "09a1b94d1ecfe778e4e2e8925b734d15dad5858d", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594175, "uuid": "6b941a63-428f-4c0e-b7cf-158701ab7f4d", "comment": "Malware payload", "value": "93cfca5555cb73c555bb971dd8820415dfadc79ab2085126ecfa9ec300c3cc375fc309d16116cd1d099b7196ffcd9490", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594175, "uuid": "63f680ca-797e-40cc-8052-f42d6f6c7e85", "value": "T139414A2106E92203E5B92B3C9448A799F660C40327EA179B3B2A0DF01A458E8F25B0C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594175, "uuid": "2607a6f4-6742-49a5-98a6-02bdd2c40ea9", "value": "48:9LpXu1DInNcDLVlA+8HvOFs6Lv1UYtvhCMj8ydk/:RpXu1knwYevOYtppj8Ak/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645594175, "uuid": "356f3558-3a79-41dc-b2c7-f02ad46550f3", "value": 1996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645594175, "uuid": "504e1de2-4ea2-418b-a195-a0d6301e8aca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594175, "uuid": "0f88bd01-7928-4399-ad18-0602617fe87e", "value": "presente_244.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61505467-94b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645626298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626298, "uuid": "8aaa3553-6ebe-486a-a752-4f8312b3928f", "comment": "Malware payload (Heodo)", "value": "ea1894722b1126745973121447bad34d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626298, "uuid": "0b283d82-0cc5-46cd-92b4-11be7bf814c7", "comment": "Malware payload (Heodo)", "value": "84b9ddf43c4fcd4ee504b5f12b8fa30ea95e96da6737e6354f46bc6737bea7c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626298, "uuid": "abd7bff6-ada1-4cd9-9b92-e73a7e23aff2", "comment": "Malware payload (Heodo)", "value": "64b7035e53da1ad01c506bd85643795cc08ad280", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626298, "uuid": "3f718bc3-05b3-4001-9bad-66d6c10ecfb8", "comment": "Malware payload (Heodo)", "value": "ad2bde04e2f2f19ec16c7f7f455ed4eb00089e73610d2da585862b1e70846b4af3beb06db97034a4434ef12375974b5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626298, "uuid": "f1a617b6-0dc4-4063-a725-eef61d29b118", "value": "T1C735AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626298, "uuid": "b6b2f9fa-b836-4213-a1b6-c55fecc7d57a", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626298, "uuid": "48caeee9-d5f3-46cb-8677-abc73fd26233", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNKTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNKT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626298, "uuid": "dfafe1e1-6bf8-4e71-9cb1-72945c49b8c5", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626298, "uuid": "43231791-f02e-425c-b319-ba39a2e22d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626298, "uuid": "4aa502d6-4967-4f99-9ab5-9c2ae37d0663", "value": "ea1894722b1126745973121447bad34d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7171703b-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645623749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623749, "uuid": "aa8d7654-8d29-47a8-957d-abc90111991e", "comment": "Malware payload (Loki)", "value": "7e4ed2d5ac121b92d086a967be365c28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623749, "uuid": "758d396b-c5e6-4dd3-842b-ef15cbc1cebe", "comment": "Malware payload (Loki)", "value": "84d943a1bd64d3b4d73abe54a2a116c734ffa7bbe6bac8043bdd84f036dcbf60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623749, "uuid": "f42aac0b-9fe4-4ff5-a914-1290fa5e01ff", "comment": "Malware payload (Loki)", "value": "97b97bedd72a3614b0c621899331bef76fac6a0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623749, "uuid": "5ff9cd1a-134f-43fa-9939-65ddfbc61107", "comment": "Malware payload (Loki)", "value": "2c2955a173ad6bfc6d5693409e5d77971762dbd491fb380095306a25ec198c3bc99d5e215b42ba1d0b02b90cfa17c9a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623749, "uuid": "ad5d540a-9066-422f-bc92-e8e2db35fa63", "value": "T17D549E00BB90C035F4B716F8447A93ADA53E7EB15B2565C7A2D42BEE4A346E0ED3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623749, "uuid": "888d30e0-1519-4257-9f63-aa3113a0371b", "value": "ccd6a4e90a04c24d49f4949717a298d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623749, "uuid": "0f3e5c19-393e-433e-b558-95c7bb01b18e", "value": "6144:/ifZXItNU+FWa1wZEDHE1zyCM3h+97e/WChVwxUrgnK:atItW+8ewZGHE1ox+97/Czwe4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623749, "uuid": "7209a57c-33d1-4d27-b60d-4324b85cc4a0", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623749, "uuid": "dec43817-6e9c-4378-8ffc-dc105a36a982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623749, "uuid": "f9c1b3ad-20bc-421c-85ff-5e981efb2ee4", "value": "7e4ed2d5ac121b92d086a967be365c28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536ee72a-94b6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645627134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627134, "uuid": "05d2e7e7-f8de-4607-a68b-609ea76ce03b", "comment": "Malware payload (Formbook)", "value": "8a856cf025a0bef8bb579d5dc1a221c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627134, "uuid": "598036ef-9c28-4541-9da0-7f490437ccd9", "comment": "Malware payload (Formbook)", "value": "851e9db7ae9fb2f17435a161dc117b20288bfe672e9d00630183504ee4a9f6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627134, "uuid": "5007f357-98c7-4015-bc1e-8977db146bd9", "comment": "Malware payload (Formbook)", "value": "af7805017eb8803efa999bb2a11c830bca93ef4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627134, "uuid": "98d12183-f26d-408d-87f2-8fa270dd2560", "comment": "Malware payload (Formbook)", "value": "f8419fbf85e190e4894272c8e8294d8572a7a913160719b771c7d54b8249810e923075743efcaafdad1006fc966491cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627134, "uuid": "05771183-fcd0-46c2-b69f-10f6cf462210", "value": "T1A9A4016476C4C89BDB6002B0C4B5EB795376BE887DA14B0B27E73E6FBA723575812103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627134, "uuid": "69bbdf6b-d3ec-4daa-9073-d02f18c33946", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627134, "uuid": "67171eea-31cb-49a5-8634-eb6d0b562dcf", "value": "6144:qxDRD2GPR13h+0oVpShpZ7Uxx+pASqSfKA2bgr9E7fNzC8jcz0JxJvRE:SD2SR13hgpShQxMNDS1grCNG8TJ3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645627134, "uuid": "3f7350c4-92b1-4b20-ae85-ea563acb2c10", "value": 487282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645627134, "uuid": "8fac2546-90dc-425d-90f5-d99a740d820b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627134, "uuid": "91a4eff4-bdaa-4f1d-9c6d-0d939c042da5", "value": "RFQ#7007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d738d4-9476-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645599568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599568, "uuid": "951aeb98-2b84-4623-aa11-88a520da55d3", "comment": "Malware payload (Formbook)", "value": "f1d0bfaa951a060ffd68fb07b67e50d6", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599568, "uuid": "3cd4e099-6f71-417e-a437-fb4861a54b08", "comment": "Malware payload (Formbook)", "value": "8564b38aba101e81b04cd5fcf0e87bb12966be4adde5906f84a49723c2a9fd1d", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599568, "uuid": "d541e025-75f1-498d-b484-aca1bdc0e4cc", "comment": "Malware payload (Formbook)", "value": "8efa26328b803778dad5e0079ed25dac684b026d", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599568, "uuid": "d84e3c02-5a98-44f1-9585-ea06b033edd1", "comment": "Malware payload (Formbook)", "value": "5cce19b3ccb747cdac0a1eff28f818a9d2ea7c480daea39f9e2787b38fdc2d63ea9bc02d34212a754882fbe9c9506e98", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599568, "uuid": "906bf100-247c-44c8-8e87-7235a53f9b9d", "value": "T171B423C8F9B5D128F5B0392E18FD040BEDECF85990B18791BB879AD85B49B38464CEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599568, "uuid": "e2fe5cd0-573b-4a2e-9853-94c8aa1d4fff", "value": "12288:cb3Qq/SJskNsmH1EoR+8i2aht/ZhNcJ+On4eVP:cbhwjH1EV5PZ3cJll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645599568, "uuid": "854c04eb-2875-45d7-91d5-8a8941655c00", "value": 497699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645599568, "uuid": "fea027e5-8a0e-4ac0-8537-45a70853a386", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599568, "uuid": "9d22224f-70fd-4b84-b8a1-4b53dbda82be", "value": "SURENDER BL.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a81272-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645610820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610820, "uuid": "90914fbd-fdea-4f02-9a14-104f5330f03b", "comment": "Malware payload (Loki)", "value": "3e56159955bb19447c6a5980a37f0c6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610820, "uuid": "0fe6e199-c2be-46c0-9b7a-0240c8f33896", "comment": "Malware payload (Loki)", "value": "867cc6b16acccdbd82eefed418021568f5d527aa0075dab423bc760b3adc18e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610820, "uuid": "008f2b3e-daed-49de-acb0-82321f35d836", "comment": "Malware payload (Loki)", "value": "8caadec78de4c4b3fa91a3ef4a22919fd43189b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610820, "uuid": "10a27110-0af2-45f9-860c-5b60f3b1e775", "comment": "Malware payload (Loki)", "value": "caafbf22e14c7b9cc46eb33618a8584d1d8afaf2c25cddf309edb62c4b684ef349684ccc859cb73d9314b2be0ac1c376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610820, "uuid": "f7109882-ffa7-4667-b7f5-aabebcaf6339", "value": "T195F4BF0839A71F3DF1B58BB21DC4ECA4BA99FB231C08B3BD78516246C6A1B409953777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610820, "uuid": "3e0f8066-3e9c-4587-ba33-3b58f3c48694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610820, "uuid": "a7db5867-fc4e-41e2-85d7-aff365b112d5", "value": "12288:7WLC/YEih7jcK7777777777775i+of0SbKhk7EcnVAmtGDsIBxkmK/DrQB7mBV+I:9K777777777777A70R5cnVAmesITkmoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610820, "uuid": "6ef6281a-c9e8-428e-9b4d-5c926629c3e6", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610820, "uuid": "4c0b8fcf-0e12-444a-9c0f-ad80e47a52b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610820, "uuid": "a8d157ce-64f9-4a15-9e38-de4af3bdc848", "value": "PO 045647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78eed25d-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "5c56f441-2acb-45cd-8958-94ab071408a7", "comment": "Malware payload (Heodo)", "value": "88874834a93e39cd7e33ddd4a1535c65", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "2150844c-81b6-456c-ba1e-1ad60e668fcc", "comment": "Malware payload (Heodo)", "value": "86ca898b94207d5c888875fc9ebc1e821f9fe8742ecf8774041fccd480988bcf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "a8d40cfe-79f0-45a3-a5d5-c2664b287cfb", "comment": "Malware payload (Heodo)", "value": "c2e7a0f17eb4cc9e37db40a990fbf6cfd66ad67d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "f1c69d51-3e93-4fbf-9b34-972dcf1ee4ed", "comment": "Malware payload (Heodo)", "value": "6365c35197887efddcef40f4dc62d8599740a4e411cc959e7fc6450e9f1c3ddd557c670a58a8b9514bf7b31a1d294d91", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "64b8f0e2-08ef-4ef8-82ec-23f603587ae1", "value": "T11BB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "239625ce-0c9d-4321-b8fb-4601cc089ebd", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "861edc34-72f4-4ba1-90e0-584c3c9faa7f", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wHIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWozo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574798, "uuid": "92c95baf-a347-4cc0-9618-2269c4951bbf", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574798, "uuid": "9e1bc6ef-dccc-414c-912d-d3e91ff640f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "9a7c741e-1772-406d-9623-7d6d02d218dc", "value": "emotet_exe_e5_86ca898b94207d5c888875fc9ebc1e821f9fe8742ecf8774041fccd480988bcf_2022-02-23__000634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbccb27-9477-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645600174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600174, "uuid": "f76f8b1b-16d8-456e-9401-2392acc93c1c", "comment": "Malware payload (Mirai)", "value": "0983791a0a0fed868728725b8e2162ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600174, "uuid": "fc6d0493-9915-4964-8b2f-feb840ff2acc", "comment": "Malware payload (Mirai)", "value": "8779946494dfca442c384b8f33cc9d8400d2844d69324d9ff06726d6ea2c59e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600174, "uuid": "21b2270d-4b2f-48c8-8df5-00cf069fe68f", "comment": "Malware payload (Mirai)", "value": "feba94f2c45859028485b42582a3fbe2b9e65fe7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600174, "uuid": "db9d50e7-3158-4002-acac-0b4c1be18385", "comment": "Malware payload (Mirai)", "value": "e87f66a92361a352f46c16fac3a4dd4143ff4873239bc3ce1514d01873a22d4a028bc1e10b2a8b1d77ce0d953626ac79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600174, "uuid": "5eefd143-cb9a-4abe-ac35-78867f19200d", "value": "T167B2D06A01CA048ADC96337F6F5F4EDFB30129950115CF909FDADCDDA26342D9790936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600174, "uuid": "0db93ab7-9135-4861-9141-6ca23c41240e", "value": "384:MW7LalTr/lS3rOVT6rJoA/0np7NYLPr//P8Sw/oJte97nmO6/UG+sOdZkx9YUuMS:h7m2bOVWNj/0njYLrlGtnP6/hOnk1uVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600174, "uuid": "a6e9d279-148f-407d-9eee-4a3ea4127825", "value": 24484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600174, "uuid": "5c626fde-13ce-4793-8eb9-4821d47d35c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600174, "uuid": "948b5c81-31af-472a-b72b-eadf98b54d75", "value": "0983791a0a0fed868728725b8e2162ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7420fa8d-9462-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645591111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591111, "uuid": "ba6b65c8-7a5d-4019-8c1f-4a62b177983a", "comment": "Malware payload (Heodo)", "value": "ce1b740cdba083657856af742c3e271e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591111, "uuid": "a9009a31-5c66-47c6-8871-f7b494695320", "comment": "Malware payload (Heodo)", "value": "881a4e05f29b14601035286c2ad34da8d4d426f8e914ba218c40a5e8199bf224", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591111, "uuid": "6a48e44f-e01d-427d-b1ee-5d88c122977b", "comment": "Malware payload (Heodo)", "value": "fc27584a9ef8f31a44bfd32f5ca2d3682a12bfb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591111, "uuid": "d2ff8be2-54c3-4e4b-8313-9e4f19d29bf0", "comment": "Malware payload (Heodo)", "value": "a3ea8a8337c58fd1f55f152c354f8d5e69a7be17384494bca6b6036d1effd7b2761817375b7bc595f8e47e85cbef2a85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591111, "uuid": "ccc1074a-bf74-4c97-a08d-179ee2756262", "value": "T154B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591111, "uuid": "6b71d47f-a7e3-4f4f-923c-b6e18b1022e3", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591111, "uuid": "87d68f5b-5729-494f-bf81-6f9a3081144d", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wrIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWszo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591111, "uuid": "701f063f-5027-4452-92c3-624dba8b25aa", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591111, "uuid": "09a9f17f-1395-4785-83a1-49838b479abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591111, "uuid": "aa708674-4dd5-4890-9e96-91cad231bd54", "value": "ce1b740cdba083657856af742c3e271e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8bc185-9483-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645605166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645605166, "uuid": "cc32407c-539f-4efd-92b3-36f75a286e19", "comment": "Malware payload (SnakeKeylogger)", "value": "edab3a2332435330c13866922e8aa20d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645605166, "uuid": "67634a07-5dd6-4356-b3a3-15ae13452a08", "comment": "Malware payload (SnakeKeylogger)", "value": "88c40e7b332156f2e4412d1d0caa401a18e3f080763af8d6fb13c0e9b584d647", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645605166, "uuid": "ca4d9eaa-7fde-46e8-bd9b-afa2a8a19166", "comment": "Malware payload (SnakeKeylogger)", "value": "ebff1947728bae174add6d0c2fc20b285030b8d8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645605166, "uuid": "d9f07a2c-a4e1-4fe9-aae2-9ca62bcfc135", "comment": "Malware payload (SnakeKeylogger)", "value": "98aad324fbc0e774e2fe5eb208e01b0dd2587172c3579489a0eb36f9d7beb2a4b26721febab1ea7ea0ef6da4878f5d25", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645605166, "uuid": "9aa473d2-c5d0-45f1-9e46-c1fb16ba5514", "value": "T11D74224E79CD88CB25100D6140CAC7E635E629A406AAE64237CE65F7FFC13BDA1F5862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645605166, "uuid": "cd385d59-20d7-44e5-881d-163ae33e9172", "value": "6144:cvQDFkDH9+ACuMnTt68JmCl+wF8+Z7nxV4QShWHhicLipzEQePtQKx3Iy+Y:jFILCNtzI6+wxpLBHhDsEQutQKx4y+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645605166, "uuid": "3f9c42e8-465a-48dd-9479-e40036561219", "value": 356455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645605166, "uuid": "14a38416-c063-4a3b-a8cd-bc77bd073d5f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645605166, "uuid": "c2e6ee95-b13b-4654-ae7b-9b8241cbbca0", "value": "Payment request for SOA per JAN 31, 2022.bat.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f46144-948b-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1645608717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608717, "uuid": "4a4a7ac3-69ca-47a5-9dcc-700f972d5d13", "comment": "Malware payload (DCRat)", "value": "dbd81532b7e66b5967bada394721be4b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608717, "uuid": "929c6c40-6b3a-41c5-977f-7a802db87eef", "comment": "Malware payload (DCRat)", "value": "897187d1c30a8eecc26e28ab1fe5ab4cf7ffaf55d41db358c294b0b19ffd1cd4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608717, "uuid": "e2580bf0-0e50-4ed4-960e-1ceb08b11c46", "comment": "Malware payload (DCRat)", "value": "9f249e381e82a09fad8508c52a1a97c6f9797411", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608717, "uuid": "01f8bebf-2da5-4668-8f9b-9507d50e9ec9", "comment": "Malware payload (DCRat)", "value": "ceec0bdb6318c71cb4bb0b7174c61608b4ccb31df8b6ec1f749e48805102c70c2e33cc51a4e2c040ae50537deb6ef40e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645608717, "uuid": "b08cc6c5-1e64-4777-8108-db6e5ddc9e33", "value": "T1B6D4E7242EE91529F17BAF7D85F07596DB7E76733717960E04A1028A0B23B02DDC1A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645608717, "uuid": "0cda5f94-d553-4e15-961b-f2c83187072e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645608717, "uuid": "e01dfbaf-7581-4c81-be90-6a04e02ea30a", "value": "12288:AqnOPF9CfuODJwWGKyyniIkVwsCWfVdHw44dpVFeRAWu8cx:A+OPF9CfTDJwWxLkjfwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645608717, "uuid": "1dd5f086-6f0b-4485-aa3f-124ac24cc4cf", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645608717, "uuid": "726b5bfd-e4fe-4d08-89b7-40646dcdc351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645608717, "uuid": "9328504a-0747-4573-9639-5a8ea4d33162", "value": "897187D1C30A8EECC26E28AB1FE5AB4CF7FFAF55D41DB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecd5fc7-94b1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645625086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625086, "uuid": "85c13798-faf7-4678-9f2c-d6ab44a6cd26", "comment": "Malware payload (Heodo)", "value": "a6ec7d7920b5fb16f2cfdaeb84ef9bc8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625086, "uuid": "ebb86ec9-6a7a-45c6-baa7-6663e45ab0dd", "comment": "Malware payload (Heodo)", "value": "89cba4948ec51601749ba78a1e229150d24bf6632444d70ae20717a8ea7c971e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625086, "uuid": "0fdb8684-2e91-41f7-92ef-4afcf2a2ad9e", "comment": "Malware payload (Heodo)", "value": "5ff6a0b4b92be217b66e47d1c9ab29a151c2d102", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625086, "uuid": "cc55f5f7-537e-4987-b229-0b035cb998b1", "comment": "Malware payload (Heodo)", "value": "ee33e949aad97ef688bda391da0be3d908dd6d74c8b39c17825c0688da6ead68ef9bd6a6201c5b9677b71ad952c27ee9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625086, "uuid": "78230331-d505-4101-9bef-406f7b95c5bc", "value": "T10C35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625086, "uuid": "e940e837-f687-4dde-bda0-700b0f419b1b", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625086, "uuid": "51d0ac2e-7694-405f-b221-4ca5707c0474", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/sTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/sTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625086, "uuid": "311db624-8e0e-4ad5-98ac-21a0cb12a7f3", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625086, "uuid": "a0b56121-8560-41d8-84e8-6ffd8f2dc6d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625086, "uuid": "2eec1f8a-97b5-4164-8dec-89a300695a2e", "value": "ceS92.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94b72a2-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645610957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610957, "uuid": "8e6c921c-d655-4c96-8834-90b31526fe3b", "comment": "Malware payload (Loki)", "value": "1c9d5f79d6a71de5af912dd8f807412a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610957, "uuid": "74492e73-c4e9-4dee-b03a-405b0f8102cd", "comment": "Malware payload (Loki)", "value": "8a546104adc5ac9d1923020edac1a04e55b10e9564cabcbebdce4014576be3e1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610957, "uuid": "13aed80d-ae7c-4c12-8422-7ffd47b20e86", "comment": "Malware payload (Loki)", "value": "153d299b868d29872322805372c1699a55e7577c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610957, "uuid": "1886fcfe-7188-4125-851a-a0d71ac3ccf3", "comment": "Malware payload (Loki)", "value": "4afdcc115a7b30e8c4ba61256309c71371fd1747c4c59783668d512f3c51d2ea9dd8b560021b74e6bc31084bf45d2d47", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610957, "uuid": "df3ecbb8-0304-4989-8028-f576a6c8633e", "value": "T12D141266B8814B48FD6391B14D51D8B64210EC9EBA5B632133277F31F93871ED80956F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610957, "uuid": "f96154c4-1c1f-41ab-8235-4ea0a09239be", "value": "3072:iCFXEyCuXiVSeTNqbPpMVjRi2LUw3S4jEkBZjzc4MuXV+dC91YS3NqKc+Q:ZYVbqzAjRD3FjFjj1TPU+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610957, "uuid": "cc311d6f-f94c-4899-8239-f093ab21b37d", "value": 190424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610957, "uuid": "774c6b96-e443-4901-9fdf-3bfa3c6ebbae", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610957, "uuid": "2591aacb-616e-48c8-b2dc-50df91dc5b99", "value": "PI 4700031338.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8fdf9a-949b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645615716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615716, "uuid": "0787f284-d9de-49aa-bdcc-c7985ce21cde", "comment": "Malware payload (Loki)", "value": "bbed08e66ae7b9ed30d8029293a2c3b2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615716, "uuid": "6519bbd3-cf16-443f-96a0-d2c947928d6a", "comment": "Malware payload (Loki)", "value": "8af17b679271ab2060234a3b23c8e425d7beb1f9d4eba0e4fb8ed5b7010ed6fb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615716, "uuid": "4240547a-bf2a-417e-9b17-b5fe7df9b2e9", "comment": "Malware payload (Loki)", "value": "14fa1449d7a018fdc4b25e596d228a03d76a972a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615716, "uuid": "948ddd8f-5d72-4853-bac7-df88e1a6e9a8", "comment": "Malware payload (Loki)", "value": "7f048ea647aeccadffa234b298280436a288f2357032af55e8b0820a098cc09f322558daece5f409c788bb052f945bcb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615716, "uuid": "78a7e3b8-4f32-402e-bbd9-3df2ac90493f", "value": "T1C214124E7652B289D5A24F755327D0FF398FFC709E4D6B3018CCB235AA79A0109B6B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615716, "uuid": "04a3ae7e-419d-4047-ae2d-a307e68138a1", "value": "3072:LzSDbNGjrcEgrXDd65zuWbyed4TIiXXeRFRKotq6wZc82UiosKFqxat5qxucKk:PMbon3grT4uunmsineRb746wODgsKFwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615716, "uuid": "55377fc6-3312-4976-91d5-5f53c960b23a", "value": 190648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615716, "uuid": "925c5ba2-e398-4ec5-9f77-4e2c278778df", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615716, "uuid": "37e8218b-9f58-4d4d-839b-4a3eeb9b6462", "value": "Ace usd.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b004b9-94ad-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645623217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623217, "uuid": "569145e4-7196-4835-acb8-6f685b70c2ec", "comment": "Malware payload (AgentTesla)", "value": "6fae635609841c8e23d27cbf8fdcb0a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623217, "uuid": "dd3c479d-0736-4363-a60d-2824f1839cff", "comment": "Malware payload (AgentTesla)", "value": "8b4c2837b0988ab0c405ea26099db3c2c557a55561f82b4634942e8785dd9b08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623217, "uuid": "0fb98776-040a-4e22-90f0-f059aab27599", "comment": "Malware payload (AgentTesla)", "value": "40292c93f4ff8ba5c835c2c02b72a8c839c64b54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623217, "uuid": "acf4c38f-4c53-47aa-8da3-8bc52cd14418", "comment": "Malware payload (AgentTesla)", "value": "febbe2cee42145ded5137afe704552d0f7cf5d6bf3e30a61aa92c0ceffa2a2bf9459529edf3c5696fbe2b09a7b8d4d28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623217, "uuid": "c8c40673-ad2c-4c53-963c-93c6be087afb", "value": "T1706423453BD8047BF14B0A316DD3DFB363B297704BB4148F2B2D1FAA36392A1562958B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623217, "uuid": "29dc1caa-cf8e-4e21-b5d7-5a84999cc433", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623217, "uuid": "9b3a573e-3485-4bb9-ba7d-fe386c7d02ed", "value": "6144:TxD714cj1BvWflGq6fhBK0mKsWHcM1s2iY6Z/3T4TuMioKn:F1jPA76e0mKz8vU6pjmurDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623217, "uuid": "c0eee08c-babc-42d4-bf33-041785a48ff5", "value": 320049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623217, "uuid": "98abfca4-0b07-44e9-9021-4f4a6b8192d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623217, "uuid": "e542b4a5-8da8-472d-a251-ee3dd1a65764", "value": "Order No 051-0-0523453883.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8526956d-94d2-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1645639243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639243, "uuid": "63e4fe43-adb9-42c5-9758-3368ac675d64", "comment": "Malware payload (GuLoader)", "value": "75054acc26ca95ae6e24d62fdffd590b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639243, "uuid": "de0cda28-517c-4224-84bb-c83ffd632b7a", "comment": "Malware payload (GuLoader)", "value": "8c02a2842e5134b1f30d10030b2a54861495943d94fb821733c48a5b53b19354", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639243, "uuid": "12dcf55c-1f2f-45aa-a0b1-99c37e222887", "comment": "Malware payload (GuLoader)", "value": "7e72ba68de11cb810d902a4cdf2dce826cfdc856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639243, "uuid": "9dcd5498-f25f-4755-a584-1b0a0db1986e", "comment": "Malware payload (GuLoader)", "value": "f96c482c67d7d0a04e13abf7b7ab465b5a33e3544b013de6890c764f1065001416c4cff20d28f5b85084eba00d369f7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639243, "uuid": "cfc92c03-bd83-4b2d-a86a-377a10a2979e", "value": "T1D6B41283B265C077DDA7473185679F251BBAAF3166A1DD032B443F8B6DB23C1CA0A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639243, "uuid": "49645de1-af4a-42f8-bdd9-fc14a043e1f9", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639243, "uuid": "c5d925eb-bd38-4d33-a27f-c3e893ecbe8c", "value": "12288:wbNW/IIHVNgriVMOEO3vm0u1B/7bOq0aeRyvQB2CHc:wb4gyVmn8vmxFbOqhOyIBHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645639243, "uuid": "12b41d9d-09d8-4df7-93a7-99af3ef13dc9", "value": 496632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645639243, "uuid": "f6aa8951-8c41-4cd8-96ad-076aa059d32f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639243, "uuid": "3133775f-904e-4015-b36c-da68ce1bb7f7", "value": "Confirmaci\u00f3n de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e734783-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1645619529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619529, "uuid": "7df4b726-991c-4f30-8ee8-9188c787e3cc", "comment": "Malware payload (BazaLoader)", "value": "32c7927de6fdc3d8c7c9ed341c420d80", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619529, "uuid": "3e264772-2218-40df-b814-eb392583d509", "comment": "Malware payload (BazaLoader)", "value": "8c22e83d9f3372101ded6b5593b6a4ac94e7d839187d497f2fa27bd31aaf0cda", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619529, "uuid": "4553cbe9-299e-441a-8313-611c78a98b0b", "comment": "Malware payload (BazaLoader)", "value": "43c0a92579502663e29fc1c876f714ff4f5aa85d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619529, "uuid": "f2c9473b-5c4e-4e1e-9ed0-f82002732a97", "comment": "Malware payload (BazaLoader)", "value": "27fcc0f577249d2a63772948974795bdf8f7119351218168681db42021abaf9d8d313d9cc883758d3dcbbaaed92784dc", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619529, "uuid": "6aecfb38-6088-47f4-ab3f-ad555e3d1361", "value": "T1C6F4D06A66A837B4F0135474CD674A03CAB17C7127B191EB9793324B8D3ABE4173BB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619529, "uuid": "632cdce1-d4ec-46fb-ba05-287ebf85cdb7", "value": "64e5d7cce23479085f2b5c15b028487f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619529, "uuid": "4d48e03b-619a-4d8a-b054-348783265c7c", "value": "12288:jb2Z46I1dVNykv7csRVVPRWYco1fQTBYPjffcvAFF5tyS7Hf:jb2o1dXykDrRbPRWPQfRPL0vAFN7Hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619529, "uuid": "8e34cb0c-1587-4825-9b40-61ba85311098", "value": 727692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619529, "uuid": "36341898-6e0c-4e0b-b32d-baeaf33e5589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619529, "uuid": "eb8631ed-119e-482a-b208-4400efbbed41", "value": "32c7927de6fdc3d8c7c9ed341c420d80.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6adc94-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645622881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622881, "uuid": "4d58e994-b879-4430-986a-320a285a7c27", "comment": "Malware payload (AgentTesla)", "value": "3332620e6dfe3ac9aa2e57f04e37e4f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622881, "uuid": "921be3b1-250c-4869-b005-678b86c64476", "comment": "Malware payload (AgentTesla)", "value": "8c56bb12177a058ad85f8b445d4f7cdfb5bfcd21bdfb19a90ab21b56d6972b6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622881, "uuid": "33b3dd0e-32e0-41ef-9557-087e3cc4e20a", "comment": "Malware payload (AgentTesla)", "value": "5bb832100fc937481340892247f155a7d18c15d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622881, "uuid": "672b58cf-6543-49ba-ba91-73a9508cd157", "comment": "Malware payload (AgentTesla)", "value": "323a63fb783a5446bf49cdae5306ae3eb4f9a19671baf7fc03ec9492c576045cebc6c9ca4260988337bfa705743eeb6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622881, "uuid": "123baa00-ce6d-43a1-a250-b0a83e73f4e6", "value": "T11003E85A7892965DC9D47BF86DB0A18366367CE10124C18FECF97F29E972223DCC126C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622881, "uuid": "e4762d86-787c-4c00-b350-26fbbde91e98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622881, "uuid": "38b84128-b105-413f-a7bd-96404634fd0e", "value": "384:SYGnGAu/JwKzjsbl9f4ZFrIQEulai+MwCKPEH2S3dd0hUADkaJvZBQ:pGGAcsb/98lsMwCK63deVDFBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622881, "uuid": "4225bb06-0635-46b4-b26d-4c265b7d4412", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622881, "uuid": "51a54417-cb27-4c15-a2a6-2e232fe05d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622881, "uuid": "8eed728b-dd0b-4703-ba96-023ea97269d4", "value": "DUE SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a83841-94a5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645619706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619706, "uuid": "007537aa-76ab-4da9-b32b-fe84a02c8b77", "comment": "Malware payload (Heodo)", "value": "04fbcf980d312b7d382118106c4fbb17", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619706, "uuid": "d1c1a91a-bbe4-42ae-aa3c-6bafa2f00e74", "comment": "Malware payload (Heodo)", "value": "8e5770c2a6cb9a445b4b5cb992682812b1a57b305b44aa416778944c04aeb99f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619706, "uuid": "af1968b5-c622-4775-9350-6d9cac5b295b", "comment": "Malware payload (Heodo)", "value": "b9a9027b00caaa2e7d7058d813a055a5f2740c15", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619706, "uuid": "1117b020-0613-4ebc-aad6-d0c4ea93a111", "comment": "Malware payload (Heodo)", "value": "24036753a885c91c9d37ad29c84f8f79ace2e777fafaf84a9463daff921a7918a56f48b3adb538b57a37b7b0d35755ff", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619706, "uuid": "f536bd8c-416b-487a-9061-2ca6b295f9d5", "value": "T19224AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619706, "uuid": "8436da87-a96c-4492-b84b-86d1d988399d", "value": "6144:2MyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:tyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619706, "uuid": "374c3ea1-94ce-4746-ad38-5bb23b2e611a", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619706, "uuid": "45c26457-0770-49d9-8f78-33ace10e9c98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619706, "uuid": "5d52033e-44b9-4255-b720-d8a54bfb73cd", "value": "2022-23-02_1330.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f047db0-9464-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645591935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591935, "uuid": "cb6353dd-7682-4b8b-8267-88b53498be24", "comment": "Malware payload (Mirai)", "value": "85824f31ed62d481a093b7a3d13cbcaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591935, "uuid": "94da551c-6528-4b21-8c91-1a5599ba42f6", "comment": "Malware payload (Mirai)", "value": "8ed142771373e01d629f52bb1994b82e14ef0c2a1eed8f97d5fb39f1feb45106", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591935, "uuid": "00f6e344-74f7-4b31-89ec-6ca385225bc1", "comment": "Malware payload (Mirai)", "value": "4c1888bf3e1f387ad29814eebf5eaf4017eee8d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591935, "uuid": "d1c74eff-1027-4e55-a4ce-6f011cae25e0", "comment": "Malware payload (Mirai)", "value": "26d40dcfe6b656e6d17c0d065f149081d161e800df18f1a6e75889be50b65243afdb3e460076c300a75cc85bbfa3c181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591935, "uuid": "b6eb963f-14ed-4045-a1dc-33aef3dbd9e9", "value": "T1DF4302AED73928F0D0EC8C303D145ED9E58E67A8C3B624F1A952811D8F77A057D6E193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591935, "uuid": "51e03982-ad5d-488e-9169-1412ef2bac8d", "value": "1536:a7co9K/lESWEPVMaA1q4s+WalAnCsRLzcz3FMurs62RQ:ktK/lESW8MaA1qaDULoz3C962u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591935, "uuid": "27e13cfb-247c-4299-a31e-ae5892ae1c72", "value": 60312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591935, "uuid": "a06c91dd-9876-4396-aac6-d1363f769698", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591935, "uuid": "8513bd79-80bd-4d37-8f39-b8eb7971b72e", "value": "SecuriteInfo.com.ELF.Mirai-APPTrj.32004.9240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dd8dcc-9471-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645597637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597637, "uuid": "05a550c7-43de-4ee4-93e5-5c0399ffa7fc", "comment": "Malware payload", "value": "f190ca8fa0b8cd1e4ce7a94b2adc3fac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597637, "uuid": "4de32b26-ef3a-498f-8a17-6395bcc42a1c", "comment": "Malware payload", "value": "8f68531d649862e8772e2237d258f607cc7636af5ec5a8ba91e1009b46ea0832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597637, "uuid": "6549811e-3779-40ae-8e09-e0f6e9214635", "comment": "Malware payload", "value": "0ff040a5cb9d5f57fcffb01ed5b60fecce21b283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597637, "uuid": "8f8de800-fbb9-45b5-80fc-8465853eb618", "comment": "Malware payload", "value": "b640afa8884dce247d39867cdc50c6b413a2d0538ae85bfa2c9364c13e3d116faf7d1e304105cd7d47987450321636d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597637, "uuid": "c3135892-ca81-4c58-ad70-ec9afd823f26", "value": "T19545F213ED5456F1FC315835140A16836FA9B6378BA0ABABB3D8893B5CF4120D227E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597637, "uuid": "fd0a86bf-a9f6-4cfe-92c0-ee4a39614c14", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597637, "uuid": "a7447cae-1f5b-4f2f-b1ee-5529c17d5e39", "value": "24576:jW6VXRh80bJ/wT3UlNyuQBAdzyoFqX73eFvXx36F6XRoC7BFOXnj2ejil:i6ftoTkSuQGyoFqr3eFvsF6BflFOlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645597637, "uuid": "105e4317-5732-4b7a-8264-59bda975eb55", "value": 1205511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645597637, "uuid": "2168613d-d607-4504-8b82-c718977aba81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597637, "uuid": "7164427b-9f23-4b7a-8708-51e0ea6a94bf", "value": "Nude-Photos.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d0b43a-94df-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645644846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645644846, "uuid": "68cef95c-69f3-42ce-93ec-51cf2a3bc80d", "comment": "Malware payload (AgentTesla)", "value": "5cd167e56acb62e64e2c2c661f6ed40c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645644846, "uuid": "20eadc51-eefd-4fbe-82fc-50d087a6c6bf", "comment": "Malware payload (AgentTesla)", "value": "902e479cffbe416dbf9fa9fe21562aee68c331c594f3861bf8b65aca5bc1114a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645644846, "uuid": "4e8f4c60-1ce3-47a8-ac63-e0c6bb219f49", "comment": "Malware payload (AgentTesla)", "value": "82287756ee6312b3ccda1837d6fb4e594a94840a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645644846, "uuid": "343e999f-5f74-499a-951a-f04834cb4f6f", "comment": "Malware payload (AgentTesla)", "value": "0acfd174b914342fea28b625a977c1eb96c38ba8eac37f0821cd32b570d508ae87aae2f861070afaca1a7c495ef834f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645644846, "uuid": "088552f8-4a37-464a-a184-68a882a23197", "value": "T115C35EF5E770B919F010C93CF99982703AF8EF605F329542B469763A197E2AC3D224E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645644846, "uuid": "20266162-fe9b-437f-acb8-9d60b72718ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645644846, "uuid": "05288e2e-9169-4159-9a10-386e302c792e", "value": "768:ObNCoIGcezZ3maHiYMwN8Agw3nZPHbzYK7:ObNCoIQ2NAVZDzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645644846, "uuid": "625aefa6-0e74-402f-8878-76254f01ada9", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645644846, "uuid": "2d30dc2b-41f2-417b-87ef-aa02ea29d1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645644846, "uuid": "e87e9f43-214c-429e-a95c-f1a71d410d88", "value": "Bank Details_Invoice-8765345678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e89ac76-9453-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645584606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584606, "uuid": "2e806778-7a6f-47e2-8cad-5aeac5860ecb", "comment": "Malware payload", "value": "6d3109ffc556fbf5bd101be10d4c381f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584606, "uuid": "111c4a64-e468-4863-b959-0772604c2b91", "comment": "Malware payload", "value": "90d3c562caa5010724489a775e5601b061d58a8ad690d298eb06db6ae0cf503f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584606, "uuid": "e3b43b18-b723-4067-9fcb-809b64fa1f42", "comment": "Malware payload", "value": "5598a5cca56cca258efe34412ab0d452d9b110a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584606, "uuid": "0df244ba-8345-47c4-98aa-edd00e2a7304", "comment": "Malware payload", "value": "269285af95e57bb2c30dbf33bf02e069f6354966c2b7adddb8db40d0ba62e58160f2316eb21c24a48c71b467bbf35794", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645584606, "uuid": "d686f9e5-c384-4de9-8d7c-e2c35535a4d0", "value": "T1AF03F84AF941AF01D4E531BAFF0E124973535B6CE3FE7111AE256B2563CA92B0F76802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645584606, "uuid": "7ddddf76-191c-4261-ba1e-cfe44c6daf56", "value": "768:pun5Jfsk5qlEYDiruENVKOhDbPvi+btkxieu:punHfsk5qlhDiSEyaT65i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645584606, "uuid": "3499334b-ed31-4455-a68a-26ab8cc714cd", "value": 40868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645584606, "uuid": "e6a703e8-d706-4e97-b639-0521f2ce4323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645584606, "uuid": "1b47ff89-6a13-40f1-b095-b260342d4b8a", "value": "Yofukashi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0ed531-94e4-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1645647122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645647122, "uuid": "afd96c5e-4bde-42ea-bf8c-d0b065755583", "comment": "Malware payload (DCRat)", "value": "dbd95e3c5ae4199fce989d58d5a28753", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645647122, "uuid": "5f1682c5-633b-4339-a5c9-01391d768730", "comment": "Malware payload (DCRat)", "value": "91c9ae6118911c8806c01534e83d696f5fed54e5d4a89e5f4530341abdde3606", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645647122, "uuid": "f7edcff5-0545-4a02-b1a1-57f9ecb19956", "comment": "Malware payload (DCRat)", "value": "71625777435aa43410fe5da9031ec5ff75ac3a80", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645647122, "uuid": "0a704b2f-3090-4138-a087-6ebc983c9b13", "comment": "Malware payload (DCRat)", "value": "289b88c521ed60e91b93a39d65138c18bf56ec3d676623fc2b7f8b4f79bdd20f870fe07a65a946fca4000d8285a66d22", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645647122, "uuid": "36331361-e695-43bd-bdbd-33dd0641c195", "value": "T11C15F7027A44DA01D0AA1737C9EF841443ACAD417A72EB1A7EAF33BD25613A75D0E5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645647122, "uuid": "d1b9750b-f76b-4737-bc8a-40da2e3b871b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645647122, "uuid": "46f4fe03-46c2-41f3-a64b-e31693ac4f75", "value": "12288:lZQ37OTM43X/Meh5I//SEWA4yqxoELF3nLlH9gvhI2iqCVv3J5MNB:giM/SEWsq/XLDgvG2iqC1WB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645647122, "uuid": "ea3dfd9a-8e5c-4c9b-bee7-f4b11868e4f4", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645647122, "uuid": "62315a80-8543-4905-9bb1-7396c0cfe7cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645647122, "uuid": "1045ec01-5024-4a21-8eec-b29a79eb6a97", "value": "dbd95e3c5ae4199fce989d58d5a28753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05aec923-949d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645616266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616266, "uuid": "e9bcdacd-9ae4-4b6c-826d-3c4673f840ee", "comment": "Malware payload (Heodo)", "value": "e441b182fbdb051da459fe6cf4cac01e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616266, "uuid": "d6961776-771f-4405-9e12-69e67bb15905", "comment": "Malware payload (Heodo)", "value": "91ed716035e5308c629498e67e49534c27d4787dab937f5c0e8a500bb1cbe19d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616266, "uuid": "40704ad1-be82-41a1-b356-2b51ae75a743", "comment": "Malware payload (Heodo)", "value": "f0e79f69b81593ae62606ada531f5e1757c0a9e8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616266, "uuid": "c76b8270-346f-48fb-b3e4-fcb7816d42c4", "comment": "Malware payload (Heodo)", "value": "983e86514253bb05d547804872fc2e11954cdbd49f64bd1bf31d6ae8d0898139b19734056a494313d94d4dafaa48d158", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616266, "uuid": "b387a83f-1756-481e-b77e-6c29e18bb9d3", "value": "T1AD93F669B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616266, "uuid": "e9fa9215-e954-4236-a86c-11ab33b3e7d0", "value": "1536:uyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQIvkWvgrPE4nWHPNc2AZ:uyehv7q2Pjx45uoDGTj+5xtekEvi8/dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616266, "uuid": "4733edec-c637-4f63-b431-0f4d3b0526ba", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616266, "uuid": "8bb434b3-9189-4e05-8eeb-33e44f7ecb1a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616266, "uuid": "f65bb39f-23df-4ce3-be03-c5b425ea5a5b", "value": "48150610469927977761.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23265af4-94bf-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1645630919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630919, "uuid": "9c88c7ef-3f6f-4d01-b2fe-3d46b2e602f4", "comment": "Malware payload (GuLoader)", "value": "b2e998cbb14e999168693fd332cf00e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630919, "uuid": "e9344247-1811-47b4-84e8-3910eb330f05", "comment": "Malware payload (GuLoader)", "value": "926305ef5e60b41dc0f83cc4dfb73bf98c544974fbe3375658a85236d29fa7a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630919, "uuid": "24746554-aecf-4a0e-8e3d-b06eb8ee4205", "comment": "Malware payload (GuLoader)", "value": "054908f6ecdc723933da0c2c8eedca53886c86f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630919, "uuid": "63effffa-42e6-4785-8bfd-ca76a97e68d6", "comment": "Malware payload (GuLoader)", "value": "776fbed680df7689d1ac175c5979301cd3716d6ea06fca274aa28ebdc83103bc881f38817090933afb6ae033ccc74079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630919, "uuid": "bb4f7245-6495-4016-96bc-d31c1ed60dda", "value": "T11DF42311FD29C556CBFA247018BA63F78F1369A51A63C3630360FE8F3553664A82DF68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630919, "uuid": "b6db4831-8f93-468c-ad78-b204fd796150", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630919, "uuid": "60700fe4-e371-4724-a020-52ddcb7d32de", "value": "12288:WblEr2vnTpLHvo09Impr3mH3laistR0J5AtePPW92/rutMyljWM1QEE:WblEr2vnhh9IKr2H3labC5AtSW9Q2pQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630919, "uuid": "5688d4f9-fd2a-4d9c-8b24-7b3ac6bb86dd", "value": 725864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630919, "uuid": "746c2b5e-0e31-45b2-b534-e801ce1abb6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630919, "uuid": "3c7b236e-d8bf-468c-94f0-c60274ce5950", "value": "b2e998cbb14e999168693fd332cf00e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7784c311-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645610444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610444, "uuid": "23add3b3-70e0-4121-adb3-a6401444cdc9", "comment": "Malware payload (SnakeKeylogger)", "value": "d51f8d1a14e6c4e4b915f56390e68628", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610444, "uuid": "fca1d380-03b3-4910-ade7-8e39ef2fa4e2", "comment": "Malware payload (SnakeKeylogger)", "value": "939b1cb622025ddb366bb715af0a0de2b61e231c8891af3a7dc849a77e145561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610444, "uuid": "54934270-f799-40a1-8de6-5d4219b40ab7", "comment": "Malware payload (SnakeKeylogger)", "value": "09c81a4206ea3bcacc2e6ad262e9017c5822a526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610444, "uuid": "73dbfa2e-5d28-4217-a80b-322f85bb3dce", "comment": "Malware payload (SnakeKeylogger)", "value": "0a08f647fda3a5fc71bd278fb72fecac7edeb99d4d503613115d0fe1db9db20c0a914131f1e56bad512e146a487b1c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610444, "uuid": "bdb0ac1a-6863-4ab1-ad8d-edae4a246c65", "value": "T1ADC4023533B42D1FC67489F8429A728053F1461B6157EBCBBCC233CE22EAB955A07657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610444, "uuid": "75810ce8-95f4-4042-abb0-1253a8f9752b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610444, "uuid": "ee186248-6c28-46fd-b7d5-36b7bf45ce92", "value": "12288:H83wL/CnQT37T4PNaFsxv7mTncrYrWTpL6wm64oK4HPFo2UEjB1YuJ6VVtrXHfMR:UsOtwRgr4psBJGITLoKqoLXWYkreBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610444, "uuid": "ba056add-d3bf-4d81-b55b-dae3c1510bac", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610444, "uuid": "79f66bde-e010-4d06-bed6-8d5cde450693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610444, "uuid": "d638f207-7953-465a-a1a6-d6177ba3da4b", "value": "d51f8d1a14e6c4e4b915f56390e68628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3d485c-9477-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645600149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600149, "uuid": "cf7f44e2-ebd9-4148-b33e-000aa2974d8b", "comment": "Malware payload (Mirai)", "value": "c97d99348b7985b2ae737d487de5cc29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600149, "uuid": "c6216537-6ca6-4cbf-bc57-73507e117712", "comment": "Malware payload (Mirai)", "value": "93b8d9bd5d26e33fb4e3b2dcb03f27e9f147b75818b4d3b21c6b3dcc0844478c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600149, "uuid": "d45f3139-5411-44cf-9207-f9d7c20e59e1", "comment": "Malware payload (Mirai)", "value": "207950df984db9c624051a26eb642587cbfcacd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600149, "uuid": "75edf355-9942-425b-94e2-cbec6efba979", "comment": "Malware payload (Mirai)", "value": "9493fae93a72c8ff865bc08cbde5a456906d7f5f7083b59d28daa1ba72664463dfed7054ad6a4fd0d487f12258b844f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600149, "uuid": "d0ea037f-432c-40dd-8467-6a1192ff441e", "value": "T1BC23F2F5C513F251AE741073EC7C0783A43A3FE8A9533036F25B86B6F595A5389B8162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600149, "uuid": "c568db2f-299f-4ab3-a1d6-dc19328e743b", "value": "768:bk4afxWvLIhOoQshHYJYBT49bR3lJPbXLxC5KvMuCUG3q3UIoOScrPPjKZ/A/lMY:MxWTbDgYJL/xCwvToOSczPekeJkBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600149, "uuid": "7d0fa1ad-7d3d-4ca0-8228-8e9fdb7c0e0b", "value": 48576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600149, "uuid": "b92267cf-327f-4fdd-bb4e-30714c2a39f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600149, "uuid": "85bffd34-5621-4c66-8b16-825b75dfb800", "value": "c97d99348b7985b2ae737d487de5cc29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4d55c4-94b2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645625701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625701, "uuid": "6f83e6ba-8621-46b9-8227-0e0dd9264b26", "comment": "Malware payload (AgentTesla)", "value": "62841c50afb26497ca4cbee6178536f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625701, "uuid": "72a9b39a-6c74-4584-82f2-2bc9e7b6857a", "comment": "Malware payload (AgentTesla)", "value": "9425182f8cd91581f58f39f0cc23dcb40e7ec459fe486c9c2c1582bc60f7079b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625701, "uuid": "a011cedb-1539-478d-911d-22f2cfe532ea", "comment": "Malware payload (AgentTesla)", "value": "37e4d7f088e69d3a39ebd01fa1a918746a4be49f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625701, "uuid": "300b2784-a2af-409b-9584-80bdc74a387d", "comment": "Malware payload (AgentTesla)", "value": "65191ff18f3764f59a4878fc9bfc1bbf3c2ab7d636f96a7a3608c8f14f48574d7d8c4f6861cade7ce7aacd392f2ef279", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625701, "uuid": "b8a883a4-693a-4a61-b02f-409d03e01d7c", "value": "T11505128B24185B03CFF95CF428E5A4405BB4EE29315AD7C8BDCAB5DB11FBBC18642267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625701, "uuid": "ce0195e1-5402-48ac-8805-24d56e297c6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625701, "uuid": "f101cb32-4c6c-4886-9288-1dbb9f7924c3", "value": "24576:6K777777777777SGYUzXAb+x8SPMiroA83IPn:P777777777777bYo2+6SEhA8YPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625701, "uuid": "c33a484f-bf3c-47be-bd4e-6abd6349f4d9", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625701, "uuid": "f525895b-e7bb-4af2-b8d4-97099c9fbbd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625701, "uuid": "2fcf3013-b12e-4edd-a826-efb6e7daa66a", "value": "SecuriteInfo.com.MachineLearning.Anomalous.93.22198.25476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c797ca-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645623971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623971, "uuid": "8b5d9972-2218-4000-886e-b0d859255f2e", "comment": "Malware payload (SilentBuilder)", "value": "ae5a2d42c67ecfeb2caeccf09215a604", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623971, "uuid": "d28413e5-0e06-4d97-bed4-94cc98254d55", "comment": "Malware payload (SilentBuilder)", "value": "942da6258a7dce6b29b95307ccd6f7b1570a9ce586395a40f8a68856f88528d1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623971, "uuid": "48f403cb-8f45-4216-9809-4e710862d668", "comment": "Malware payload (SilentBuilder)", "value": "17dee8f32b7bbd278e444c3b551e42425bfd82b2", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623971, "uuid": "2db743fc-ca73-487e-aeb5-12c34185d795", "comment": "Malware payload (SilentBuilder)", "value": "d2b091e71049a2f741c4c8e83dc7317d9afe41b523aa93b44798f5335a9f7badbbac03a32eeed401aa956ba5dd8714d7", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623971, "uuid": "3091c4e3-ef4b-4bd7-8bac-5342fb921c6d", "value": "T15944C04AB84A5C35FD45C3BC8983C7CD84E5AD3A6B5B815E4D28332396B3EF416025EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623971, "uuid": "3e8ac4c3-1fda-4273-b6ed-6e525575d452", "value": "6144:EKpbdrHYrMue8q7QPX+5xtFEdi8/dgUThvsiKIjvl5fd1Xh8rsoX/w/0J:UhEXs5fXR8rsNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623971, "uuid": "a1a17957-0580-4d27-8abd-c357992956c5", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623971, "uuid": "62aefaba-cb19-404a-bb86-82a426394c88", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623971, "uuid": "00e8890e-5e59-4254-ae12-ad4d83974280", "value": "Kommentare-67.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789ad0e8-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645610446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610446, "uuid": "8761a2f2-c003-43b1-ba42-2902356a22be", "comment": "Malware payload (SnakeKeylogger)", "value": "e3dbc3a2be9b732da8caaa16837d19ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610446, "uuid": "0de2daaf-c458-4478-8eeb-08256da793ec", "comment": "Malware payload (SnakeKeylogger)", "value": "94ad9beeac4d0fbe0af046f2b3f0eaa606fd30e17f04fd20b430361b69dd83c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610446, "uuid": "90854cf0-04ec-4776-84fe-0a377bcbeae1", "comment": "Malware payload (SnakeKeylogger)", "value": "1aeeffb427b89f4905538d0faf0c938226c479c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610446, "uuid": "73bc4333-169d-42e6-b268-effbbf2b7b5b", "comment": "Malware payload (SnakeKeylogger)", "value": "092f494a317ff56d4e8cecba5b0209cb16cf1558621223954f64f7099f76fee5b72c4ad2b8417b4999a1a202148c5e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610446, "uuid": "9ace8263-3445-4895-9823-e52ef8ce467b", "value": "T1F584F11A5365A697D41E0F3AE472C30083B5FD81A607E3675BD5B8AB3CB33A00A497D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610446, "uuid": "f4e9f06f-cc8c-4172-aa1e-2021bdfb1c06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610446, "uuid": "7627046d-9e45-4c9c-82e9-52b1882c728c", "value": "6144:2mcYrx33tvJ/xaWAA9EnrYqICoC7xJeUrkekSh5Ebf/OComLNjiwRvSVu:1Fxz99crNHDQekKubEmkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610446, "uuid": "b5561afa-9c59-4df0-8e4e-9c23ec7ed8b7", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610446, "uuid": "2868b02a-0197-47af-af74-cada56af3cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610446, "uuid": "669d4c43-9679-46d8-910a-45d5f9bd3afa", "value": "List of items and quantities.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1d0d01-9476-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645599585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599585, "uuid": "807bf1d9-4fb4-4fb6-acb8-84fb43ee1009", "comment": "Malware payload (Formbook)", "value": "6e3dff6de68bbdea1ae0d933c8f0e12d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599585, "uuid": "9e186117-0a91-41d1-9db0-be52141b3120", "comment": "Malware payload (Formbook)", "value": "951abf2f4116821009369b593b8b56f353bb6176e7574b44fcb448eaea6515db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599585, "uuid": "27959fde-05ab-439a-b757-24550e82f664", "comment": "Malware payload (Formbook)", "value": "a7ae1b92f56bbc71126b65f291b48a06facaf76d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599585, "uuid": "75288879-4b04-426a-ab74-d89ef130750b", "comment": "Malware payload (Formbook)", "value": "179efdfaf019ba13c27c61077ef4e10027def77fd3ec130fb8695bf2362be566bb2f4d0b18150161a2fbfe48ceba9d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599585, "uuid": "1086edea-5e00-4d49-aa6e-ef13f7056878", "value": "T1ACF49D18F7525AD2E89546BA9BF523012351FAB00CDFD20B75DCA43D86FF3A93E80169", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599585, "uuid": "a76a9ca5-d3ee-4908-94dc-513cc6d3b519", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599585, "uuid": "13f976f1-2914-4c1e-8740-5264109a7007", "value": "12288:JdSpuu7l3hjgGa83bzH22qla5w/yXbxlihQ9RlewbD0ii:JCuYlxjF9bzH0MW/IbxlHLxD0ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645599585, "uuid": "2e420c90-e17e-4c9b-ba74-a14638188941", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645599585, "uuid": "77e5789c-a00e-4199-8b80-873378ec86ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599585, "uuid": "a6886ec3-08e9-4d8b-b5e0-535d097260d8", "value": "SURENDER BL.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d9ae35-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645623724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623724, "uuid": "0a24124e-13bd-45ac-b7c6-782d5c26214d", "comment": "Malware payload", "value": "1104a9c9b1518fc716af3eafe5d7b950", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623724, "uuid": "4a5f62d8-04e0-4b29-87b3-f389a535d7ec", "comment": "Malware payload", "value": "96077c533e59e3b8cf38826e5e37e35f1f2eb44d356eae6575223158b565198e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623724, "uuid": "6a3ea1a7-5c7d-4ecc-8f54-2c408a1e18ba", "comment": "Malware payload", "value": "49ed6a9be432fe563c9fe6242aa952c4e399cb5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623724, "uuid": "9e27e49c-cc53-48b0-ba60-92c30c1fc8f6", "comment": "Malware payload", "value": "3ddf0c3f640ec81d2b4abf47e3726a2e44e0214b40a3c4030be7a73aa09157b1623204198ddfaf1a133ff902e59e9bcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623724, "uuid": "f3586446-1e80-4d8d-be8f-5a7939d3d0c8", "value": "T1B305C008396B5F3DF1B18BB21DC4ECB4BA99F7231C08B37D78516686C6A1B809953277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623724, "uuid": "87e81ec2-9dc1-4ad0-997a-b489cfd65610", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623724, "uuid": "538c9d62-99e8-49cf-8c26-2e2e46f66159", "value": "24576:SK777777777777fSV5KyphHSqREvqPGXsrOZM6M6l:n777777777777c5TmqGCPG8rSMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623724, "uuid": "12580c1c-967d-437b-956d-15b0a3b443a9", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623724, "uuid": "a83aead0-01e4-42dd-91db-9d3c148ffd75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623724, "uuid": "f846504b-8234-49ce-8e35-c91982fd49fd", "value": "1104a9c9b1518fc716af3eafe5d7b950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129fd063-94bf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645630891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630891, "uuid": "7f240a2c-c48e-4cc2-abd2-76d4773d5c95", "comment": "Malware payload (AgentTesla)", "value": "27762895771b5cea4273995f715dfb01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630891, "uuid": "fa526eed-e942-4416-a7f6-7cc6a5382236", "comment": "Malware payload (AgentTesla)", "value": "96d9ec3b7719d17680ac51310318790e8fc421c597eeef6a6c0faf7e98f6c97a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630891, "uuid": "be290476-71db-44a3-af5d-396521b37055", "comment": "Malware payload (AgentTesla)", "value": "e75b4442cf981527f55c3a8867a7e127b1ae9513", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630891, "uuid": "7a8b9342-a671-4259-b28a-1fb8a49d1de7", "comment": "Malware payload (AgentTesla)", "value": "15fbf884e05a8201f4a7a51c8aec98ef6c83734602f155fda614d973a89370c094422984218ef327f7b05775c45d7a78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630891, "uuid": "c2dee9f4-ba52-455b-a592-9b13af7cb77c", "value": "T1A315CF4829AB5F3DF1718BB219C0ECB0BA59FE331C08A3BD78517D87E675B409842676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630891, "uuid": "e15c5b38-49e8-4827-85b7-5349682609c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630891, "uuid": "d3ad35c2-2436-4f2f-8b63-07cfafd759ef", "value": "24576:xK777777777777d5rQ9cJ2ZEQV2B1jBHbB:I777777777777bQeJkEQ07jNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630891, "uuid": "e78261d8-920a-4f71-9197-c85f1711bf92", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630891, "uuid": "799aff88-5002-4e2a-b4a7-b9d3b377c94c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630891, "uuid": "d5db294c-e2ac-493b-a2b7-a8e95c668cb3", "value": "27762895771b5cea4273995f715dfb01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751b383e-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645619030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619030, "uuid": "67081491-e867-4b87-8f4e-9c5d326caa8a", "comment": "Malware payload (SilentBuilder)", "value": "4d64d5682e219cfdba6726dfb5c070c3", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619030, "uuid": "66d9fa3b-e199-486c-825a-e345eab55375", "comment": "Malware payload (SilentBuilder)", "value": "97443b1393bf73fd1ff09ee302af566531158b2e36c6c947b4167b9c9e5b5ceb", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619030, "uuid": "495a16e1-dfc5-4e73-acd5-feba84f20058", "comment": "Malware payload (SilentBuilder)", "value": "c7be014b4b62943676ee7de13841a030efd1e129", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619030, "uuid": "10869049-ef3c-40da-a52d-fce8deb4e1a9", "comment": "Malware payload (SilentBuilder)", "value": "9d7e1ada4fb331003696528978187553bcf3f2558ccf4a1c3335bb392ed345a29d888c5c19c51d98b9dda49a3e96de1f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619030, "uuid": "00d6b192-01f6-4d72-b056-01cd498ea52a", "value": "T1C353184ABA4A991DE51587358CE747E96732FC104FAB0B873A49F3257FF99D04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619030, "uuid": "1c87c777-bd29-49d3-b46d-9d256bc3bbfa", "value": "1536:sp+KpbdrHYrMue8q7QPX+5xtekEdi8/dgJ5+4kKF3XOCmGanK8oWIG:sIKpbdrHYrMue8q7QPX+5xtekEdi8/dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619030, "uuid": "bfecedad-7406-4841-8e95-6d5598a05b3c", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619030, "uuid": "aa6c27a2-3789-4bfc-82bc-08e0ac6a74d2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619030, "uuid": "aa272d58-e21f-4939-9f5e-98339e4d6fe1", "value": "Details-99.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090cfe38-949b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645615413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615413, "uuid": "1227d02d-6d45-437b-acbb-08332eeddb03", "comment": "Malware payload (Heodo)", "value": "4f1ea97aefccdb02f9f9014c4f5395da", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615413, "uuid": "1e110b52-b738-419b-8bb9-5cb9ba7a6fc8", "comment": "Malware payload (Heodo)", "value": "9753ba36b64ef079a88be3e756e4ec00940709fc1a3e3ff5c6c3c0d9edc463f9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615413, "uuid": "60f64dd2-55a8-4049-80fa-c843e1dab5fd", "comment": "Malware payload (Heodo)", "value": "f826d19986b561477a9a30434c9f9cb212403375", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615413, "uuid": "f972b92d-9172-4005-9862-13a9cb8b1bd2", "comment": "Malware payload (Heodo)", "value": "2cd9cffc9d2441580a0698a1bcc38421b299a1a6120650636d3c3e5c7d6d2b213603683a94d827fb2f58263cb930c966", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615413, "uuid": "79b451c9-5e12-4c6b-a6f2-6717ca9ab333", "value": "T15435BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615413, "uuid": "fc10c471-5ad5-4c8d-9d82-88acd2ebd66b", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615413, "uuid": "c011089f-5476-4dbf-8e8f-b744fc8243b6", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/1TewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/1TeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615413, "uuid": "44a86ff8-ad6b-48dc-a3e5-b0903865fbd4", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615413, "uuid": "e8914180-069b-42ab-bde6-56998e90ca4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615413, "uuid": "5f75a589-a6b1-4c61-a1c9-2892beb5964d", "value": "wjyyp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae2432e-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645624435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624435, "uuid": "8b1e63ee-aff1-40b6-97da-588523663abe", "comment": "Malware payload (Heodo)", "value": "b3d2320d53abb14726ef68fec389c01f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624435, "uuid": "f4b299be-c8b6-48c2-b145-7a06dfcca345", "comment": "Malware payload (Heodo)", "value": "97559f6fb4cd712841f28cb5987b5b92a5d387e3e6cb440d15a5761560872806", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624435, "uuid": "e2d776c9-abbb-4e0a-a7fd-54cd2ff5a11a", "comment": "Malware payload (Heodo)", "value": "850f2faca43835db201b9ad4d34b03af33bdebdd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624435, "uuid": "c5cd325e-4131-4fe7-a7ef-3be66dce50b5", "comment": "Malware payload (Heodo)", "value": "f77c05ac17c8bbc136875a3ddbf4cab6e8eb00756499f651c7bbec2f4ebcc9bd84765c7ee9846531b6434aff6feac51c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624435, "uuid": "1b5d8c41-2d1e-478f-b58f-521f6eea0f31", "value": "T19235AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624435, "uuid": "e526dfa9-abff-4770-9cc5-b6aea1698dad", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624435, "uuid": "5f10f5aa-f93a-43ef-9803-5c65437b5b97", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNDTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNDT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624435, "uuid": "e902dd41-2e13-4826-aba8-e076bc629ecc", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624435, "uuid": "d98b2b41-92a3-44e7-87e9-08db8e1ebe4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624435, "uuid": "c1504ce1-c023-4d19-8aec-472281ee04ae", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77bb9a2b-9476-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645599707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599707, "uuid": "ae1a1302-eaa9-43d7-b583-3c2b9d55ad9a", "comment": "Malware payload (NanoCore)", "value": "ccebb65128c397c3ee79265ed6399977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599707, "uuid": "3403b1e7-4e67-4567-9499-22fc399150e1", "comment": "Malware payload (NanoCore)", "value": "976984034400d4aad28471d6dd3183f86d4b2d21aab8663657a6b4ca8e06c02e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599707, "uuid": "b3887c46-43eb-4d3c-b901-8f6805df91a7", "comment": "Malware payload (NanoCore)", "value": "8d9eab58d2db14916b3fb29f5eb27bc681ee8e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599707, "uuid": "37f39efd-f0ba-4608-8960-3b7d7b94b29f", "comment": "Malware payload (NanoCore)", "value": "57535e28845aacc6b40772b17cb3e92ca6a25a92ce6174b43caf8cfb62f3176271f28997eb1627929e2c71bf4cedf650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599707, "uuid": "7e592481-fa58-4128-93f9-5d62fe1835e7", "value": "T19224D0167BB94A2FD2DE8A7961111142833DC2E399C3F3EF58D850B74B267E54A4B0E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599707, "uuid": "0694d732-de88-4bc9-ad5a-7e183429a683", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599707, "uuid": "85582ea4-a57f-4945-b1e4-edbdfd5f8c21", "value": "3072:EzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HItoexjRXJcrYlBEzVGGhyuPmJE:ELV6Bta6dtJmakIM5I/Jc8lk8GAuuTny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645599707, "uuid": "4a8948e6-4397-4cd1-bee3-c6f33a345bf2", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645599707, "uuid": "719bdaea-6170-40c9-b0a6-40552a3b181f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599707, "uuid": "131b8512-9df6-4ff6-9feb-62b89c08038f", "value": "976984034400D4AAD28471D6DD3183F86D4B2D21AAB86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8f4003-94bc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645629993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629993, "uuid": "f19f4f58-889d-4164-8871-0c8f3023178f", "comment": "Malware payload (RedLineStealer)", "value": "9e40dd044fe2e9a146932ecbcdc7b36f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629993, "uuid": "ed103237-636a-40c3-947e-a5570385389a", "comment": "Malware payload (RedLineStealer)", "value": "97a1aa42e6ae04842b0729acc0f14911bd2c436107f451d8faf42c1ae963f9d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629993, "uuid": "de7c3cb4-ace8-42ea-8eec-c4edbcfcc5c2", "comment": "Malware payload (RedLineStealer)", "value": "f1b0b89b51ee4cc4b680fc5aa970d193f21da925", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629993, "uuid": "39c8ee2e-4b12-4c88-bdc6-61e90f768f3f", "comment": "Malware payload (RedLineStealer)", "value": "fe0f532a1c8f49e6208684d7e44ae823c9fcf2baa7026f88976d1d42a1b02c101e81385185be1186f72d9c8418d29d8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629993, "uuid": "c3f6558b-f2fd-4898-b1bb-cef539ce81c1", "value": "T1803633BE7295CD0CCD95573337C3426A0C39E166D26042B637ADE66E8FD5F098F1A08A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629993, "uuid": "14315813-2e73-4aa8-8d89-57e2f4745ddf", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629993, "uuid": "7557db11-a6ff-42ea-968c-52db2f53c139", "value": "98304:ywWpE1n6ng9GiF8ENCYSVBKv4ZGXET73i+Zs7LCs4oGNoQRB:ywWp6n6ng9L8JVBKQks67LsoUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629993, "uuid": "09524f31-b63f-4222-aaf5-de7cea0de217", "value": 4880176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629993, "uuid": "86cf5499-69e7-47f1-bd18-5f793929e98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629993, "uuid": "ddea13c5-edb0-4b7a-9a60-6ddc9c7db3ea", "value": "9e40dd044fe2e9a146932ecbcdc7b36f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7344077e-94ad-11ec-9275-42010a9c0029", "comment": "Malware payload (a310Logger)", "timestamp": 1645623322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623322, "uuid": "0531a146-85a7-433d-908e-18abd88a4569", "comment": "Malware payload (a310Logger)", "value": "fe45ce8fbd888c1e77a3815a516e1cde", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623322, "uuid": "2c26b82b-b25b-430a-8b7f-8fb3d865911d", "comment": "Malware payload (a310Logger)", "value": "98ff3c6514c7c3282bdec92ccc6a916c1fd978f69733cf80e1ed75672e4ffda3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623322, "uuid": "10348fff-330a-4456-b185-0d735a0d01c1", "comment": "Malware payload (a310Logger)", "value": "761ea13fd4e242a682aec632ddebecae91e6d2ae", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623322, "uuid": "a3231a7b-be06-40f0-9e1d-0756f0014fdb", "comment": "Malware payload (a310Logger)", "value": "4676ca32f2d271fa3b48662711e0e5651453d576ea7888fca343aa9c9a921c7b943ddec5422b76d065c54929a3e638b2", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623322, "uuid": "737820eb-6f8b-4dbb-8959-4623ce394df9", "value": "T15335E14839A71F3DF5B18BB21DC0ECB4FA99FA231D0863BD78512646C791B80994277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623322, "uuid": "96380d6d-dad1-4ae1-9b87-c9b639712a24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623322, "uuid": "1b29f28b-24a0-4319-be7f-7b90d1e4ab5c", "value": "24576:wK777777777777b3vpyAhyG+sy5DVMz38EaCSkvn7nteJfW18Vsi84p:p777777777777b3RyAh+VDuzaCSkDtaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623322, "uuid": "f5162b32-d563-4d3b-b2c8-a552490e99b9", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623322, "uuid": "8190a59e-c2b2-4d18-9c4e-a1f6134e4ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623322, "uuid": "c6e02b69-1453-458d-9807-9b5fd068f3b2", "value": "PAYMENT_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ff5599-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645630111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630111, "uuid": "886f860c-1895-4ad3-9920-0588b7a41027", "comment": "Malware payload (Loki)", "value": "5b9b7ba37c9d8d63fccfa059a368410d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630111, "uuid": "69d8306b-d574-4fd3-8e78-0ec98aeda14d", "comment": "Malware payload (Loki)", "value": "995e9f1b65017c03da46a8e33fe7b50f833111b12f6d17116a49c682f5edd9c8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630111, "uuid": "7c285e8e-4a6b-4d64-9b47-9e0fa459fada", "comment": "Malware payload (Loki)", "value": "4dc08999f95a3fc53ae53968be32ce6128f21bf0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630111, "uuid": "76d147dc-c9ab-46c1-81b6-f9d54ba5dff2", "comment": "Malware payload (Loki)", "value": "e7a378eedc52b50ab3c9466abf2b4911a34e54f2a2099ef01fba3b745b06a1a90f353c1845491173cb33ade850cdab2a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630111, "uuid": "ddbf859a-7ce7-4c6d-9102-b45129d462b3", "value": "T17B25B5887190F1EEC8A7C971D9648CF4EA513C7AD31B910F50973D9ABA7E883DE150B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630111, "uuid": "b5b632b0-4fb7-4f62-b02e-d58290f5da6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630111, "uuid": "eacdd390-5750-4eef-82e2-021ce0fdf225", "value": "12288:9oK01IGETdoifPh6Y+BKdDi0RB7G3irVOXaGnnZoLZJkOoUPfz/PlSsftWv8BHvB:SPITZx6YoKBB7Gy5KnZoLMfR4E1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630111, "uuid": "af946301-7aff-46da-bf3d-b2163dc1b8e9", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630111, "uuid": "100c95b1-fb16-4465-8940-9639747b69d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630111, "uuid": "99b12bf5-9eee-4875-843c-2d54c2931b11", "value": "DHL \ubc30\uc1a1 \ub3c4\ucc29 \uc54c\ub9bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47118d08-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645618953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618953, "uuid": "8b4283d8-7867-4456-9776-6672a61c610b", "comment": "Malware payload (ArkeiStealer)", "value": "15f70c1555452104f84910d711ace2b9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618953, "uuid": "f2fe100d-57fe-4fed-b424-be5f04b47170", "comment": "Malware payload (ArkeiStealer)", "value": "9ad5db9f1437ee5bb03077090861e13efdcca1dfc46133f4b77504add9f18c38", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618953, "uuid": "d229d723-d100-462a-94f2-1881a7d7e97a", "comment": "Malware payload (ArkeiStealer)", "value": "cd2a074def7a19346c92ddbbcbeb31ed22c03dcc", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618953, "uuid": "a62267a6-cc4f-46e1-8f69-10e17314f30b", "comment": "Malware payload (ArkeiStealer)", "value": "67a98a6fcae90004bed0523ed9351cc724fb8740c6a8569eba91a75742fa911471e6a777db326518d9eee07aee4ab471", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618953, "uuid": "be2f43da-5f93-4000-8e98-5e65a3801066", "value": "T1DB64AE10AB90C036E0B711F8597AD3BCB63E7AB15B2465CB62D51AEE16387E4DC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618953, "uuid": "7ad39387-5216-4f22-a199-a9579741729d", "value": "32f2c538eab8007c123c6eaeceead9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618953, "uuid": "66080b4e-ad4a-492e-aa61-324591c0db45", "value": "6144:Pi+GbtNs9LxKhikzsm5MPSS6py4Pqm+oObYMIZkjDAH455kc7nM:K9toLogkzsm50vYP+1bYijDAH4DjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618953, "uuid": "6586b34c-5ba4-4b36-b52f-b32cd86cd594", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618953, "uuid": "b547fc14-830d-42f8-b0ad-9378e7de30d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618953, "uuid": "a89fa056-f3d6-4fdf-ac69-057c27ff1eb4", "value": "15f70c1555452104f84910d711ace2b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c4e501-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1645611117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611117, "uuid": "cdaac7db-a6c9-45ca-b60b-978fd5f656e3", "comment": "Malware payload (Gh0stRAT)", "value": "dd589f6170cb475514ac44958ab79a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611117, "uuid": "24a09560-5cbc-486b-bfe4-03c452c2ef4c", "comment": "Malware payload (Gh0stRAT)", "value": "9bfca68b39d2a32135525b028ee122e43407d5668edfd6d7d709700241b5d143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611117, "uuid": "f9429e11-0d3c-4601-87af-1cadc3ebd4df", "comment": "Malware payload (Gh0stRAT)", "value": "f54899fb4ccb330d161d096d528af21105d683d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611117, "uuid": "5e45c12e-ae2c-4dea-a79b-c0b7eb213e9c", "comment": "Malware payload (Gh0stRAT)", "value": "bbe6aeed9ee749e98d0752f8290fcbbb02be7718f337523451429ea5ea797c6d5e28aabcad07c3386861d61d5364e715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611117, "uuid": "e73ffd86-9f5d-4d6a-9f89-4e15c4493c97", "value": "T1D2F36C01AD8300B7F494183C82E927FB8F7F6C533A86BA6FEF14D95504A2158FA517B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611117, "uuid": "d4273663-cb08-4b31-a868-9612628bfcaa", "value": "49f273757d26af21b1811697c1313d94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611117, "uuid": "00503c51-f427-4375-86ec-a34680556c44", "value": "3072:siQteXts2cV9nCtXL/WlDziSuLjAzhGr2OsKn7:ZIVlC9CzFWjAzhGr2Op7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611117, "uuid": "74001679-8569-47f8-b3c7-1904ea870116", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611117, "uuid": "25333bf6-0b6f-4ba3-85ac-ac368d53dcb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611117, "uuid": "aaeff131-2849-4a0a-933b-7c89853cd1ca", "value": "dd589f6170cb475514ac44958ab79a9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e210013-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619018, "uuid": "cdf55208-872a-4006-a065-870da33b2808", "comment": "Malware payload", "value": "574ad809496cca45e13093ca7c01e853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619018, "uuid": "6bc528e2-5bc6-4f8f-8721-fcf37379c55a", "comment": "Malware payload", "value": "9cad27165a2cfda1afd54a54298615d75fd802695c22068ed51883690c954098", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619018, "uuid": "5e830505-734e-4d72-8701-232c71fe687e", "comment": "Malware payload", "value": "c827a37ae44ff3c138ea0b6a16cdb59597c68749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619018, "uuid": "270ea601-5b39-4567-95a8-668702052600", "comment": "Malware payload", "value": "604d519065d9904e87cad94a91d7fc82082fb8c336f914c927972c8cd14cac1d651dbffc2e7601ea963bf0c9469828a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619018, "uuid": "27deaed0-b756-4082-99c1-e4bf7578d5d1", "value": "T1D3442262BDB72607D88715B208B06A41EC3FD416F740AE547A7F8D8399F65B190A33B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619018, "uuid": "9c29b96f-970c-4573-8e54-88d18831918d", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619018, "uuid": "c5df3b70-a2d2-4abb-9eef-7db92969b3d5", "value": "6144:tBABAdbouCA9dctS6HrFGDrbyyu6vzTr5dNKTToAH6s:tmB0OCW1gDpu6nrcVas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619018, "uuid": "82b4caf2-8ae2-4637-af12-77f6db95b099", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619018, "uuid": "46b7ff14-ae3c-411c-8254-b932d6245261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619018, "uuid": "8a4b0baa-b881-4c94-9b50-bf7e7d3de35b", "value": "574ad809496cca45e13093ca7c01e853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1074fce4-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645619291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619291, "uuid": "06aa40be-ad46-482d-a2be-517edebae084", "comment": "Malware payload (Formbook)", "value": "3b5490aefd3ce67343e08be3e66bb5d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619291, "uuid": "adffa4f1-7fea-468d-b23c-30ff5b00b7b3", "comment": "Malware payload (Formbook)", "value": "9ce82a229ef8536047a01fcd3901205df9ad5c8354746c590892503c9c617d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619291, "uuid": "53e1c428-1c23-40ea-9cb1-1f58caa467fc", "comment": "Malware payload (Formbook)", "value": "d37ab1533b12c4cca20dfaf14fe87fc153f47b02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619291, "uuid": "34c0243f-3f90-4b9b-b8d1-7f3a866e7a2c", "comment": "Malware payload (Formbook)", "value": "4724f26b6f3ed0560713cef5284fa60db13cf7decaecc8e988b36ef296fb0a1fedcec1cc97d2f8b8f8d1aae8f177b262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619291, "uuid": "b85a2617-b295-4f04-9856-0e3787ed781a", "value": "T16E84128635809443DD9A0F31003FAF648779EF2226A554936BE1BFBF1E372C664055BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619291, "uuid": "fb472fa1-f711-4dfd-8b5e-7de1727d9934", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619291, "uuid": "7c9475d6-ec5b-47fe-b1ec-190e4c74cd5a", "value": "6144:/xDhU76BJzteuHXo6WVgXeDI97YYpZJCUIAw40p8aAgLUOdNFda+ZDgSg/d4G9oA:3U74eao3V27hJA140p8aAgLxr3gP4bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619291, "uuid": "70e8197e-53c4-4180-afe0-64c773ea7f42", "value": 388735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619291, "uuid": "e9ede42c-5df0-4a0a-a278-0de97d6adbae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619291, "uuid": "3e97b6a4-bf6d-4d8a-9109-18c81d39b50c", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fc0097-94be-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645630732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630732, "uuid": "481df031-13ca-4d57-844b-58e07383d8f2", "comment": "Malware payload (RedLineStealer)", "value": "4f281adb9b1114f7d2284bd00c33d920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630732, "uuid": "e7445c87-c8bf-4288-949c-d8c8634b5b46", "comment": "Malware payload (RedLineStealer)", "value": "9cfaff53d01cea67661599d0dc9032ea990ef8d88f090e6028d82e9787ef66c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630732, "uuid": "01aa242c-c8da-4179-a057-023c59d442d5", "comment": "Malware payload (RedLineStealer)", "value": "051d656f8214979f74567bc3644e48f0df3ab5dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630732, "uuid": "00dd4010-9cf8-4cff-9b62-f5b21dfc2948", "comment": "Malware payload (RedLineStealer)", "value": "67e31f70ba39c436122ad83bc00f0438ee9640b845c64b01157e010361d0805039f5bd0e8895886b4a9f7bbec8ff6bbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630732, "uuid": "697184ac-a0da-42f1-a914-29c039fdbdca", "value": "T159F4E100BAA0C439F4B312F549BA926DA63F7AB15B6461CB53D51BED57386E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630732, "uuid": "cdd68c88-b6e0-41c3-8ce9-abc22e106513", "value": "ecfb8ce0d70668868f462672b03acee3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630732, "uuid": "eac84c57-b685-44c3-99f8-6ce74903dc91", "value": "12288:WjPS92NnzHEVj4NdyjlNhaWTqg129NzBMVDAR9ol+dd8/pAEBsVmgauKmpeHP:WLBzHEVjvjTUWC9NzBCC6+w/pA0sVmoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630732, "uuid": "60bdcce1-4557-4741-bab8-8f3ab1de4581", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630732, "uuid": "dffdc179-7e87-4123-b3d7-8b374703e1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630732, "uuid": "2609e1fe-d00f-4843-b6a5-053fe2488e85", "value": "4f281adb9b1114f7d2284bd00c33d920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a5f502-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645619457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619457, "uuid": "61c9f2b6-a20e-4a63-bfcb-cd4abb4d022d", "comment": "Malware payload (Formbook)", "value": "21c467f17b35432b0e6d384e09e77e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619457, "uuid": "0373528f-127a-4516-8215-afd1f471f616", "comment": "Malware payload (Formbook)", "value": "9d144168607d4e6808be108cf349da625b911307dabab1ea645381a5473deb03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619457, "uuid": "e9379f59-6708-4be5-a80e-ab6c2d40a88d", "comment": "Malware payload (Formbook)", "value": "1fe28204941a586998e721e8ec4df57a353f6b05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619457, "uuid": "3c7cd931-ac1d-4ee6-952a-e36787345880", "comment": "Malware payload (Formbook)", "value": "cd41deb15803b8c8a8d1e37d4908716273691ee145fdae4dc630be880522523aa9e59ec3477f60efde31c014a7f8e777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619457, "uuid": "4094c678-49e9-4ebc-88d5-4723732a1ae2", "value": "T13405C04839A71F3DF1B18BB21DC4ECB4FA59FB231C08B37D78516686C691B809982776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619457, "uuid": "c5c86ceb-df25-4229-a596-6f3167ffca11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619457, "uuid": "07555a3e-0827-4ecd-a2b1-411831be0715", "value": "24576:IK7777777777775rD3CnFWwdrkUA5ZYS86MHrCnA:h7777777777775/3/w+UA5ybhrCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619457, "uuid": "b1d00101-cbd9-477b-b8a5-3a7cad8ee1d8", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619457, "uuid": "c3e39bfa-b71c-487f-ab75-0e00ed1b4ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619457, "uuid": "f4786c6c-3e02-4db5-83ce-f2c32f7222ea", "value": "91JadopM6BYFF0K.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5be5b0a-94f9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645656102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656102, "uuid": "3289f7cc-b4cf-46ea-8769-3c4a288ef6c5", "comment": "Malware payload (RedLineStealer)", "value": "f93b1a80a3ba2862f459d07e563ee0c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656102, "uuid": "762034d5-0bca-4c25-84d1-bedf9ad7d228", "comment": "Malware payload (RedLineStealer)", "value": "9d6df58a98d6702a38fb52a3e7c5155bbc6093d9858b11d6dcc0da3cfcad0c70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656102, "uuid": "a6be35f2-0f57-4c0f-98da-5d6ec4a3936e", "comment": "Malware payload (RedLineStealer)", "value": "f1d752912fd3ff453a06cba1227e81c2c39b2155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656102, "uuid": "3a763314-96cd-4317-9855-84aaa691e3b3", "comment": "Malware payload (RedLineStealer)", "value": "7b0c54d6921526d7aede46f443c2c8c0d6a54e019caf24b060b8d68ce055a01ac16c4c89a944b2166be91d9ce4f822e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656102, "uuid": "7342fd66-dbcc-4640-8825-d7b563035ffa", "value": "T133249403AB095F04C9783979C2FB5D2813E5FACF1731C95A8F05BE6A2CC5396A8CD54A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656102, "uuid": "1a4174ac-753c-4011-8ba3-0aff4bc7aa6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656102, "uuid": "b28cf765-1b7b-44bc-8e66-7d032de522b5", "value": "3072:2qrrcvfvctnbDfpm/s6/7BICPwKlnEbFEYF0Cw1Zh/g:Avnctbk/s45WGiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645656102, "uuid": "b0defcb0-e18c-4288-80ae-07c6fb896bff", "value": 219608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645656102, "uuid": "730d95c4-f4a7-4b79-9ebb-f47567e5c55a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656102, "uuid": "6331668e-3706-44ca-b4c9-4e040c432591", "value": "f93b1a80a3ba2862f459d07e563ee0c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7dd63a-94bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645629971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629971, "uuid": "533a42e6-2ca4-4773-ba38-8391a686e201", "comment": "Malware payload (Formbook)", "value": "13c33dcf766129f15e1362f8edf9a981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629971, "uuid": "6f7d03d8-c277-4182-bc30-b82410777f59", "comment": "Malware payload (Formbook)", "value": "9dc7fcfcf600302dc2fafb21be5a63dea8d15197f29a9af3b1ac200e725d9393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629971, "uuid": "b7558f95-4802-4f20-a055-13fcaec35b91", "comment": "Malware payload (Formbook)", "value": "1291d53e873e10e6fbcf2dd0f7398c62d13f7ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629971, "uuid": "1365c52a-d6d5-4339-b3fe-813ecd7f20d3", "comment": "Malware payload (Formbook)", "value": "dd7ba27d2e41f008353771939bb6d04fd609c73dd11e41e32f57a7a030ff31db04fb0af268f7ebb6dcb5f309e22dd08c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629971, "uuid": "497f27ae-86bf-409d-9149-12037c7aac58", "value": "T1EEA4F82F73BDB896D2EFAA732AE031B1CD7B723A1211279F20724D520901685EF55CB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629971, "uuid": "1424a2f5-c55f-498a-b339-be43c87ba343", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629971, "uuid": "9dc71826-267d-44e1-ad1b-582b679d53a0", "value": "6144:m/NaCwpS8ccw+VvSwLfrNMyg5PBaTV0D1YMNHz0cS8S8YP/ba5r1qDx80kxGdCtN:7WMrymMNHzvS01wx8nxGktN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629971, "uuid": "d4c3538a-21c0-4026-9646-1853fe42f6e6", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629971, "uuid": "8d7884f1-cf63-4441-b868-e0a5aa95fe2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629971, "uuid": "ec4aef72-99b7-48de-ba6c-677b21f4f194", "value": "13c33dcf766129f15e1362f8edf9a981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d92a10-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645624425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624425, "uuid": "fd2086d0-9a94-444d-8482-6dd0858bd445", "comment": "Malware payload (Formbook)", "value": "9f32cc12f53653dd0d2d44b6835deb97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624425, "uuid": "62b36edd-2fa8-41c0-8832-5a17ea73be28", "comment": "Malware payload (Formbook)", "value": "9e3aeccf79c4c92f97410817a161701c59affa07403748695e61fef0d1d082e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624425, "uuid": "0876fb8a-8fbb-421e-92f2-17f229ef28ce", "comment": "Malware payload (Formbook)", "value": "628e4677dd08e2668b095d652e8c9399bd2e87c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624425, "uuid": "c3d98b25-c966-4f08-9da2-45fe9a2bb0c1", "comment": "Malware payload (Formbook)", "value": "4864a763f546d0fc6ed475f3db323a4a2adaf6b473af5de28e38f372af0bf4a8370de25026d9ff7931f902ed280b742a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624425, "uuid": "29f2371b-8357-4b70-98a9-c6e52d2d0966", "value": "T182E49E22F2B28832D0675639AD5F525898267EF07D3CE8451FE83F847F35645392AE83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624425, "uuid": "edecd5a7-a3f8-444b-b04b-2b6fed2ca619", "value": "9a208a82f2ac1ed3524405196188a65f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624425, "uuid": "46634bb7-be81-4613-adae-271315b10fe3", "value": "12288:AqPCASx9alrm06WvcmOEEJCYgFZ83A5W3S2x3pxjsf:Aqa1Ii06WvcyY3nw5W3d3/j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624425, "uuid": "3df57a92-dc8c-4801-8b63-641e79a09b08", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624425, "uuid": "bf07cc70-4e45-46b1-bd21-058e96c0d7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624425, "uuid": "44296541-8b0c-4d5d-8038-c92895786b8b", "value": "9f32cc12f53653dd0d2d44b6835deb97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bb4f64-943f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645575912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645575912, "uuid": "e595c3ea-3079-4b06-a84d-59624e403704", "comment": "Malware payload (Heodo)", "value": "824f883a79f90cc31272bed6f56f2c7d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645575912, "uuid": "04b098b9-ffba-4818-9d25-d171a3518d58", "comment": "Malware payload (Heodo)", "value": "9e437df223986bc07f60c2f3e421c525479cad16a940372b6ef3de70e96fa9b2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645575912, "uuid": "136ba49a-2c77-4c67-b97f-9a1494fe135b", "comment": "Malware payload (Heodo)", "value": "575b007a306d238ef605bdd9a6fd899a8bb1a435", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645575912, "uuid": "d29937ba-2e31-40e1-ba4c-fd9d4d1fa700", "comment": "Malware payload (Heodo)", "value": "d2ffa781ab9aa475171cca022d45776189c0e35d65208846794066e6644a2aa056c24e312e1ebfb30d841f3e841cda07", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645575912, "uuid": "88452f1d-fd1d-41f1-9673-6af978418061", "value": "T10B930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645575912, "uuid": "6ed9ccd0-7863-4131-8748-acbb853ffc57", "value": "1536:O5555sDWZowD9gGtgNnEbzyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbL:syehv7q2Pjx45uoDGTj+5xtekEvi8/dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645575912, "uuid": "ebe56637-1e41-42cc-a1af-9b6492f2497a", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645575912, "uuid": "8b263057-5f6e-4c98-9378-999ff085bbad", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645575912, "uuid": "ff4742e4-93d5-4f40-9b05-87417b7de9c6", "value": "GSE Audiovisual.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc300cbc-9469-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1645594265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594265, "uuid": "0dd8bd86-329a-4c31-b5a5-3627beaf1f7a", "comment": "Malware payload (Gozi)", "value": "c6f9463bba628a9873691bd1f9f94645", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594265, "uuid": "9ae95037-3e5a-439c-aff9-a93b39c85722", "comment": "Malware payload (Gozi)", "value": "9f67885dc039a8378a81b3b4edb035a4e7c0e0a4e128ac4aa60232fff8e67acd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594265, "uuid": "1fe54708-4274-41ac-a431-ddf309e9cbb9", "comment": "Malware payload (Gozi)", "value": "63bf115490eae7045447b740c4682bc10d710e94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594265, "uuid": "22e9ae2e-c6db-4ea8-b784-3358fc60c0f4", "comment": "Malware payload (Gozi)", "value": "c709d0773bb800595b01ca3dc7a0e7d888914519144daf18bc1add64e4149df1ef8275696d4c6008f98555a3df181d9a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594265, "uuid": "e4c10fde-1348-4e9f-8b0c-8782931002cf", "value": "T1D194D0B330EDB17FF29BA637FD04E5760800951AB17991E3B6CA0ADDD4B6DA74128243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594265, "uuid": "16116037-fc58-42e0-b5be-5ece631a6ee5", "value": "b28ff5aaedf54815b1c73bd248288642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594265, "uuid": "2ba6b593-de93-4378-b60d-fffbbd248aac", "value": "12288:EyF2GQcZzyF2GQcZgjnNZdkyF2GQcZkyF2GQcZrhDAcz:EyF6WzyF6WwnNZdkyF6WkyF6Wr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645594265, "uuid": "8d5d52f1-779a-4316-a5c3-7ab8efc23adf", "value": 433976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645594265, "uuid": "3c5c18ff-bfd5-4e3d-a335-fdb22446efb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594265, "uuid": "bbf684fb-6e6b-4e5c-a5a5-7420c25fd38c", "value": "image bmp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b6c68b-94f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645655557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "d96c10fe-ccb9-4030-843f-c1da460f530b", "comment": "Malware payload (Heodo)", "value": "12af38b99482f3fa9e78d08ff7c6c71b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "7d77e76e-f4c9-4416-8dbe-6b6b4e52a097", "comment": "Malware payload (Heodo)", "value": "9fa6552a0872f1d67ef27ff06ce54f892157654e4c1ca3b59380724154195d7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "a4d0ddee-43a2-4df1-9938-4c927300f6d8", "comment": "Malware payload (Heodo)", "value": "d00f3a22701e24ab20cbef14b20a1f48d80f9bc2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "d303122d-7b95-4d0a-9c25-2e15ab597c82", "comment": "Malware payload (Heodo)", "value": "38768372965dd99c807aa4b09dd6bdb519a3a7b4e5563801d4abfd4b169eba5d6fad07a507d4d027799bfcadc44b9fbd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "f15f30c9-e4d9-4d3a-bb89-01aa80de3f51", "value": "T1ECE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "d4f4f1ce-cace-43c9-aac8-e40e84b142d6", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "9605ad36-4705-4e39-888d-c371505ca24d", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKwe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKwLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645655557, "uuid": "75dc55a3-2ad4-46f8-99e7-ee2a2e725317", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645655557, "uuid": "30e6d658-38b4-4aa9-8fd6-1936bc1e04a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "be71bf84-964b-4b1c-82d3-42d9420edaef", "value": "emotet_exe_e4_9fa6552a0872f1d67ef27ff06ce54f892157654e4c1ca3b59380724154195d7b_2022-02-23__223231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3713bf0-94f2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645653038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653038, "uuid": "2eca4f6e-f7e9-4a28-a2e1-45638f25d070", "comment": "Malware payload", "value": "2e346a204d2d0d8a4307a53f3ce2b658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653038, "uuid": "8f01cea8-2d66-4034-a0e8-7bc83025067e", "comment": "Malware payload", "value": "a0a8674bf7493ece3dbf1a890a55ebac36b3345f8ffd14c89fad35abae46100b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653038, "uuid": "1603d5b0-18cb-4528-ae6e-66674dbf004c", "comment": "Malware payload", "value": "df1ec3f085004d3bee856b77ac670aff687fd14f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653038, "uuid": "6030e47b-14bd-490a-ab2d-af562eae065a", "comment": "Malware payload", "value": "76289e9990568f20bfa881e6a77d45cb861d88cecfe558d26481ee0a3ce70a57146505e2ba35118523946d9b16f1bdf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653038, "uuid": "7847e0fc-8355-4867-a425-37e617d927df", "value": "T1A8B4F1D6209DBF18C8619B7164D09F9BB29AFA6C9F0EF2DFCC08F2175529CD091B2854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653038, "uuid": "c39ed63e-e1db-4792-a767-1513868ffcb7", "value": "12288:x9ipBELlLZxJdKH6FskUqyBeyYmD9AuRHyFLeaSjqRuT6vDt:ypGJdtWdeSbohROEDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645653038, "uuid": "87abc544-b376-4408-918e-26d9cf1c5eb2", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645653038, "uuid": "912f955a-0918-48d3-a0db-cea138d8aa8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653038, "uuid": "93b6afdc-5091-4039-9a64-ce9ce919ce5b", "value": "ulock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0278541d-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645630005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630005, "uuid": "49b92603-22e5-41ab-980e-e6fba2d2d139", "comment": "Malware payload (RedLineStealer)", "value": "1c30f848d8f3f3f4584da4c51094fb9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630005, "uuid": "790d7c14-0ae1-4a35-bb32-3b7cba11367b", "comment": "Malware payload (RedLineStealer)", "value": "a0deb710f888eb526c74b58f46b5f3a57eb5e62c5753dd6279e6115f3269b411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630005, "uuid": "f11fbf76-d759-497a-be5c-035634ae8148", "comment": "Malware payload (RedLineStealer)", "value": "e85bce6f21ea2c0f91e26fbf329ae10d86f3fbc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630005, "uuid": "5c106eaf-a403-4ecb-9646-8fc2ae14713d", "comment": "Malware payload (RedLineStealer)", "value": "3c4e7720d1b239868558088c4b4f6dae7e968e6b656f086b7642408bb3248bfba75c1add3238be5973b978e35864ac04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630005, "uuid": "a58f170d-a44a-495e-bafd-4934e3dde4a3", "value": "T124943AC5B5689481CAFC75F1B8A2E91221F83DAD9DC3964E36F932361472AD3CD0A50F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630005, "uuid": "07bc5722-e291-4ec3-bba5-feb32c95b2d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630005, "uuid": "ecfe2714-31b2-4084-8720-cb32abe8acdf", "value": "3072:O1HDmnTgrO69jAGIoRNyHXIQenAKo7MMye9zurKCy5bl0EBUUffNtWEivOOOJZoK:O1jXq6hhfAb7nC0WEG05iTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630005, "uuid": "e71f7fc5-5849-40e5-a4d2-e6b4684171ab", "value": 442840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630005, "uuid": "bd3bf9cb-3b16-4ceb-bd48-c8cb98b0c939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630005, "uuid": "f098fdaf-73d6-422c-a832-fadba191a1c9", "value": "1c30f848d8f3f3f4584da4c51094fb9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f786ad8-947f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645603478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603478, "uuid": "f5c32b6b-e418-4ab5-b1de-d8cff20cde89", "comment": "Malware payload (AgentTesla)", "value": "a6946f19c55bcd12da40b30ff440bd58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603478, "uuid": "fbc7e847-da55-4050-bb8f-15458c89cc22", "comment": "Malware payload (AgentTesla)", "value": "a113e8e47a82954b017a2649b68ed3153a96ddb843714af6c56d3a2978420ca9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603478, "uuid": "f7cc5113-137c-45e6-8a85-909973b127cc", "comment": "Malware payload (AgentTesla)", "value": "68fad98c86092c5c76c5929e7e20aaf56f46bcb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603478, "uuid": "3363ae30-ad01-4c7d-8b45-c07fedd3966c", "comment": "Malware payload (AgentTesla)", "value": "9400aeb0ddbe52202c7cb2a19cf14eeadb575313d7ba2f57878ec644e52424b6a07e58d457a070415d521aaaa146bb1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603478, "uuid": "9ec94235-557b-466e-a1f9-127fb8f17d2e", "value": "T1426423DC32C2C866C0DB533059D6B5BDD3FB921A2762123B7B888FD5ED41587B6086A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603478, "uuid": "4423e696-03c6-42e2-8592-1273a2e6bd1a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603478, "uuid": "860eae60-bbc5-4396-b686-383e1ea5e1fe", "value": "6144:9xDLriIZcT0Dcm7w6ihK1zhLLKtvYjlA22aBgMlE5zRnN51nD:H7ZjcafKKvLLQAZA22aBgMeHnN5xD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645603478, "uuid": "488b9015-4bc9-43b4-bd58-33c3d4e86185", "value": 325058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645603478, "uuid": "055371d6-6b7c-4174-abf8-90f079431d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603478, "uuid": "593366e7-f587-4336-9e2f-fef4e3e9259b", "value": "New PO#903-2224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a71f44c-94bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645629186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629186, "uuid": "6a0d7903-872e-4dc2-ab90-449eb488a7fc", "comment": "Malware payload", "value": "12469464a7feb9770f1e31a07048b528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629186, "uuid": "c25aee66-e4b4-4dc4-bab0-2a3e9071748e", "comment": "Malware payload", "value": "a212a296cb3073eade7502f2ec92b79d7e9f60494b7eaddcfc0ba49e415bd83e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629186, "uuid": "18aea9b4-51ea-467f-a27f-9ac596928edd", "comment": "Malware payload", "value": "7489354b53d3b1151c9329e36fabc19d441b2986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629186, "uuid": "c990eba8-6513-4c91-9945-e396be29e7e7", "comment": "Malware payload", "value": "b025841c7ef18b09a562925c0c3f2c3bd33735fc9124a0b0766aa6436f4bce4535348b95b02ce63101e980f938c4f16d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629186, "uuid": "0e1838ed-9fb7-422b-aff2-f801ef487a03", "value": "T1A8157C1373E18022FFABA1739B5EF31646BC6D290323A52F139C1E79A970171166E772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629186, "uuid": "b111570a-5ee6-4d99-a1c2-218a5d1b831c", "value": "12288:9pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M0l:9T3E53Myyzl0hMf1tr7Caw8M0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629186, "uuid": "be7081e8-9889-4772-9d23-360aef02e172", "value": 893611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629186, "uuid": "2e29f41d-e0d1-483d-8880-d7266cfa9f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629186, "uuid": "fbcb3789-043a-4d08-a600-8bc5e174fab9", "value": "Grandi.midi.1350980928.DROPPED", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed68c163-94a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645617944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617944, "uuid": "bf75c132-fda8-4065-90ca-f9f376888daa", "comment": "Malware payload (Formbook)", "value": "b4fc5e30e7e36c2446c92623db5eff98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617944, "uuid": "f644796a-29d2-4293-babd-87bcd8c52392", "comment": "Malware payload (Formbook)", "value": "a224c97625fc3ef62642eb8fff23f1e2523cc7bb5cc656d4a59e9668eafbd9c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617944, "uuid": "d389c026-b299-4a1a-82af-0dbb446bb128", "comment": "Malware payload (Formbook)", "value": "b7726b51655a508878eb624e507f114fc880c697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617944, "uuid": "c9826808-6ebf-4cf2-8189-d54650f454b2", "comment": "Malware payload (Formbook)", "value": "0bf7bcbad87187ee5691659f7a738dfa67951ecf24350662ace08ff3368ec798485332c474d5e5a1b5a058284e1e7b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617944, "uuid": "46f5db09-bd4b-4902-be96-9d6fd226d3ab", "value": "T1F1F459D2E14481D4EC295F76A43B9C2605977EBDBDB8B45C289DB1722BB32D3002F91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617944, "uuid": "3ae4616c-f0de-4b4c-87ad-cf2e4f121a9d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617944, "uuid": "7c0f79e7-5f7c-4bb9-8c17-ca378d9117a6", "value": "6144:QxDtsUZvJ5bx0UpacjfRkSP3GCYL2ao1bWPp92ubAu28RgjxqmiqD3+NAS+Shj7w:6Lx0U8cH/GZcRUp92ubNrAChmrsCKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645617944, "uuid": "d0a84a6e-1713-4c29-8e82-7165b3a13389", "value": 754071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645617944, "uuid": "199929fb-1b03-4200-9288-0196c75dc365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617944, "uuid": "dab9aaa0-d424-4620-a037-9088d41ba547", "value": "HSBC Customer Information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea433133-94a0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645617938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617938, "uuid": "32c63506-f2ce-4f95-8c05-501a87e7d6e3", "comment": "Malware payload (AgentTesla)", "value": "c29af9f04b0dfc04b82bcee74598a942", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617938, "uuid": "a99bf53b-6a2b-4fd0-a944-33e5dddd203a", "comment": "Malware payload (AgentTesla)", "value": "a2500d0b2c4a934d1531ad3d9b617561444f542d26037229f6014c00b55a360f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617938, "uuid": "1e26a610-c26e-49c6-8694-221957c9772b", "comment": "Malware payload (AgentTesla)", "value": "45083cc59d42403e695b34406efca8476473094e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617938, "uuid": "bcc8bc2c-a6d2-42a2-9d0a-b9f6208c2c2f", "comment": "Malware payload (AgentTesla)", "value": "5676392bbd6b54659e6fed744dd0621e941ebe964734170e792946d88f47d0f692ee3772ded8b5cf952adcbc2d77d59b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617938, "uuid": "e3fab13e-fa03-4e3b-bcf7-c3cddcdca198", "value": "T14505C00839AB5F3DF1B19BB21DC4ECB4FA99FB271C08A37DB8516546C2A1B804942777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617938, "uuid": "2ac00a98-3a53-40ae-bd6b-54c1cec43f71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617938, "uuid": "71461dff-833a-49ea-839d-b7ddc6ce4b65", "value": "24576:QK777777777777TXNoQ3ckuHDPFNDi8BjMWI/zSr:J777777777777zzzMVMWI/zM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645617938, "uuid": "fec34ea4-a65a-4340-9ce0-fc155451b55e", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645617938, "uuid": "9f54bd59-7053-40cb-b6f3-51dfbf1c3c5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617938, "uuid": "556790cd-45e3-438a-9fe5-5b24fd1a2fd0", "value": "BBVAMT1030493__.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83fb3ba-94a8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645621317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621317, "uuid": "3dee9a7b-7dff-4291-8476-f9b0d0cd1650", "comment": "Malware payload (Loki)", "value": "e019c5a2ad98c473920aef1c87759ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621317, "uuid": "d1541ef8-d617-4d0c-a612-c1e92489e863", "comment": "Malware payload (Loki)", "value": "a2f8774c48255067b1f99faefc4caad82f18706093d9bc04864ac646a253f500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621317, "uuid": "1718df3b-b08d-4251-bec4-46ae6dcfb560", "comment": "Malware payload (Loki)", "value": "1610370cff4a4eecdb67c919d2e6ed15feac2ed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621317, "uuid": "9a00ff84-ffa7-41d9-ae0a-97e46d3ac52d", "comment": "Malware payload (Loki)", "value": "d25c7348c0706595aa693fdc4a697e75ae829eccff3870508651fc4b19c3a37d5bc32337f0e0fc34dac4405316e8b4c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621317, "uuid": "28522b47-c9ad-4f6d-8871-decc04daf8ee", "value": "T1BA64227BADE984B7D95513312233E71AE67BEAA43750163F3BA01FC76B2B1C38244152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621317, "uuid": "0ca16d0f-f61d-4370-bf89-cdae5ddf326a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621317, "uuid": "41c08da0-2f16-4adf-a14b-f7e132e67678", "value": "6144:TxDpc0qC4i+CefD8ZH0/xKeEvdBYEuqC3iK/zFhXRNt4AOA:7c0qR8WoeiBYN/LDt4AOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645621317, "uuid": "bee4a474-d9d2-4a2b-b1d5-b21ce2ebe651", "value": 311606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645621317, "uuid": "44b275be-ecd5-43f5-a1b7-8b528f9e0c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621317, "uuid": "39bfaced-d032-48c8-a8c0-12b6f8353ab5", "value": "e019c5a2ad98c473920aef1c87759ee3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ced8a85-94b6-11ec-9275-42010a9c0029", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1645627043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627043, "uuid": "5b8d7a71-f2c3-4c43-84b1-d58bbf5a363c", "comment": "Malware payload (Gh0stRAT)", "value": "e821590c03872a304c25315ab46005a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627043, "uuid": "4a85de62-73a4-4573-9803-820a83528f1d", "comment": "Malware payload (Gh0stRAT)", "value": "a3b7929d37805fa49dda5200049f664f38c6832fcc8d9d58f4afb7d7906a2d23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627043, "uuid": "3029a4eb-7f66-492f-9f22-b48c1ba32c1a", "comment": "Malware payload (Gh0stRAT)", "value": "e66c74d7e7dfbf6ad67678a9948ab08f59469604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627043, "uuid": "e57bb94f-4b5b-4d84-a014-1e6c659148d5", "comment": "Malware payload (Gh0stRAT)", "value": "f7c0f8f55b29141cb7ded753fbf915c065dac5738e655d0669b757937e64b8a04a7798180d21d09e493af5e1dc295e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627043, "uuid": "a3ab583b-20b6-4f10-a4cc-89da647492bf", "value": "T11D53F16481D1655BD5E208F0289F87606910EF1B358C5A0FE6A97D2C7CAF38F4BB3366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627043, "uuid": "97c6b081-acf5-4bcb-9e5e-12ad4ab48fa2", "value": "b2ab9c868a88adb1bc668cb8d724d018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627043, "uuid": "8745fdb4-6f50-4648-a281-5d14e2894758", "value": "1536:QOP1q+mQ29I4uBbHOZ0km257VnGJDZc8FZtjQBl/CCcizMo:QvDAXkmS7RGJDZc6al9eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645627043, "uuid": "6f38d5d1-092b-4a1d-bc61-ad2c48536075", "value": 64528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645627043, "uuid": "9c614096-f0c7-477f-9823-a6d151d2ce80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627043, "uuid": "ee9ab96e-4c20-4d5f-b2fc-4a18887d44ea", "value": "e821590c03872a304c25315ab46005a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90e1e3a-949a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645615279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615279, "uuid": "43ca2153-27c1-4328-8fab-c0425f778c40", "comment": "Malware payload (Heodo)", "value": "dc294ae044d7c2f58fd6e3b08531a29d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615279, "uuid": "29d110dd-47fd-43da-a601-9b4163fba0a3", "comment": "Malware payload (Heodo)", "value": "a3fac58e136994aed7baf11d3c071955e3ee53846279ec90013a5a94c9f5c7db", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615279, "uuid": "7b008c6d-9a7c-463f-a808-d20634cb8963", "comment": "Malware payload (Heodo)", "value": "2a48d42371b3ced12dbe2daf2a1819cc3e818d79", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615279, "uuid": "65e1df8c-a460-49ca-9976-4c87d299db4b", "comment": "Malware payload (Heodo)", "value": "d1987d29bab3dc025380881f8e8b84ecdcec1430aa0ff47e6cd212b687cfdd098ec479b58d186d83e4fb03ae48e0bc66", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615279, "uuid": "d0c0f754-4d47-4466-8e84-23267a17ad3f", "value": "T15E35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615279, "uuid": "02edef87-6d54-4b3a-8a2c-33a22594158d", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615279, "uuid": "a2d5ba4c-881d-4183-9ad4-768167248432", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/gTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/gTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615279, "uuid": "57fc5475-c5b9-41d1-aa32-2f151f4dad0a", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615279, "uuid": "f7730eb8-dcac-4d0a-bdf3-b746fc28f79f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615279, "uuid": "d9c2442c-ae66-4896-8086-21d485a79958", "value": "MeGZ3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6990b19-94c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645631595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631595, "uuid": "579186f8-a8a5-48b0-90bd-9f339de46786", "comment": "Malware payload (Heodo)", "value": "53bf00c903e7e1dbd1a87b81a977e6da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631595, "uuid": "3a09b1f1-e801-4181-88fe-64924cf3804d", "comment": "Malware payload (Heodo)", "value": "a40906fae2805f68126eb37b4f59976299c7656d08144bd3209142e30e381257", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631595, "uuid": "1872ff53-ca14-4cb1-807b-6135bfe6cca8", "comment": "Malware payload (Heodo)", "value": "938b19be3e91c21c3440a959e834f0ae8dd00a33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631595, "uuid": "e4db53eb-cde7-4f68-b29a-45bc449a601f", "comment": "Malware payload (Heodo)", "value": "4045bf958308c86e17ca8254bd1731b64c2cd08d85faf94f3e9024f00449ba497e37ac13399aa4546f6c8c37544cdf0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631595, "uuid": "1343ac24-ea21-4de6-876b-f9a41f46a5ba", "value": "T18235AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631595, "uuid": "61d550db-7bc0-40d0-9ddd-6a720f2207cb", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631595, "uuid": "cfaede1c-0432-4427-bdb9-8567b0ebe2d3", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdN2TEMJdHuN3LafJSrN:hDQhXJ1Td2CpdN2T/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645631595, "uuid": "9df953bd-2b01-42dc-8a98-b9e5db2bc639", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645631595, "uuid": "c99084ef-94a6-4191-91a5-6d7e8302811a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631595, "uuid": "db8f4c4e-a78b-422a-9c1b-7593ce913df0", "value": "53bf00c903e7e1dbd1a87b81a977e6da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a9a6da-94be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645630470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630470, "uuid": "c2440834-5f9a-4cc5-bb52-62c903fc7fc2", "comment": "Malware payload", "value": "6c19b941daacd91f1ea7679b385ccc48", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630470, "uuid": "e642a19f-3153-48e2-9db3-564dde1234fa", "comment": "Malware payload", "value": "a44b40f0f5686936c98f55f1cb7a9fc7a6dfec0a33ad941de50f5a00ccb3b5ff", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630470, "uuid": "9fd22171-f1ca-439c-b88f-77cd5afecb77", "comment": "Malware payload", "value": "980e1fb5f6855ce8dba3e9e4bc87df0e142e8f3c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630470, "uuid": "48843da5-fe72-44fa-9db9-837cb0da1c14", "comment": "Malware payload", "value": "f800fb86ea4a44ca4dedb7109a5844b7e74a6071a8cff8e722bf3cb0539cbc7bf39837bb54e714a2fa2e6de87bab1bcf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630470, "uuid": "c13ae9d8-04a6-4fda-a451-a36327b6844f", "value": "T194A60246E759596EC9F353338AFA0675014A4C268B839B836D18F33C28B76F44F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630470, "uuid": "246cd421-ae0a-4d55-b975-8fd9a31506c2", "value": "196608:SjwcDXg/AbFes2CF+luJaZXSezTk+MCnzoPXXwn5mRsjdfxcUOQa3y:ycAb3F+lR9NzTdp0vX65mRsjdJcnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630470, "uuid": "49d34fbc-2e37-4286-a74c-6528b1240f92", "value": 9944916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630470, "uuid": "b2867870-5a06-435d-8c18-75c9e2fb4a64", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630470, "uuid": "e19c40d8-0026-4b7e-a105-67c7c9199e09", "value": "Easy Photo Editor.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423793f5-9479-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645600906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600906, "uuid": "54fcd793-0351-46c2-912b-70cf4006a927", "comment": "Malware payload (NanoCore)", "value": "d04ffb5106ae135a1eadf50315e19e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600906, "uuid": "8c408af9-1012-4b58-9d22-878aaad69b1c", "comment": "Malware payload (NanoCore)", "value": "a4717412162c3a9b74997841c66cb913771279323f6e5829b6e42b0970499e08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600906, "uuid": "8969e6d9-1e46-4685-a943-a62e890e678a", "comment": "Malware payload (NanoCore)", "value": "85053675b309e97c9be5be8f86ba8c1b4e9e1ef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600906, "uuid": "20ce3cf2-a927-4395-a2a5-bb0c6b72b4db", "comment": "Malware payload (NanoCore)", "value": "5c02df93701c47f6f7e59782f0eef3ead62743a60c7d0fbd643802c47f7987efa2da20571f02fddfefcc50a4d61f2f53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600906, "uuid": "3e7e1f4d-990f-4cb1-a51b-4747cab07bb3", "value": "T18A739FA1BE84F625C1262C32DB12DAF5C227BD2BC97099537CC87F1F7933642951272A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600906, "uuid": "77baafbc-a745-4233-9c83-ab6ab8d66231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600906, "uuid": "6d35445c-df43-483e-98c9-38655eefa173", "value": "1536:jZb8EJcQU+iopiA+bHq0R4Co0s7yj7c0q1X:jZbDJQYzCo8/c0q1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600906, "uuid": "3359f0d3-3b65-4da4-b262-32b682c44c3b", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600906, "uuid": "25c18a3e-1519-4414-b299-e1e3c14cc252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600906, "uuid": "56007242-7fab-4a9c-9dfe-e211f6d191de", "value": "d04ffb5106ae135a1eadf50315e19e16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219555dd-9504-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660551, "uuid": "1a9f613d-6c6f-42cb-bbf4-408411b664b7", "comment": "Malware payload (Heodo)", "value": "a57146098c22bc50276a95e7344fc612", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660551, "uuid": "4e637b84-463c-49bf-999d-1b99ee45a64b", "comment": "Malware payload (Heodo)", "value": "a4853b4d8d69e9908f6fdf6f4a9852fc5aa200205721a3b64fd59f85d7893216", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660551, "uuid": "797237e2-8dd7-49b5-b602-cff230398d6e", "comment": "Malware payload (Heodo)", "value": "06be47dcf684ecbabaf3592f39d47d965f64dea2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660551, "uuid": "8811711b-c246-4c73-bf72-73c9e5993825", "comment": "Malware payload (Heodo)", "value": "b61fa9f6a162124367ae8217487913095ee38324923fd8421826d132057963a13062a5bd4e6246726a3ab4b8ea7d88b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660551, "uuid": "a0a2adc4-d69b-4b62-8f33-895654d98ba5", "value": "T12EE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660551, "uuid": "0c9f259a-c7eb-4d31-a4c6-76412c30f301", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660551, "uuid": "0615d4ae-052f-4f88-a33b-0a950f12ee46", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0HhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNf5PhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660551, "uuid": "99679307-05a2-4c8f-ab0f-73aeb984aa91", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660551, "uuid": "8062f2a7-a4d1-4b4c-9b1e-890854aefc25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660551, "uuid": "5157f09c-fdec-4cca-aeab-cb8c160c45e6", "value": "a57146098c22bc50276a95e7344fc612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904d4c64-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645622941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622941, "uuid": "404ce305-6a42-4d8c-bebd-203b00caa895", "comment": "Malware payload (Heodo)", "value": "6d4927a4535bbd90e39c97a8f731875b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622941, "uuid": "e1c9734e-d230-4ba1-822a-03bdb5a831d0", "comment": "Malware payload (Heodo)", "value": "a4917c629ed5583947ce4a55fbbcfa5125dd4a35a450ea01f1de504c4952ad26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622941, "uuid": "ae57560b-a739-47f7-a881-ec29167f756c", "comment": "Malware payload (Heodo)", "value": "3caaa6b4d914c933fc2e0c3ab926392684d248b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622941, "uuid": "bf1dcb8a-b481-45dd-989c-ac64e97bc7b3", "comment": "Malware payload (Heodo)", "value": "180ac0be49116c1620037714df5ec4148c3692083b22a8c165d84cd2d2a5f127150e8b6df56e824c28b05909a9a7f05e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622941, "uuid": "9a8389d6-3528-416c-a610-55b83af8e6f5", "value": "T19E35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622941, "uuid": "8a41a9f3-c6cf-4dca-a2ff-8955b9386d9f", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622941, "uuid": "38cddd90-eccb-487c-bfaf-d5acc52b6e87", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/STewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/STeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622941, "uuid": "71e04398-0371-43d0-8e2f-6947a8037e9c", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622941, "uuid": "4b3073fb-0ea1-4784-a12a-aa0d89b5d999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622941, "uuid": "cbf4d008-c980-4f87-9e3a-7a6c40a9abb1", "value": "6d4927a4535bbd90e39c97a8f731875b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c66a9c5-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645624465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624465, "uuid": "8fba808c-3005-449e-9a10-741d4edccfe2", "comment": "Malware payload (Smoke Loader)", "value": "d85ec4fd0eda6d9358573248445d9bc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624465, "uuid": "d1a5c8a9-267a-4a78-a633-0601e1cfa910", "comment": "Malware payload (Smoke Loader)", "value": "a56a7017ad9ec869853223c5f7420ce22c4ca07f85d6e28fab4514ece49892e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624465, "uuid": "b28a38c9-9224-477f-b0da-fef5c0552485", "comment": "Malware payload (Smoke Loader)", "value": "46dc7234ca850d902d3268d620f89423ced651cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624465, "uuid": "b5f7616a-2833-40fd-bf5f-b24475cbe59d", "comment": "Malware payload (Smoke Loader)", "value": "fdeb471309899f3179b52dbe7866c1aa9f925e824440e67e0f8005b9885e6e7c2d16e8702024ec28b2366467616d3135", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624465, "uuid": "01decd12-e670-4a42-9ee2-382929c9133b", "value": "T1BFF42311FE29C052CEFA247028BA67FB9F2778960563CB531B20FF8E35535546829F68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624465, "uuid": "e457e0cb-f414-41e2-84cd-402849228e60", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624465, "uuid": "a8b067b3-8e38-409c-ba36-327f0d73d210", "value": "12288:OblE0z6hfTpLHvo09Impr3mH3laistR0J5AtePPW92/rutMyljWM1QE8:OblE0zwhh9IKr2H3labC5AtSW9Q2pQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624465, "uuid": "f7ff5729-21a2-4ea7-94ad-57751005937e", "value": 728560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624465, "uuid": "408899fd-2168-4d94-b6ed-5ce3760957b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624465, "uuid": "e226ecf1-3c57-4867-a74d-3e95a919acd1", "value": "d85ec4fd0eda6d9358573248445d9bc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4930ae16-94c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1645631841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631841, "uuid": "ebd59284-0623-41fc-a2a8-321dab6d4589", "comment": "Malware payload (Gh0stRAT)", "value": "eaec1c0efcff93c03945a2bf5a2fafbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631841, "uuid": "871b9c6a-3d98-4912-b51a-56c7b84131b5", "comment": "Malware payload (Gh0stRAT)", "value": "a5a8a35bc7f082b6107a1b19ecd0b78d4467b4159689ef6d1030be7d1ba19c6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631841, "uuid": "1fe31a43-7cfa-489e-bf10-4baeda1d4c8e", "comment": "Malware payload (Gh0stRAT)", "value": "97ffd2556a700a57db0b897a9b682743c966310d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631841, "uuid": "cfff0066-3d2b-4ed4-b2ec-00cb9eb9186b", "comment": "Malware payload (Gh0stRAT)", "value": "abb43d7ccbac6995cd5b42fa5af5bdc50b73640c50abca5cdff574c9f6cb3db6759c5842da45fcf3ded130eb04fd2527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631841, "uuid": "7e2878df-cf93-416c-90a8-895c3fbbb167", "value": "T1ADA4E132B9C144FBE94A443040FA2BBEA63AFD8617115E97A744FE953C33152D32B19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631841, "uuid": "1f5985bc-ee7a-4e97-a4ef-b263e9c89133", "value": "4d4c746105ec68f3b3b28040325a9d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631841, "uuid": "2f823889-7187-4e7b-9d33-815b5f5b736d", "value": "6144:1iTti+B0bL7t4A5gp34BEQ4G7v4G7AWFC4G7AWFQfOVM10UbFaxU+kX78Dr:4PB0bd4AgNi1JAnABmVM10UYcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645631841, "uuid": "0417d9d2-d955-4616-8a87-f2204894905f", "value": 483524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645631841, "uuid": "fd6174c3-82f5-4f64-b71f-8eef521e98ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631841, "uuid": "5b769466-bc45-47e3-95c4-3eab8a24c060", "value": "eaec1c0efcff93c03945a2bf5a2fafbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee97003f-94d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645640279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645640279, "uuid": "b2343257-4f44-47f7-a003-1232119736b1", "comment": "Malware payload (Heodo)", "value": "6c346c294b02706919b111b5cfe48afd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645640279, "uuid": "b1210e71-9471-4b25-a90f-ddf768d979f0", "comment": "Malware payload (Heodo)", "value": "a71ce371b92b9c84f97a30f048a53d4f677269332907480a5c9ab635bdb14634", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645640279, "uuid": "19492a93-ffcb-42fa-bbb5-64147a141221", "comment": "Malware payload (Heodo)", "value": "bb946248c82b4b992da95ee851a90489739c8d2d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645640279, "uuid": "c805b708-6de4-496f-952d-6da414ddf3b4", "comment": "Malware payload (Heodo)", "value": "77ea26d437f31742b6775b423f6ad3da9e3b2f6d68266b974610c79152f2f1798affc9a4647dbad1eb64a7d2ed8d70f9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645640279, "uuid": "0ff52f8a-b5fa-4c1f-9ae6-6258a48e75fb", "value": "T17293022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645640279, "uuid": "7380848f-f405-40fe-90d9-aba6a3c3bbb0", "value": "1536:/QBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:WDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645640279, "uuid": "c177e5f4-cfca-4575-a47f-a4973c395011", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645640279, "uuid": "931349df-c00f-4899-8845-fae821a44f98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645640279, "uuid": "9c8bd28d-98bd-4f19-aa1e-ab8445064045", "value": "ALXU8477733041 invoice.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6152c7c4-9464-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645591939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591939, "uuid": "fdb6cdf5-c715-4c3a-b33c-19c7e615913c", "comment": "Malware payload (Mirai)", "value": "3c9f56ba2d621ed506b3efc0e97ea251", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591939, "uuid": "3d9f6657-d935-4ecc-84d9-8167815adabc", "comment": "Malware payload (Mirai)", "value": "a7400d8a1952ba1d5bc32efc4b614884873956ba390b9906488832a34de659be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591939, "uuid": "36da8dda-d324-4b91-b3e8-28df1b5764e6", "comment": "Malware payload (Mirai)", "value": "638fae93a31e3b046b7b43f24048ee485183c76c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591939, "uuid": "7a576c40-4a57-451d-a6dd-dff49220c965", "comment": "Malware payload (Mirai)", "value": "b940e3feb7cce250d33b984b3c08fe5b04c0a0df2e1ad25b02311b025d6e33d24b44752b217b7117cbade92eeebc593a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591939, "uuid": "88f80b97-1b0c-4484-bfc3-825a0b8f70c1", "value": "T175E2F114DF1E2110D67186336F3BC3EAD75688A452C222B2B9350F34F592A9BED381D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591939, "uuid": "f768cc28-2f7c-4340-b8d8-aa3b92be0bc1", "value": "768:Q75BzXwDut6ynQwhBk/dAyjQ1bkfFaPms3Uoz1:Q75FhxhylAyjQFIFaDz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591939, "uuid": "4145bb4c-4ddb-40a5-8cf5-2222658a36e3", "value": 31876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591939, "uuid": "4f598018-f6ad-418a-bfc1-9c85b3541b60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591939, "uuid": "f7e32e7e-0e07-4531-b376-21ec12e4fdcd", "value": "SecuriteInfo.com.ELF.Svirtu-AATrj.9354.5060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bcd1f7-9480-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645603915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603915, "uuid": "40c12a88-7b02-43ee-b25b-2455d47dcea8", "comment": "Malware payload (NanoCore)", "value": "d8bc462d12ff4669bcdac67a870aca56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603915, "uuid": "74ac7561-01d1-48b7-b625-112738a6c43f", "comment": "Malware payload (NanoCore)", "value": "a7693434e775cf120cec21c7380f70b9e8914f7dd02019e953d5af4af0147a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603915, "uuid": "c1844a37-b9ec-4193-a0bf-1dd7c0552b94", "comment": "Malware payload (NanoCore)", "value": "4866b279760ee48bca0c3fec18f70207cc88b72c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645603915, "uuid": "bfebf503-c5a5-4f08-be07-a9da9f454d5b", "comment": "Malware payload (NanoCore)", "value": "1dd2be6471ec08597c4da470e2be86562f878fb9d8ecd90db3a82d5914b3ed18de685eaea11819bd7a39c5e196cd5670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603915, "uuid": "42b68a17-2171-41af-a395-aab7c2eac1c9", "value": "T1EC156C7631EF105687B2EBE30FD8ACBF9A9AF177120E753631911B868325D429D82371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603915, "uuid": "bf39f21e-e903-44e3-b427-828b73474349", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603915, "uuid": "222671c8-4391-449c-96b3-5b78e30790e2", "value": "12288:3IXxaVB+Rqy09wPOnoWxpMvwfzuECawz1MRHKpjoi+78JsVnsfbkrAhVqy0pWPHQ:3d+RqyGnozvwFK1MMjYQEszopWPHLx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645603915, "uuid": "a303f2be-cc2c-4269-ba23-c5392a85bf4e", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645603915, "uuid": "851d7eb4-e12a-4ed5-b2f4-e41c161eeee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645603915, "uuid": "979b092c-af03-4985-9d29-e0f729f510a0", "value": "d8bc462d12ff4669bcdac67a870aca56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de63b7d-94f6-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645654693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645654693, "uuid": "950d6c4f-7e9e-4fb3-8390-719f3328263d", "comment": "Malware payload (AveMariaRAT)", "value": "3be7607fa30c3eb255ebd93124397d44", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645654693, "uuid": "9e2a51c4-e152-4cbf-9378-384a26ed4664", "comment": "Malware payload (AveMariaRAT)", "value": "a76a198562994a7e8dd2d2cf4541058c6001a7c37625a022c8683f6040783812", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645654693, "uuid": "bb7643e4-66fc-4423-9328-cf7d408d1e7a", "comment": "Malware payload (AveMariaRAT)", "value": "94dfb644ff1faf3601f786c40182a22696160e9e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645654693, "uuid": "64504fff-960d-4322-9480-19b4e504c41a", "comment": "Malware payload (AveMariaRAT)", "value": "cd64a95becdb28eddc796f62ddcec2eabdc48e8c4c4a7ef27936bdbefaebb2515d3543308f208b34e188567c5952785c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645654693, "uuid": "de915f6d-da6d-4137-aa76-03bc686af6db", "value": "T1471515B6275BCF28E0738673A8849870F65FAB131C44637DFC76AE45F271A404C936A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645654693, "uuid": "e8bcf363-e408-4c08-a904-1fe9c1c64ec3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645654693, "uuid": "5a1f3db4-b376-4b0a-8d4c-688dca4f49a5", "value": "24576:SzVK777777777777M/D+SuQUSgaSn+vsbxsE:Z777777777777M7+JSgP+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645654693, "uuid": "6ae97457-86f4-4c92-88af-158ae3b5b8ec", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645654693, "uuid": "ec72ce24-6575-437c-bfb5-d77f9456f9a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645654693, "uuid": "67ff8505-cc9e-40ef-bfce-2e6a81cefffa", "value": "Court Documents,PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d9ba2e-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645618892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618892, "uuid": "69252dd1-f1d8-4368-a485-326404c334ee", "comment": "Malware payload (Formbook)", "value": "316e89e095a535d4b3e716f1152373f6", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618892, "uuid": "0ecc10ad-5ebd-43c6-95c4-65618785be9c", "comment": "Malware payload (Formbook)", "value": "a832c9247186fe92b4d0e269a92b3ff9fd54e53d3968fb94e278023f48d1f0e8", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618892, "uuid": "a76569db-ad52-4d8f-ac92-7040d2a81a5a", "comment": "Malware payload (Formbook)", "value": "d9a3d2c8e4d0e5a5beaf970a803eaff10e670434", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618892, "uuid": "a112a3b5-d4ea-4bed-b317-257693924598", "comment": "Malware payload (Formbook)", "value": "88621ef7b3237675e86464815a212d957ada886790f547b87d4cbaa7e876f584b8b2c2ee150df8b9b7772a84bccddb43", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618892, "uuid": "bf16bec8-7247-46d6-b3d8-cc65fe63502f", "value": "T10AE423803DC15289010EEB3AE864DF55D3A4CC54CBFE8BAAB9E5CA51C3EF9134D65076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618892, "uuid": "45d4fa9c-4d35-4a87-8501-4b6dfc7b2fe1", "value": "12288:25v+2FEqRAzhovvzOZ6EiCtg9DUlJy6tcSb1X7lmsFpPaxKy8L7KzBu:2h3KerOZ6EBwUlJqSb1Ru3uKzBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618892, "uuid": "c54ef695-c119-4b28-81de-91ae53b7199f", "value": 685355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618892, "uuid": "ad231e9a-0200-4fa1-bd19-45060406adc8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618892, "uuid": "cdeaf688-47af-4719-b3e4-16a0c1f724ed", "value": "swiftXcopyX0011.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b687b6a-949d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645616410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616410, "uuid": "ab49159a-9593-43c6-9338-74de07fa4c28", "comment": "Malware payload", "value": "67c635f9fcc8e646a0b9576cbeabaccc", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616410, "uuid": "59843250-89ec-4377-be96-df478e0be6e5", "comment": "Malware payload", "value": "a933c776a85c37bf175ce67be085732e374559d1e7e0549304dbf7151bd9ec55", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616410, "uuid": "01040a21-cba4-4018-8f7f-e9ab116e7240", "comment": "Malware payload", "value": "b877fef1afaff0d40ebf845876546b497a18b351", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616410, "uuid": "1ca0f45c-e84e-427b-9dc2-0928119dcb4a", "comment": "Malware payload", "value": "8b61008ce3f3e12140e064d659591143b28a181295bb8103c89b966d7837abcce4fe6fc032cf35fbd24f52d4a740f6c8", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616410, "uuid": "44a88f8b-01c4-440c-9dd0-9ae75bf0d2bc", "value": "T14923D02CC4425716C5B3693EC478C8E10AA6DC57B114058FD1EABD8B1B98E9B274FBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616410, "uuid": "de6b12c3-14b4-4874-854a-e1eb0e320286", "value": "768:yqRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTCW:yYJqHt7NJECQFfqA9IbckpN1/K8Nyts2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616410, "uuid": "da18fd25-a92f-4d34-9465-1c7778c86c42", "value": 47917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616410, "uuid": "bfc49b97-a1c1-44e4-adcd-585c1633be4e", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616410, "uuid": "85297e3b-eade-48dd-9cec-6e856c749222", "value": "SWIFT Transfer (MT103) INVOICE #34000769.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3762071f-94e0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645645126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645126, "uuid": "c03a4153-c700-4bdc-8345-5469fd11fc08", "comment": "Malware payload", "value": "7f1e548fbad0275f358fc1a2612e050d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645126, "uuid": "52e90cb1-6a86-4f7a-98dc-ff83971eacc6", "comment": "Malware payload", "value": "aa2a9d5cbe58d86bfeed3d1226863fd2a84f8ec286f3b8b97dbed1b005a99e89", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645126, "uuid": "e1940c9a-c0bb-4e63-ae66-5b5385fea934", "comment": "Malware payload", "value": "bd9376a37452d81cdb578ff818c94a30f3d68dfc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645126, "uuid": "762decfd-b94d-454b-a04d-01b9f6bf3136", "comment": "Malware payload", "value": "ab155b3c297b4394c7fb47321f649c21cca7d725afab5218404087ecdf9cee564a39c31035d2f42416cbc6f852d00341", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645126, "uuid": "837d1498-a083-4473-b464-ecf5adf5b2ce", "value": "T19394D0067450CA0AC66D07360CEA83E66337FC512F76934736D8B72E3EF7681AE92654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645126, "uuid": "2b0256b7-b885-4c8f-8650-f5550bf7ada4", "value": "6144:qehvMqAPjxO5roDGWjV5xtuEVi8/dgsqHexnsE5ira0DptvJXC3RnUTcSwRa+Myt:5exsc4aGthXqRSqaPyjOV6FLbsNzhFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645645126, "uuid": "ced7d3cd-179d-4918-85f0-731bbffb78a0", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645645126, "uuid": "56578c9c-d707-4f54-a788-169ed123cf5b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645126, "uuid": "2a2b644b-2f12-47a1-85ff-035076fc2920", "value": "63267_41937.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd593f97-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633808, "uuid": "30c6cd7b-fa51-4d30-acbe-4db01712a1fd", "comment": "Malware payload (Mirai)", "value": "1768f14e95e71f60ea079ded68adbc7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633808, "uuid": "f15ab9f7-e3dd-4535-ab96-3da2b19b0e09", "comment": "Malware payload (Mirai)", "value": "aa55eb579074056a95ba11a41f728332769890e6014c1e7e350704f482738c82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633808, "uuid": "5c7cbb13-96cb-4b8a-a1a3-ed58fd6f5439", "comment": "Malware payload (Mirai)", "value": "97a1b66aea3499a3b80f34299ce12c29cb50acf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633808, "uuid": "a28b2b69-c851-43ca-a359-0a5e1122d349", "comment": "Malware payload (Mirai)", "value": "ec86edb7eacce917542905e1e0f17f11f94180e46789facc3e5d051f5ac61ceab3e7d72fab2c5e465aae4df08a77748e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633808, "uuid": "7362eb5e-f442-48ab-9c34-bf06ac3d6172", "value": "T1EAE34C86FA409B13C5C51777BADF414A3322DB54E3DB73068D189BB43F86A9E4E23609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633808, "uuid": "7df50a26-c08c-4ca8-a26d-fef9c56fc7a1", "value": "3072:RAPMY/f1TqQCoLmpMguHcUZDVUHalw7WWuH0TsfCNYhLol+zGYOJEX9Np3bsaz06:RA7f1TKoLmpMguHcUZDVUHalw7WWuH0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633808, "uuid": "c6cafdb6-cbec-46a6-a638-97ac0249a9a3", "value": 153097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633808, "uuid": "51f12069-ba4e-48d2-8bc5-9b4e73d4cc96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633808, "uuid": "00e8117e-8a0d-4053-ad81-0aeefcbc9cfd", "value": "Zeus.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6970f55e-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645623735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623735, "uuid": "bd833d21-8c19-46d3-9e08-027ba8059aa4", "comment": "Malware payload (AgentTesla)", "value": "312b97082753ec863629caa82f6983b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623735, "uuid": "fb09c270-f079-427c-b4d5-7f0505802a02", "comment": "Malware payload (AgentTesla)", "value": "aba25b6f35915076be3f3eb0cd2992462762002897d39e5654acbeef6db310bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623735, "uuid": "ef4de045-5992-44b3-859b-5a5455bed519", "comment": "Malware payload (AgentTesla)", "value": "38a378727f9f75d646a453c832044451bd0fea2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623735, "uuid": "1d9574ce-64f8-4e62-8c47-41fb27b6ed07", "comment": "Malware payload (AgentTesla)", "value": "ed1f70187d6752fc3df4594f838a8ab3393bb886448ce7916c2bab97f4609564a259ef0a8ea9ee49d8b60ea5f5192ba2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623735, "uuid": "88a0f883-5312-4215-b419-bc2384b389d2", "value": "T130355A9C365072EFC857C972CAA81C64EA61747B930FD243A06316EDEA0D99BDF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623735, "uuid": "6bc3a8a8-67c4-42e4-bb93-34f558493bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623735, "uuid": "f767de23-696b-4b5d-87f4-a10300aaf6c2", "value": "24576:UvYdGk+eDRXNyBm1sCp2Tt8rDSQAywTPKhRFyK:UvYr71Pp2pwDStihvyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623735, "uuid": "8e121b4b-2433-436a-b218-a72ab5138714", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623735, "uuid": "986edcb3-aa02-4235-8767-49527bd374b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623735, "uuid": "c532797f-4f87-4a89-885b-359e65af65e0", "value": "312b97082753ec863629caa82f6983b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02884267-94a2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645618408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618408, "uuid": "7fa682ec-cd93-45d1-b85b-763db7ae14d3", "comment": "Malware payload (AgentTesla)", "value": "500a21653a1e3aa58cc721410a1d2e25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618408, "uuid": "8423c2d8-3895-4aca-af18-4cd5a51a65ad", "comment": "Malware payload (AgentTesla)", "value": "aba88fbca4bc1906e9602f61b25d48d01cf476d48bda115f317fda930313492c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618408, "uuid": "ea12acfb-8170-4852-8ab4-91288c329c57", "comment": "Malware payload (AgentTesla)", "value": "6ca589f5e1522e629564545b53c9d2f6185ff536", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618408, "uuid": "609a2214-811a-4035-80aa-8dabca7b4e3b", "comment": "Malware payload (AgentTesla)", "value": "02885c758cb5c2e1b44d6d2a2369e968aebab86019a94c5d6ec4b15d9d38a7f3c79d3788758292cda2ae6d55425c60e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618408, "uuid": "f691828f-390f-406b-90a6-61a10f78f3af", "value": "T148C47E57F7DBF6B0E6FE827A86F1851C52B774620260A78F664072886D22392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618408, "uuid": "01cffdc9-04cb-4fc5-bac9-f4f8096f523a", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618408, "uuid": "3c4b9d75-508f-481c-802c-7acd1d1ba195", "value": "12288:Un/zDvGHAykH8vLW/4+8bzbBSreMdsBY4ZyrE7K3yl8PeVooA/AB2LEJZuAQPUqj:2zbGHAzHKjX1HBY4ZyrE7K3yl8PeVoom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618408, "uuid": "ee0a4cf6-c09d-4c24-a012-9dd8868652e9", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618408, "uuid": "0281c28f-8275-425e-9e73-636bcbdb4905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618408, "uuid": "dd47fc53-3f3e-42ae-9b70-176a04a6a7a8", "value": "Quote (1).xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a93527-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645610490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610490, "uuid": "de18e80d-952c-44bf-bbbc-f8e186ad23b1", "comment": "Malware payload (SnakeKeylogger)", "value": "3b723f6e5bc0f4b1f3f8c4ca63568834", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610490, "uuid": "779e1c78-c009-43bb-bd0c-aaa599839bc1", "comment": "Malware payload (SnakeKeylogger)", "value": "abc9859e70631e0350f6322149cabd267fb6a11cbaae32cbc9cf5ffdc6434df1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610490, "uuid": "4a830982-55fe-451e-8feb-cc557b983d19", "comment": "Malware payload (SnakeKeylogger)", "value": "8716a9be391321e8e5645586646c014fb6e9d913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610490, "uuid": "f0e835ff-09b4-4154-b905-9510919927c5", "comment": "Malware payload (SnakeKeylogger)", "value": "e7f64a4faa8cde5cdaa11275444c9a918150e6519cd2e63fc952047b9b4eb16a7a0239257bcd6eecf7096738308d50a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610490, "uuid": "406663ea-e197-4a7a-a09b-f753ba3f295b", "value": "T15C94AEC9003747B2DA699BFCF461A1983FF47E2DD206E27EECC8B08904E1B954796953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610490, "uuid": "6b79590b-d27e-4dc3-accd-cef3248c353b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610490, "uuid": "0fe5996a-6ad6-4ae9-89d8-4e92fc3048c0", "value": "12288:qTCMTp62K777777777777AupBxTGz3mvf3SXjP+SrKwtLRm:quMQ2K777777777777/xTGqeSSOwLRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610490, "uuid": "77bdc61c-48e2-4d2d-b9e8-b85eaf0b1f21", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610490, "uuid": "72fa9742-c0b1-4341-b11a-e5dc9db2eaf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610490, "uuid": "4961484e-6428-498e-8711-eb55591e636c", "value": "3b723f6e5bc0f4b1f3f8c4ca63568834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b227af6-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645623684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623684, "uuid": "c63f767e-f5dc-4148-a9e2-accb81aa5465", "comment": "Malware payload (Formbook)", "value": "608287968693b4de2a346939fc1b3728", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623684, "uuid": "e771462e-bd85-45ff-93a4-4f066ded8f01", "comment": "Malware payload (Formbook)", "value": "abd56fa3417e5b048077b6de12811d6790e429ef52d2ed0937b955e26eff1fce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623684, "uuid": "8267b77b-fa48-4bf9-96dd-1181f4637056", "comment": "Malware payload (Formbook)", "value": "47588674eef8930cf47e9ea667729efa00f97493", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623684, "uuid": "ea7a2d69-0bc3-4f3e-bb17-8ef65fc0a411", "comment": "Malware payload (Formbook)", "value": "320886b64074105b68521475b16615851f60c0b490524ff15edeeb3437e22a001bcb43e6b8efb101d46a1850d427e27f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623684, "uuid": "96cb8bd4-b2b8-4e92-8070-6025913a00da", "value": "T10664226B73C82427F09649335BEAB3B4DBFA9100197A607FA3B45FBDB45168398118C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623684, "uuid": "6db74491-a20d-4007-ada0-1c76431bcd4e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623684, "uuid": "aeae1eab-6210-47cc-8fd6-adb390b77b9a", "value": "6144:TxDfipSqd/+MYD36d2nY+ZBcdSfJie9+NXv3qhL5nxQo6WhG40TgDwYOv9ZHx:RySq78pcKJ9cXv3OR6gugDwYOvfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623684, "uuid": "65d3b007-c03c-4d08-9fe5-6afd549e695f", "value": 321756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623684, "uuid": "a836f8e5-ac9b-43d3-bab3-67ad438c119f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623684, "uuid": "ba21555a-2bbc-4560-873c-4b2f7b7690ca", "value": "608287968693b4de2a346939fc1b3728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0190d512-94a2-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1645618407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618407, "uuid": "788f2841-e316-4e01-9ee6-b2e540da4d3f", "comment": "Malware payload (RaccoonStealer)", "value": "f99b36dea75fad7dc2ac7158e5d5709b", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618407, "uuid": "62bfa1d9-ac14-4c9d-badd-4c70d0426099", "comment": "Malware payload (RaccoonStealer)", "value": "ade73b7033e024443c9ebffc25a424d3a1fc4e67c674fcd585e9d5d5d2c774a0", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618407, "uuid": "9f30e921-a8cc-425f-9ca1-fd8ec13ea550", "comment": "Malware payload (RaccoonStealer)", "value": "02c8ae9cbc12033a8678fbcec1693c2e7a51cca7", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618407, "uuid": "3dcb146e-caac-4f23-8504-8c11b342635f", "comment": "Malware payload (RaccoonStealer)", "value": "bb21c4c9f6280a1c33a3a51ac23f6875079dcf5796fa9fcf9a6b11e121e9cc3e6bd63526785b574018c91672f0d1afc3", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618407, "uuid": "b2e0a5c2-d997-4a06-b378-9c60ee5f9587", "value": "T122C47E57F7DBF6B0E6BE867A86F1851C52B774620260A78F664072886D23382453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618407, "uuid": "cdfcd6b7-5e7a-44a8-8442-f370956a582c", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618407, "uuid": "75489d76-3484-491b-a856-792c867afe9f", "value": "12288:Qn/zDvGHAykH8vLW/4+8bzbBSreMdwBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqj:CzbGHAzHKjX1PBY4ZyrE7K3yl8PeVoo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618407, "uuid": "76c7af10-202f-4017-b483-524f91ee3303", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618407, "uuid": "3b7d1b76-096c-432b-aa44-fe0fdfdbcde4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618407, "uuid": "5b4b21cc-3172-4e65-aa7d-15414b76270c", "value": "DOC160222-1602202212333-64.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5f8e0e-9477-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645600141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600141, "uuid": "3b242961-60a5-47f1-bf2a-5b54c52d8cd0", "comment": "Malware payload (Mirai)", "value": "a010cf71dedfa2d8096d8a0a549bfb6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600141, "uuid": "36f17359-93c4-44bb-bdb3-edb3a2abbcde", "comment": "Malware payload (Mirai)", "value": "adf20bff3cac7efaf6b29c94ddaaeb37a4d6742242c3f5105a140e582da5a700", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600141, "uuid": "e67d49ac-b9d6-4e9f-9679-910593d2dddd", "comment": "Malware payload (Mirai)", "value": "78aaf1a7f52a693b062eaa99341b5fa4eefba14c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600141, "uuid": "066c4b8b-663a-48ff-bda4-30a0efc87c7e", "comment": "Malware payload (Mirai)", "value": "d836f4ee6861c6d56d682a036d5cf198738a6c6e2487f9cb98e206ce2398ba1e4741ed8c306db9efd8a4ccf90c195858", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600141, "uuid": "e52cbd40-c29d-470d-bed6-54fe4db293bb", "value": "T179534A25697A2F06D0D0E57A12F7472472F1629D3AF8CA2E7D330E4EFF2464425932B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600141, "uuid": "4a8397fe-713b-4ad9-9bfa-cca86769f1b1", "value": "1536:RnOkiHp1OkFRFdSZTk9+2klTySFUx+D9qc5+:NNxEZqyAD9Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600141, "uuid": "37af2f6a-a51c-45f2-8245-3f0945c21d24", "value": 66388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600141, "uuid": "46c7588e-cad0-4b1a-b6c1-154012bd5098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600141, "uuid": "e4a7751c-1db6-495c-8b05-b33bdb48da94", "value": "a010cf71dedfa2d8096d8a0a549bfb6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ae2736-949f-11ec-9275-42010a9c0029", "comment": "Malware payload (N-W0rm)", "timestamp": 1645617127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617127, "uuid": "7be520db-df98-402a-bef4-c14159a634e4", "comment": "Malware payload (N-W0rm)", "value": "d546eb292c17626af658e34ffa402e47", "object_relation": "md5", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617127, "uuid": "226589b7-00d5-4326-b238-b9aaac5099fd", "comment": "Malware payload (N-W0rm)", "value": "adf6d30e5c3767c268a66aa887dff2ebe4d0295c49c9bc42d343b6dd0e707825", "object_relation": "sha256", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617127, "uuid": "37f694a3-95f1-4f25-a8c7-60b0a775597e", "comment": "Malware payload (N-W0rm)", "value": "f0a379ae37a860a6c082464f4a41cd474a5f4cbe", "object_relation": "sha1", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617127, "uuid": "e4ae9c0b-c5d4-4a27-8e86-78469ad96ce8", "comment": "Malware payload (N-W0rm)", "value": "5ccbe570d543285bf427b040708589851ba0a001be0e5d29bec1b8d66eb946c5e38762b13e5611568c5e1560014824f0", "object_relation": "sha3-384", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617127, "uuid": "db0ec934-3190-42c1-87d3-214f591e6371", "value": "T118A128BEDBC2D026964DF9D1C866AFE6011C62177ED01E68E9C5D2608BB01FE24446BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617127, "uuid": "e537d73d-b7c2-46da-ac25-49f4e0832af9", "value": "96:etoGZqdRGBHD+SVH+tR+tEVwpVcgyV06JHjRzA8As8A8aZ:yFVHsRsEVwpVJyVDwFsFbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645617127, "uuid": "d8144156-5658-4c57-ac86-88b763525d37", "value": 5025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645617127, "uuid": "81751571-0e8a-4def-ad70-f74a4e7172d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617127, "uuid": "50dcfc14-3a10-4e79-a43b-8ceb7812a7d2", "value": "GBTVHWQCB_INVOICE#07JDKAS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fc4906-94fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645657337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657337, "uuid": "30c6a44d-49eb-4f8d-9bd3-8a564306c39b", "comment": "Malware payload (Heodo)", "value": "7e5cb8f2885e87282fbe7f6db9896ef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657337, "uuid": "02aaeab5-0b40-433a-8572-5c45a6fee03f", "comment": "Malware payload (Heodo)", "value": "ae1df3b0d0d2ead1bc66d49317983d9884253457d1107bc484c923147bdfb9ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657337, "uuid": "439d0fe6-16cc-4cf0-88eb-4ea779d472e7", "comment": "Malware payload (Heodo)", "value": "d481418f34a208ebd2e813c065721ce7fff02a3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657337, "uuid": "95b4fd9b-7961-49b8-b73f-5524183a757d", "comment": "Malware payload (Heodo)", "value": "c539d7b6bc928b0fe9c101360f1e160e227d76c59de96598167071143bf15d602896684cffd68cafb57517793538a50c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657337, "uuid": "f6cedd33-6e07-4891-90c7-f36c2d9a86ab", "value": "T1C1E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657337, "uuid": "7a12dd78-f819-417b-af4d-62d847f887d7", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657337, "uuid": "169d9512-1506-4672-92e8-cc8ae38ea3ce", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0phR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfPPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645657337, "uuid": "881eac88-147c-4c45-963e-50cdc5a9fc07", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645657337, "uuid": "f5e92f38-aca4-4f42-8e22-13067fe498f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657337, "uuid": "0038edc5-4046-42cc-a3f8-26099f05e365", "value": "7e5cb8f2885e87282fbe7f6db9896ef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc74c6e6-9476-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645599823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599823, "uuid": "f57ab703-7133-41f1-a8bc-bfee5d7f836d", "comment": "Malware payload (AsyncRAT)", "value": "60e06bb1c32684396f94bf5014183aae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599823, "uuid": "d0a54e4b-bb1b-4fd5-baa4-25f61e6327bd", "comment": "Malware payload (AsyncRAT)", "value": "ae3abf213a7e6be586d7e0b6f562cee7230385164c91bb63372f10fc7e7d9352", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599823, "uuid": "7d9dde2e-8b24-4a71-bf80-0b3e1289c127", "comment": "Malware payload (AsyncRAT)", "value": "3a40a2d62c6ff15184cf87d8379f8d2a7d99de94", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645599823, "uuid": "86513ff6-2c4e-4ebd-ab48-1f5da82b0426", "comment": "Malware payload (AsyncRAT)", "value": "24ed1d204419b58b45a0f9fa31449093bfc0f7102d1434702731c2008e7aa77b75729bbe9080de582cd780ba691abf11", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599823, "uuid": "033a3165-eacd-4d04-a0a2-cd456db35467", "value": "T1FBA4129CABA4B2DBF2BD0F3110036DB1D15C56C89DAEEA8B0A20765C9D930DC5F9711E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599823, "uuid": "dbbe4576-ab66-43c7-b369-3d3951271c71", "value": "6144:WCUJf7g8a016H25KX12JQ5juY7DqVIdDn:W7B7g8a0IHsKX12JQhuY7DqVIhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645599823, "uuid": "16179a86-1479-4dd7-b921-82c912f5b378", "value": 466947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645599823, "uuid": "84ecfd33-646b-4652-87ad-591da7b49b2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645599823, "uuid": "31f1c9a9-f7fe-4dbd-970b-6637d9e75e2a", "value": "BEHDBHAS_INVOICE#04EUDG.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74de5bff-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mercurial)", "timestamp": 1645619459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619459, "uuid": "b38cc583-f695-42bc-af17-4a3846e18763", "comment": "Malware payload (Mercurial)", "value": "ee21678d6c4ad7f1e8aa2a266fe76b20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619459, "uuid": "a44f4eb4-6d42-4441-90e6-c8a6c34eebb4", "comment": "Malware payload (Mercurial)", "value": "ae5cb1e8cdf7c298ddcaec79334a954a8a34d98a58e3aa857c2f75373dcd08ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619459, "uuid": "bbe85c4a-7090-4fdb-97c8-3eb225cc1712", "comment": "Malware payload (Mercurial)", "value": "677a6d5cf3ee018644c29e30a97b3ef966eef25a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619459, "uuid": "d20a859f-ad63-40b7-b700-9cc076179d2e", "comment": "Malware payload (Mercurial)", "value": "d6b9132e18e4630ee548edf297faa5ddad02dc2032ea1059180f5ccde26199c3b75e9f2a5dcc04eaae304ec78643e30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619459, "uuid": "cc6a5154-db07-4127-baed-4368de148667", "value": "T10013074977EC0609F3FE4B7A6CB2911446B6B8A6AC31EB4E1D94589D0873B80CD90F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619459, "uuid": "632afa55-177a-4e6a-a1f0-8c0dd4eb7b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619459, "uuid": "f35a4715-e2aa-4cda-8663-6708f5173ef9", "value": "384:5/6DSRia2Pz5Y4eN8zM517J3dDlKz++cTTmrs/XZxIh/MoJEFq5nml6TAssKQsLZ:U40M5/dj+uWuZyLM6TjsKZKfgm3EheO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619459, "uuid": "a39be4e5-1f17-485e-8966-a56ff5e24421", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619459, "uuid": "73d3ca81-ee00-41bb-ae9f-472cdaa08d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619459, "uuid": "d30af16c-7d5f-4bb6-84e8-3d9a52359cbc", "value": "ee21678d6c4ad7f1e8aa2a266fe76b20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23efdf2b-94b2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645625336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625336, "uuid": "0c0b5aa0-d304-40c4-88da-cf3754c009a8", "comment": "Malware payload", "value": "315c3b97fd18577e360e4956a7130d51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625336, "uuid": "94f17d9e-7d25-4b3c-adea-620565449eb5", "comment": "Malware payload", "value": "ae7752f2d09d42090b41558309118f902afc0071e627fd6283ee7d314ecb5319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625336, "uuid": "8d0c0af9-3d20-4513-953e-d5347ba124fd", "comment": "Malware payload", "value": "c817225477b6a0a90ba647c60f69dfce9f8ab301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625336, "uuid": "0e0c7dab-a0f0-4f71-9daa-ed73b27d6292", "comment": "Malware payload", "value": "4fe71c3e2feb37d84731e437f4f4378cfae1d5a999f0bd47890d4fb1046b62d2dcbc0f2816edf397c4bde576c04766aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625336, "uuid": "a4e1f505-c0d4-4419-b280-4b34bd32b70a", "value": "T136251266EA1442F1F5F10172E9FE7DE6166AAE76031420D723E478666C712E3173A30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625336, "uuid": "f2fac035-5d8c-4137-8539-a40168cd8e89", "value": "71ece0c59f467938bb7cf321dccd47b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625336, "uuid": "56ee5982-6f24-41a8-9bf6-4473680c8921", "value": "24576:JuIAZN1mLeM37s0e/2WXVmhMX8ppn5EKVyD/J:Jre27sb9EpJShrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625336, "uuid": "66f808cb-6d65-4f1c-92ca-54c09998e3e1", "value": 966720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625336, "uuid": "bb4c218c-f0a2-4f6d-a8ff-450c07c612e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625336, "uuid": "28c98d42-a260-4bb3-ad3b-c3dd3f6b2f21", "value": "ae7752f2d09d42090b41558309118f902afc0071e627fd6283ee7d314ecb5319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950a7338-94c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645634546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634546, "uuid": "eef33f64-ea4d-43c7-ace8-872ab94aaf2d", "comment": "Malware payload (Loki)", "value": "627f541b7031fbbf6c7635c035c03a01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634546, "uuid": "bb7f1d4e-209e-40d0-82b1-ae77b08d5471", "comment": "Malware payload (Loki)", "value": "aec37c0354418c5918aa4e92b227affbac9f880be79f165ffb7c77adf75fef96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634546, "uuid": "d3ba3bc1-9bb7-4a1d-bd21-542698c05207", "comment": "Malware payload (Loki)", "value": "0b47196328c7e0dad3090bc773747f5e5a431ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634546, "uuid": "8325dfe3-3ee8-4d9d-af30-a1d103334ecd", "comment": "Malware payload (Loki)", "value": "0927c1a0bc0c714720b11e1c5271699d4617d67b0b9027b944e4096cfe9759fe74a6f9ee40a40dc3bf05e75ae4f61ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634546, "uuid": "0f1b8243-a519-4710-b94c-7bfe296f76cf", "value": "T150E4BE2028BF60CDF073EAFE9ED8F9F5CD6AE13A260C75BA24450F564B41904ED12676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634546, "uuid": "0fa8f665-b940-4ed7-ba3f-02d095777914", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634546, "uuid": "2ab404c4-c1be-4554-a4c9-302cc6b1b348", "value": "12288:jEJgYYz0N+do/cGaLJJ6z4sZy+zUHwmg3LA8kWrkTCksWyhRkfaP/DyHdUOPp:j9Zm/ZaXqySUu3cp0fPP7KdUOPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645634546, "uuid": "da832975-7117-4577-8999-84636593cffe", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645634546, "uuid": "92f9b9b2-ec81-43e6-82c1-9b2adcd2806f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634546, "uuid": "54d86e12-b808-49a6-966e-380144ad8a69", "value": "Comprobante- $178.000 USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541c8f55-946a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645594494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594494, "uuid": "fda874bb-e14c-4a59-a012-bb0298eb12ba", "comment": "Malware payload (Heodo)", "value": "e860bdb350240ab453a7d6a5d98f60b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594494, "uuid": "2c685803-7935-45ac-b0b5-819ed256a539", "comment": "Malware payload (Heodo)", "value": "af02a319c14bd92ee3e68456ff26d8e5b4e99750b9c6f7e1c031c804995718ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594494, "uuid": "ba33e3f7-48c2-43dd-a6f5-a37e26bbd48b", "comment": "Malware payload (Heodo)", "value": "a16929b3a492e16cea710cfdc33a50720db974a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594494, "uuid": "b99437c0-5eed-4955-80e0-013b0376449e", "comment": "Malware payload (Heodo)", "value": "8668955178854f60bdeebd1e3d3c5b992b4f7b1b56fc5a14da095e9db380d63b47c72c1a33d20ffacca43f2cf7f19177", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594494, "uuid": "204f0f8a-0b25-420a-9286-e87109bf07b4", "value": "T1D6B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594494, "uuid": "1e73d31b-0baf-408e-a0da-62bc837b38ab", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594494, "uuid": "0a70775c-789a-4ae6-86ec-88714e3f7a9a", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wMIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWLzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645594494, "uuid": "220fb442-0f98-4d62-a4d2-0c8c0068ae55", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645594494, "uuid": "7706728b-c5b8-4c9f-ba35-a11d79a1ae2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594494, "uuid": "e2b7c54b-ef51-4fe7-94d5-b0f56413e1f7", "value": "e860bdb350240ab453a7d6a5d98f60b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a0a765-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645622955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622955, "uuid": "f8ed6a13-6ae8-4019-9431-9c68ebe1c798", "comment": "Malware payload (Heodo)", "value": "b8f3bec48ad2cf2dc0cd7badf62bfb32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622955, "uuid": "2d3ca48b-b525-4223-bcdf-ae582af22c82", "comment": "Malware payload (Heodo)", "value": "af0d0fd82b9329a0f9842a8c8e42651b9331d58c88ba3f210ec154cf107a6a69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622955, "uuid": "230cb427-65c0-4b30-aa35-468153231ff5", "comment": "Malware payload (Heodo)", "value": "c55f0766f615956a9b9c82cd3193ed909212a41b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622955, "uuid": "7b3f92a4-85b6-48f5-9a16-7df4f7b33586", "comment": "Malware payload (Heodo)", "value": "0ad93c8aac997da911c2d95b9bf3f1b5223b159ea8ad1b2bb02b6c38196cfdd04290dbe6978839a8caf268c88af7ac3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622955, "uuid": "7644b173-40cc-4fbc-a081-90b327629a79", "value": "T15535BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622955, "uuid": "2432f724-9397-4e34-aa98-74d11198f1ce", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622955, "uuid": "687f1cf6-d87b-45ee-b4a6-0d1930488d97", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/VTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/VTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622955, "uuid": "43b1ebf8-1649-4f0f-a94e-bb7795878bd2", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622955, "uuid": "d85beeca-20c5-4717-85dd-1a85d42af534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622955, "uuid": "a5d08ab3-d041-4389-a484-06c2e38aec1b", "value": "b8f3bec48ad2cf2dc0cd7badf62bfb32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31829889-94c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1645633949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633949, "uuid": "a7b51ec0-800e-4a1a-abcf-ced23b238771", "comment": "Malware payload (Quakbot)", "value": "160deee692a2ce0098798546b1ba63ee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633949, "uuid": "e4440358-69d1-4e29-9cff-cf9cde534669", "comment": "Malware payload (Quakbot)", "value": "af9ff6ecb351b6b63446c24677070b767b8f77b0a53feccdfde2c42c1205c258", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633949, "uuid": "01329964-15f5-42b1-88b4-389f18dfb9a2", "comment": "Malware payload (Quakbot)", "value": "f3ea574def874cad92223233b4c9fcef4e51f0bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633949, "uuid": "abbdbac4-fb33-450a-91df-e724bcf6e16b", "comment": "Malware payload (Quakbot)", "value": "829603aac360602874bf3a81a427aed90c1207498831d90a38be2c82fa17163b9011e5a006802ddc1645d4bcaa802939", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633949, "uuid": "15aad64d-337c-4424-bc37-3838413a7347", "value": "T11525F94286642A0DFD3DCEFB6F3AA3ED40664F70192AB256E350288951B81F1723DF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633949, "uuid": "9cf38884-60a5-4192-a6d7-b99d6f1a0acd", "value": "a2c4c1cc45cf157e67048505a3f85c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633949, "uuid": "d984acc3-4b0e-412e-b5d3-5b06c3cf7ba8", "value": "12288:Zg4d/lpygJCNLgUgYUypwKzpVCD2aep4Xl8I1JV5OwBi6fC8a/ZnFH08hXhQrVNP:ZdddhCN3tVwV1Twh/n/qVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633949, "uuid": "e9d73152-9779-411e-bbac-18d6a1836096", "value": 963168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633949, "uuid": "3154f335-a1f3-496d-bf7d-ba8b6667a820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633949, "uuid": "d4fc3118-a2fe-49e5-aecd-8a1d516f6911", "value": "af9ff6ecb351b6b63446c24677070b767b8f77b0a53feccdfde2c42c1205c258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7584b79a-9474-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645598845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645598845, "uuid": "ef3765f3-ba00-4ec4-af38-d4c5375e0781", "comment": "Malware payload (AgentTesla)", "value": "2488b364dbc8fc2b212058e6a2f4dd73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645598845, "uuid": "f07a7289-baf9-4501-b433-fdc9f960f8de", "comment": "Malware payload (AgentTesla)", "value": "afd924a867a430a85a5fdd49a40798c343194d4c6ead9b946a9a703135d85860", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645598845, "uuid": "612dd2d3-6e3b-4c9f-b223-640830cbe706", "comment": "Malware payload (AgentTesla)", "value": "a1dd33a1a1fba3e8f80de34671b83277c0fa59e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645598845, "uuid": "e787dde9-0dff-4768-b124-432e8c25c1d3", "comment": "Malware payload (AgentTesla)", "value": "1af1becf0256e1f0ba53a80b85268070b5c618cb75645db023484e88e99fe52357e6c53096221b95b07faeb09884a156", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645598845, "uuid": "ac7f8a8a-1271-4267-acea-7e4211f777d1", "value": "T1D9F433031861E7DDB822B36DB835B2059DB8E85BC4A48598DF2B3CF80C6FE5DC65E245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645598845, "uuid": "ed33ef21-89b7-4900-a2de-d76832080747", "value": "12288:qmQXbio+ZqJqxAboiSbCzphE2pCBZa8QiPDsVnLA/KVBM+hGPcZnQ/AHcK:rRhZcEEUCPzpcgQPD+A/y36XoHcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645598845, "uuid": "7dc48852-7fe4-4bac-8f39-4a7246e2bb94", "value": 732026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645598845, "uuid": "e7dab0f2-aab7-40af-b358-acbf4925c2e4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645598845, "uuid": "30fd7a88-ce33-494b-af5d-2999271ae44c", "value": "payment receipt.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e41512-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620293, "uuid": "f9902812-34f6-40cb-8fd2-50046e9b9f4f", "comment": "Malware payload (Heodo)", "value": "a0f9a55a9aba95d15c63d84ee72d336d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620293, "uuid": "83c82b1d-4005-40bb-88d1-71cfd2f2359d", "comment": "Malware payload (Heodo)", "value": "b04631b1a6c5d940a680fcd326873dab1900edcbd2ba94d6986f6cb2336c56e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620293, "uuid": "f7d326f8-380b-43d5-b13a-8a81944c2e13", "comment": "Malware payload (Heodo)", "value": "8513f76d99c4e9030f8629a5857e893495809bb7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620293, "uuid": "128c9157-7ef3-4a60-9487-c5ec5cf4780f", "comment": "Malware payload (Heodo)", "value": "6a1585c777de32e4ab348b73c09d1409985c225f1429e79d5f49b1a081a4710921082865b656cf17c8e802c8d952a7ee", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620293, "uuid": "c14986ae-8280-44d1-8845-c1f8f95a3046", "value": "T1A234C04AB84A5C35FD45C3BC89C387CD84E5AD3A6B5B815E4D28332396B3EF425025EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620293, "uuid": "693302ec-0f84-4050-890f-a145209a4e60", "value": "6144:DKpbdrHYrMue8q7QPX+5xtFEdi8/dg/ThvsiKIjvl5fd1Xh8rsoX/w/04:ghEXs5fXR8rsNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620293, "uuid": "7bb779c3-5217-4ff4-9e95-b50b53172990", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620293, "uuid": "6fd18aa1-486b-40eb-9f96-41bc77503063", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620293, "uuid": "58e5bd51-694c-4d7e-8ed7-532465c93011", "value": "4_566.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6850f2-9448-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1645579881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645579881, "uuid": "5fc7e64f-7d80-4541-9d18-2167d7a15fa0", "comment": "Malware payload (DanaBot)", "value": "4abb2ec8fb0125dc26a53eb690656618", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645579881, "uuid": "73ee3167-f6c3-4e5f-a35a-003826d00e01", "comment": "Malware payload (DanaBot)", "value": "b20753700e6839173e63c607bd2e7da1da85b3d46f7c67b8e4b819814ff898ba", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645579881, "uuid": "9abd75cb-78e7-4d3e-8d62-8eda16b8ed44", "comment": "Malware payload (DanaBot)", "value": "0b6c1e852d817dcd609b62c32cc4bada63de3d53", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645579881, "uuid": "8886d8a3-227d-4d4a-9efb-4009ffec9337", "comment": "Malware payload (DanaBot)", "value": "0cb3de5b34686b768e2283272e31f1f6067dbc634ad827ed796d75048b7b4b6f8712632da28de97f2978a18231311603", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645579881, "uuid": "2582f1f6-2d1a-481d-a2a3-23c11c3bc4b5", "value": "T19A351210BA90D035F5BB12F489BA83BDB52EBEB1971551CB62D46ADE0634BE0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645579881, "uuid": "3061c1f5-1155-4822-aac0-b4d4d2ef2c28", "value": "ccd6a4e90a04c24d49f4949717a298d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645579881, "uuid": "7180002f-a5d3-45ee-ae1e-8b59d81a5d79", "value": "24576:+PB5KiCAWM8lnEM7ZKkJUqXlEMcmVRW1x4EBB7pnOCgg:YmMah9rmq1oGRw9jOC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645579881, "uuid": "321e5cc2-fde8-476e-96a6-40022f42cb9e", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645579881, "uuid": "245446e6-8aae-4c9f-835d-a368c50a7925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645579881, "uuid": "bf41ed5f-4757-4f1d-bd1f-17f005a3081b", "value": "4abb2ec8fb0125dc26a53eb690656618.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376ca0b5-94ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628805, "uuid": "cb4d2444-c55f-4e8a-9f6c-fce4da665977", "comment": "Malware payload (Heodo)", "value": "bebe818bcae3904e3e9dc74bb490a46d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628805, "uuid": "820d71ba-0af7-4572-a48f-de421803ddff", "comment": "Malware payload (Heodo)", "value": "b2a273ad65e97bf6e321134adbfeef2a978cde3a88bc3d1f97f063f8983538eb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628805, "uuid": "eb33d191-0897-4da8-84b8-af154b09c4a3", "comment": "Malware payload (Heodo)", "value": "1fed11c005e15f6b0d9b4ed7fc5e4732625870f1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628805, "uuid": "2bf3ddf7-9422-4108-aa9e-e79e5859e04b", "comment": "Malware payload (Heodo)", "value": "fcbe678807c9f1aa1ccd5cba02599864a9e5f8a1907beea80a0b34601bd021525d72242bcb0abb236a94343676a5eb0e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628805, "uuid": "a99e96d0-11c0-461c-8a3d-00137efbee35", "value": "T10535BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628805, "uuid": "cfe75560-ce02-4ea3-b634-f2769f2334d1", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628805, "uuid": "c6611287-3060-4016-9ca7-da1f14ff0878", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/STewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/STeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628805, "uuid": "ece799ed-0e71-4e16-84ec-73daea5bf140", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628805, "uuid": "a4a38272-9b13-4ce5-bb60-e8f1a650ca43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628805, "uuid": "e4252a07-2266-47c4-92cf-4bd57eff62ba", "value": "fRuYg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cebb6e-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645630044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630044, "uuid": "11689bf1-ba15-4f23-a9bb-1a0a248393fa", "comment": "Malware payload (Formbook)", "value": "fee9161f3dac689ca89ebf1086c7de42", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630044, "uuid": "93662d47-27d3-4d38-b18f-7d288b07a139", "comment": "Malware payload (Formbook)", "value": "b2bd1a5ca08be4b29387c9c52dbbcebefc0f1f34f372b78e5bd24cb4fffaf3a2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630044, "uuid": "a8ab17af-0128-4c77-8d5f-f452aa1dfdf8", "comment": "Malware payload (Formbook)", "value": "bb5ea6fb11ab70151ffc7155904c1d9f0958dca1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630044, "uuid": "fc5ae6f7-6661-4b5c-a58b-f17cca43bd43", "comment": "Malware payload (Formbook)", "value": "bfd2f30d33f7cef8221578f6472dc67d20d61e63d746e6c88622050100abd2bd6ff566a3136d26d5312cbd95160f5db6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630044, "uuid": "5a015c1f-94d3-4b0f-ac83-6d21da719ab0", "value": "T1E614022937638784F9BA8330CB5AA6AA37AFFCE80D11144012FBB7560C799D5C8353A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630044, "uuid": "8e26732e-abf5-47d4-967d-ffbf73b0de40", "value": "3072:u4iRZk60G+bS28hk14qLH/TSgf5tQhfM22AYx8Afpr7G2Z/F9h8u8yZe:NO052hk14qLegfQNM22AmffZr8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630044, "uuid": "1f856e12-f763-465b-bcb5-9dee3bfe64fc", "value": 191192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630044, "uuid": "87ac94e2-ea7b-4e27-b25c-a6c08f7a5738", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630044, "uuid": "83d18846-93c7-4712-8f4e-93545fe0c738", "value": "Telephone Message.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6accaa5f-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645620301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620301, "uuid": "772378f3-036f-4023-929b-dd32dd1b3634", "comment": "Malware payload (Heodo)", "value": "c6ab92e94b280329002759752ee79253", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620301, "uuid": "22925682-c44b-4f91-bf86-43b4e5ee537c", "comment": "Malware payload (Heodo)", "value": "b2e13370876930cafc8c088a7011cb600cfebaaa2bf97164af939c2a996439fc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620301, "uuid": "8bb2355e-6eed-475f-b007-70832e04eb8b", "comment": "Malware payload (Heodo)", "value": "fed2aeb8af5efdfdfb5dd42939f6f1c3dbd8bda6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620301, "uuid": "c67bb1a3-9ab9-4127-b25a-a0415f6c24f6", "comment": "Malware payload (Heodo)", "value": "43f34fbe7f03cc5f14f22fabe1bbfc75c216265086a9f80a744c68b68adbc903ff671e774c74c6980b1b2127690549df", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620301, "uuid": "fd0d9391-d2d7-4cb2-a502-e6e3fc365943", "value": "T1B124AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620301, "uuid": "cdc5e8fa-6251-4324-b691-06ead768d62b", "value": "6144:WMyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:NyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620301, "uuid": "b7f68668-f4a1-4d36-b927-8a66856ca73b", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620301, "uuid": "a7fb4232-3f85-46f6-96c8-7297d2f91ea2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620301, "uuid": "5a594077-4eac-4bdd-a64c-d886269d0133", "value": "Gmbh_2022_02.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1afe83-9453-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645584607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584607, "uuid": "0d31ff3e-7ca4-41be-9296-89ff916c6bdd", "comment": "Malware payload (Mirai)", "value": "0fec02594c3cab3a1fbbc4e4e3e34fe4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584607, "uuid": "155e857a-f64e-4f0b-8cea-da09d415c633", "comment": "Malware payload (Mirai)", "value": "b375cb689e91343fd8e86bd05bd49eef92115d6d3bece075f605f5a559c10d85", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584607, "uuid": "19bff0f2-dccc-4f82-9940-c26b27e86c3c", "comment": "Malware payload (Mirai)", "value": "ee6c94d7d2f1fbc437236522dd01675f5528b0e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645584607, "uuid": "ffc43f9c-2c0b-47fc-9ac3-069c638c414d", "comment": "Malware payload (Mirai)", "value": "c790b54fbc5097ac44131e86c5f739d7a20ce38b4b12af8eb2fbd28a4c2be85990b90f78e98b463f98f2290cb9e339d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645584607, "uuid": "6471c51c-e25e-469f-919d-033e051672c9", "value": "T13C52C7E2BD459E03CAC46237FB0E839D7F265748F2EE33036B1B6F5166079170A6640A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645584607, "uuid": "78c5cdde-19c2-4478-904f-da1e32c89740", "value": "192:P3ytjn0s/uG5hsQa9ZBiM0b85M/d6YrGooJHb5B8okEZx4ewEu:P3W/Wc49iMU8rYrC3B8oFx4eNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645584607, "uuid": "6da9750d-3eff-4493-8cc2-eafbd7085da2", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645584607, "uuid": "57e944b8-4205-4b6c-b059-b492710469c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645584607, "uuid": "a4bbfaed-fa0e-46ff-8324-62c8eb9b9195", "value": "Yofukashi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffd8890-949b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645615612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615612, "uuid": "f65dd004-a452-46c4-9519-75fbf24bc40b", "comment": "Malware payload (Loki)", "value": "cca2c2d0e3f436c105fe0d8beb7fb76f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615612, "uuid": "047a2435-9387-4a02-8206-8ef91744690f", "comment": "Malware payload (Loki)", "value": "b423f52d2a178115faf3ba1b18817d2990334405a5bd7eac59ccba914ffd197d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615612, "uuid": "a246de49-b56c-47ee-a285-d9578f02e633", "comment": "Malware payload (Loki)", "value": "e3f906400a002cb0c2403fb31e9521d018a0d78e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615612, "uuid": "a0e5a1b6-44ca-4917-abc3-10df7c9657df", "comment": "Malware payload (Loki)", "value": "51670f17b50c905e9a10fb62740c83becec72fa917340110b43842cf0cdb583bd297aac7ca5bd6e78cf6b13504ace0f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615612, "uuid": "8e3fe91e-afc2-49c0-83c2-0d89cf4c711a", "value": "T1F4F4BF0829AB1F3DF5B59BB11DC5ECB0BA59FA331C08B3BD78416686C661F808943677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615612, "uuid": "11cff66a-33f3-4a8a-934a-b8aaa19f0704", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615612, "uuid": "5f67dd2c-2c3d-4bdd-aaaa-dbece7736659", "value": "12288:MWGCrQDwh7jbK77777777777715ho6NTBq+98XgLSdFufwCsTd11+hMv19vb2yed:bK77777777777715hrVq+9aqSafwVJ9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615612, "uuid": "2fdf293a-e42f-4bf6-9e78-2c741d42588d", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615612, "uuid": "04f1c161-d7c7-4122-8ba5-139b73fc0a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615612, "uuid": "b8ba6097-71e7-486a-8dd8-bf0f88a3a802", "value": "REFUND-BSCH22.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78fbffa-9478-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645600781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600781, "uuid": "7384cac3-30c9-44aa-8f91-dc93314e64ff", "comment": "Malware payload (AgentTesla)", "value": "003d78f8ee68803d3cc563bc886a4f6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600781, "uuid": "d34fd377-f35a-4971-855d-9dff2b6886e0", "comment": "Malware payload (AgentTesla)", "value": "b48650ba14beed7253f833936514a482d7905851317a45c19c424a0ef9ce8e4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600781, "uuid": "e13fcccb-9451-4db1-bb43-101e9f033fac", "comment": "Malware payload (AgentTesla)", "value": "efb923aa0d1e5e2db0cd21316182441a6de7e7df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600781, "uuid": "8ad766d8-4d8d-4329-9cfd-31ef7226d9f3", "comment": "Malware payload (AgentTesla)", "value": "75e9fa9e42cd8407c3915d29983ab4cb89ee2239599df4ae8d4aae68070a106a9924cd2ea6806f0ddbb2ac9e4cf2e973", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600781, "uuid": "666a828e-936d-4059-849a-10a975655ab0", "value": "T1703307666C99951DC9D87FFC99F1E58A1232ACE00120C14FE8F97F29AA32323DCC515E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600781, "uuid": "5bea8c5e-dccf-4fad-be23-e73d9ab60956", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600781, "uuid": "994484fb-271b-409e-9955-bf5aff92a1dc", "value": "768:gIrZ2MkdIRVokbDb8WzoixlmMwCK/3deVD2:gIF4IRVvbDbHzoi630VD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600781, "uuid": "d2c74861-b1f7-4ea4-a830-a807c7297dd5", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600781, "uuid": "4834e3de-312e-4e72-9dae-9c1eda9d1345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600781, "uuid": "ae371527-d35d-4418-b573-9dedc4b37c61", "value": "4098125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ad7e8c-94b9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645628425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628425, "uuid": "8d39a2d8-8339-4767-81e0-87c9a4520e1a", "comment": "Malware payload (SilentBuilder)", "value": "9a7afb7557615b728aa97c6b1327c1b6", "object_relation": "md5", "Tag": [ { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628425, "uuid": "3b27a480-e51a-456f-85a4-be8648a9f35a", "comment": "Malware payload (SilentBuilder)", "value": "b488a09972aef9504171a253092d6d99bc6bbe9cf8ce5ecd532e44ab9bb01fc1", "object_relation": "sha256", "Tag": [ { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628425, "uuid": "393e60e7-e693-41d4-9714-bc8efd39ab27", "comment": "Malware payload (SilentBuilder)", "value": "258f7650ec376d425f8bf5982c9cd9516e53d09b", "object_relation": "sha1", "Tag": [ { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628425, "uuid": "a41d8cba-e191-4b3b-ade1-6d86bff2a472", "comment": "Malware payload (SilentBuilder)", "value": "9750ec0f196509bbe6122fd20b6c18992683d3cbc95a66b8c7cfdf0e777baffd8aade9622df38bd892ca9ef1cf466691", "object_relation": "sha3-384", "Tag": [ { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628425, "uuid": "558d99ed-e7e4-4925-9c1c-7a8a09861ac5", "value": "T14F44C04AB84A5C35FD45C3BC8983C7CD84E5AD3A6B5B815E4D28332396B3EF416025EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628425, "uuid": "f4d10778-511b-4a97-9cf5-719aec4da7de", "value": "6144:EKpbdrHYrMue8q7QPX+5xtFEdi8/dgUThvsiKIjvl5fd1Xh8rsoX/w/0t:UhEXs5fXR8rsNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628425, "uuid": "8540392e-f652-4d8f-9c53-60ea78352aa8", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628425, "uuid": "764b0849-9b71-4a95-a477-c2f42260a4ec", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628425, "uuid": "343ef018-2b62-4957-bdc7-69bb3ad68159", "value": "DOC-8.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ea8615-947c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645602436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602436, "uuid": "0907c50c-e82a-4285-8fc8-d09e55d140d1", "comment": "Malware payload (Loki)", "value": "1b5e9afaf4451b0fd2c0e185e4a6f116", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602436, "uuid": "eff55edc-ffbd-4d7e-8ca4-13bff7947837", "comment": "Malware payload (Loki)", "value": "b51dab942122cc03241e78982517035996afe909f2e4c5917d00dc7051803b47", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602436, "uuid": "3e2e4b58-18c3-4d64-8365-691061e48dad", "comment": "Malware payload (Loki)", "value": "8790ff8ccd0bc5e64945f4fdfbdf03bbb4734315", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602436, "uuid": "7225b9b9-655c-48c5-b9b8-4977caea1c90", "comment": "Malware payload (Loki)", "value": "cebbc9d5f43e9e5f120a91b7c002611ab3ab0cf1369aaa6536a6c8d3cb635cf05d2494b70822d2a26bb70a40b4bb1337", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602436, "uuid": "b34b2e38-cda0-406e-8f15-635b49106c92", "value": "T119C423C33C69B8CE2E75C06F6C18A1A485F5956082B11DC33B9CF7DD5B7A14A4C8E87A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602436, "uuid": "9fc9f0cb-eaad-46a3-945f-cd3c82f66634", "value": "12288:VOKKqzcByc85ItpTvc58gfJjllf87QawJ5/gh+1IhG83aBL7xct:VOKKbjtpg58gZl27QaaYU5jBLmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645602436, "uuid": "9cd1cbd8-c7f2-47e0-86d7-fea737ebbd69", "value": 595479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645602436, "uuid": "bb442a96-563c-4e16-957b-3a8175735824", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602436, "uuid": "afb09f08-6ff7-406f-a3cd-670b59067ba2", "value": "Samples doc.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a6dd26-9456-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1645586178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586178, "uuid": "d5b804c5-5846-46e3-bf70-671d59241ad5", "comment": "Malware payload (NetWire)", "value": "0cf1f73e6e44df792a0463a415be8c36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586178, "uuid": "a105840a-ad8a-435e-b472-c2cab5dc1782", "comment": "Malware payload (NetWire)", "value": "b5e057dd035dc2c643e93e2ca114b458c6e8376b137236ab2c4840de7acba6c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586178, "uuid": "79999f64-bc8c-4fa8-9e8a-136929ad23ed", "comment": "Malware payload (NetWire)", "value": "3de2be50f7f7838a80eb77c1e5abd02dc5691f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586178, "uuid": "46000fe7-bd29-4447-9557-7fe7658e8af8", "comment": "Malware payload (NetWire)", "value": "e6bcf7ea1bbda2511d0ac943e152553a25bf0da67c6bad813b6daccf3f0d32dc0e954531751bceb3a080a2aab53acd2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586178, "uuid": "57ca681f-ebe6-4f83-844f-89f3a9167bb2", "value": "T1C705C04839AB4F3DF1B18BB21DC4ECB0FA99FB231C08737D78516646C6A1B809952677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586178, "uuid": "a355405b-4ca6-4845-b9fa-19c266599e4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586178, "uuid": "72455d06-d495-43f8-a93c-542d85706bcf", "value": "24576:bK777777777777OQvoPwEzVEkVL8eYd9wgdHHlWFeKxsA:G7777777777779vwwETVL8eOpFWFe0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645586178, "uuid": "93fe370e-117e-405c-bdda-b5bbb320144b", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645586178, "uuid": "fc5396e3-d483-40e6-a65b-d0a4fac73533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586178, "uuid": "d2df9452-3479-45ed-8721-00871ff8f6a5", "value": "489309000023443.INCPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8351c6c3-94af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645624208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624208, "uuid": "119bdfba-0a09-4c53-9512-d742e9106902", "comment": "Malware payload", "value": "b792bb1b55a686eab1e1c74a97532e0a", "object_relation": "md5", "Tag": [ { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624208, "uuid": "fbb3671c-4fbf-4949-963b-9136e2ec9205", "comment": "Malware payload", "value": "b67a252c0be96380c51eabc2d17513989544412df6c13299dc9e388f9e9b8ee5", "object_relation": "sha256", "Tag": [ { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624208, "uuid": "83b968bb-b422-4239-82d2-21440a7c7ca3", "comment": "Malware payload", "value": "7d533dbd608306e680bc10a376c26e56ebb32085", "object_relation": "sha1", "Tag": [ { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624208, "uuid": "1b2bf36e-8ff5-4fdb-959a-d5c7e4adfd1e", "comment": "Malware payload", "value": "57265c7c9ce1d27f97d46b1bb521bc54217c419a1b4e40dbc4bc239b51e5865c79a1bacd9335daa3e7abc204cdcad9e3", "object_relation": "sha3-384", "Tag": [ { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624208, "uuid": "dcfca32b-cd54-43f3-b3cc-cae5836e1c8c", "value": "T185C58C17FA028F32C6EE037924B247487775B24497835717180DE8A5FC63BE1AB9D2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624208, "uuid": "cf658da1-7c09-4020-aa49-8434c83525db", "value": "24576:p2PMWmluKysdW6IS69fIQp/oFsonPxMDX2JmScxGc6yhPXFtwOEng2:kMIW6eQp/2sMxGX2JtcxPNSOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624208, "uuid": "3a6b8f4d-c29b-4a04-9948-3b62fb2a3bb0", "value": 2729332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624208, "uuid": "03ed0fa8-5255-47a4-b6e4-b7474254e7c1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624208, "uuid": "ed37f948-aeb3-4d31-b2d2-0d4ac8d04f26", "value": "b67a252c0be96380c51eabc2d17513989544412df6c13299dc9e388f9e9b8ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400f4e73-94a5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645619800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619800, "uuid": "94a68432-3e72-480e-8ea6-3463ef9b9572", "comment": "Malware payload (RedLineStealer)", "value": "60713255d9696a147dc2153e9a496aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619800, "uuid": "4c661ab7-b4c3-4061-8c2e-573272224e3f", "comment": "Malware payload (RedLineStealer)", "value": "b6cb082a4eea02dc5da3037d71abd3a8fa0f475200fe75adadb12d791a133457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619800, "uuid": "cf5549ac-4fcc-44ef-b2e9-80e094784183", "comment": "Malware payload (RedLineStealer)", "value": "80deaf8cc3169555795d70dd38bf4b6a7e6df9e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619800, "uuid": "9b3168ae-b26c-4d38-b308-e4fbdfb80f0e", "comment": "Malware payload (RedLineStealer)", "value": "8808ef2f4c0c53c87f61b6c7b40ad0c4305f9a366cb9830bd8a2d01dc693985108d461635487ca50000cb32dfce140be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619800, "uuid": "b8295650-5721-4163-b6d7-e796f1987f27", "value": "T1CAA33AA027DCA620E6FE5F70ACF8119443F0E443A502DB8B6EC570DE1E76B81E6567B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619800, "uuid": "5c24ec2c-9c6e-4c97-9a4a-f72f0c39bf94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619800, "uuid": "255418b3-17ea-447c-9b0e-1f5cbdb5426b", "value": "3072:3ucUJyKCfYi0tJ+OJfy5mXGCCjv7JSWyl9DibtuY:3ucM1RGtLgWyl9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619800, "uuid": "e29c8144-411d-49fb-8118-cf863bbc62a2", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619800, "uuid": "79e30976-f466-4e70-a515-8cc32d35e5c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619800, "uuid": "6d32b0c8-8509-4784-8b0b-3146423fbf6e", "value": "b6cb082a4eea02dc5da3037d71abd3a8fa0f475200fe7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2775520-94c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645633333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633333, "uuid": "cd237b83-7a37-466f-bac4-3aa88ccbc5cf", "comment": "Malware payload (Loki)", "value": "ec0c675a945282bc76fb5e5d65325d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633333, "uuid": "8aa9dc64-2022-447b-8f22-5f12971da28e", "comment": "Malware payload (Loki)", "value": "b709c34c37903f1e843a68fd40a16a352e70050cba9f122ef420764b55a11fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633333, "uuid": "4c318eac-485e-40d8-9e4b-e7c5da19e99f", "comment": "Malware payload (Loki)", "value": "367ea9e5f8c1fd75c36f2c5e6f8f505f7e5a37e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633333, "uuid": "8ae5d13c-a1a1-4ba3-97a8-d7ba72de9d8f", "comment": "Malware payload (Loki)", "value": "f4934f18c15703ea5cab1a0fbcbe6ca09573ff0c2f4359b0ad1ebb4daed5fb3b4a098bf0e0fe1d08441f4226efdb2333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633333, "uuid": "311536f8-2e0e-4041-9d4a-9850b04386a9", "value": "T183C49F44741AD84DD5E102F3FC57845AB1741EF329A8C97EF16873163A3A38EDC2B9A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633333, "uuid": "67598b9f-7831-4064-9312-293b74b7555d", "value": "97c78528560304e623c2ccfbb0d08b5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633333, "uuid": "2391460f-1ca1-41a8-a512-a72ca4d42b88", "value": "6144:18i2LFkWSD/vMCI8PEpgBl+rM/7gn9uk:18i2LWWSD/vrvT+rM/7gnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633333, "uuid": "b99d627e-9d2b-468e-96d9-4d0720a0a531", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633333, "uuid": "f52080f4-4489-454a-90ec-fadb8de2f20e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633333, "uuid": "f6165d75-c7a1-48f1-8133-10672073ce0b", "value": "ec0c675a945282bc76fb5e5d65325d86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8d0c6e-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "9d538999-0d3b-41b0-b798-6dda21c9baa5", "comment": "Malware payload (Heodo)", "value": "8b89901a01711596b4fd3d6cad50c4af", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "6d1bd203-05d6-4762-b1b6-77c7ba8881af", "comment": "Malware payload (Heodo)", "value": "b769ea6ee12f9ba315c0f944ff650f84da113acc489b6aa999a9d10b0a972c5f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "65d28fb6-4232-45cc-8cd6-b7a0b1986be6", "comment": "Malware payload (Heodo)", "value": "08c11028f441484113505000ed4d87489dfd3c5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "1efe5c20-4212-4232-b34e-5a5094bcca0a", "comment": "Malware payload (Heodo)", "value": "6e7ea238ebfe66070f27be9ac3b91161161b738036096ca852ca5e31136511052325b2ee8a410fc6f3f3fde7e15a4759", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "af68ce3f-b5eb-41e0-83a6-d12a59789dc9", "value": "T118B42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "8d5312b1-bd93-4cdd-bb5e-e1d7f857dd97", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "89f5e9c2-fd66-42e0-903f-1c407a01230a", "value": "12288:IOzyEtBX2ZHq79+W6/G5YgvmgZDa6A9TU:lnmZKR+2Yzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574964, "uuid": "2541786a-3451-4100-8e2b-a76bb823f77f", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574964, "uuid": "cfc17ff2-9f60-4b6c-b583-78967574aa28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "91f739ad-172b-4d4a-9c92-452772abe3d2", "value": "emotet_exe_e4_b769ea6ee12f9ba315c0f944ff650f84da113acc489b6aa999a9d10b0a972c5f_2022-02-23__000918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75f9991-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (YoungLotus)", "timestamp": 1645619544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619544, "uuid": "8c83594f-b716-48f7-93f3-88d6ae12ef7d", "comment": "Malware payload (YoungLotus)", "value": "ab253a5ca4841ae90c290d3538a22363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619544, "uuid": "9d4b7fc6-d66a-41fa-8dd5-ab589bdb7f64", "comment": "Malware payload (YoungLotus)", "value": "b80ba2fe68770544da2fd5f9163af4a0a0b2b6b291229ed27573433e099e207d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619544, "uuid": "6d1034c1-1cd8-41a4-ba89-a00bc27c8d3f", "comment": "Malware payload (YoungLotus)", "value": "958890e099eecafe30a0e160b680f3df6abbecd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619544, "uuid": "885501bb-96e8-4159-8223-0d0386e663cf", "comment": "Malware payload (YoungLotus)", "value": "6530f2d3f2ef977ef6348fd3e7ffeed166d46025a1050a4cd130afb2c5f53654ccc759b49ce764fe09f37096bc2800b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619544, "uuid": "38ca781c-0306-4017-8556-4bfefd87c822", "value": "T18E366C0173E285B5E0B3177426796335EA7ABD320729E29F2695CA1E5B305C0DB32B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619544, "uuid": "888f34f4-d957-458b-ae1d-93000beac907", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619544, "uuid": "8f93c811-1065-4382-b988-d78ae4a1e9d0", "value": "49152:NjBzpD700KVwh3TA0PCUuz73aknXKK7vZI7aV8iJdozEL3BasSh87YYMTcBF6nRc:N07wtABUuz73amL8Ad8QB2RMhJsst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619544, "uuid": "b321d416-83a4-41ed-8c8b-10a299c70321", "value": 5055066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619544, "uuid": "ea350563-cf73-4413-b820-e88ff2cf38bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619544, "uuid": "4050bfbe-616a-49cc-a9f0-0edf96cdfd24", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c90aab-94fb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645656632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656632, "uuid": "3e130adb-3aa7-4073-8b1f-d96ceecb1613", "comment": "Malware payload", "value": "526c7e0c5201c7682d8b24de2826289d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656632, "uuid": "e86b73c8-91b6-4974-b30a-cd7811a8db41", "comment": "Malware payload", "value": "b8286a4dcdf1213da30d7ac85d29182bfccc4ea884357f43ab64d32881d8acdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656632, "uuid": "dd58c624-62bb-4c62-91c6-f2ab0af65427", "comment": "Malware payload", "value": "17a966a32b49da4890542b4ab9b1c2dab2f36b79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656632, "uuid": "c51dc4cc-029c-4d75-98db-bce31bdd0e59", "comment": "Malware payload", "value": "34267ff3c71e37b5ea05c9c861b279785867bffe62c54c3d90ba6c5fbd6a92c57042f958324c8bfe4b3361d5826deef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656632, "uuid": "fc11afb6-5a8e-496a-8617-5c47b0c0e4a4", "value": "T1E5661239B34EE298E05624B33345ACFB04983B34106F44AFFF95771A29B4AC4C569B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656632, "uuid": "a5bc8f09-14b8-4cd7-bde1-3bec517ddd00", "value": "68cef2fa777e1f979f55b23d1429289c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656632, "uuid": "9b455c7b-defa-4340-9eb0-564ddfce0fed", "value": "196608:iHkLzImEcFCxCSxIdXXoEHi0lDCRJ40ZrjM:yqEcFCLxIdoEHlluRJZrjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645656632, "uuid": "eb01149c-db1e-40d9-ba51-201791527b71", "value": 6757888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645656632, "uuid": "db0e8797-b5c7-42f2-82d2-ca40253cab9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656632, "uuid": "581ed89d-e07e-4788-856e-3ec7bc466dba", "value": "SecuriteInfo.com.Variant.Cerbu.126790.32435.12326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8615a94-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645619224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619224, "uuid": "3dc9b0c7-26f8-403e-91de-41ded8524595", "comment": "Malware payload (Heodo)", "value": "ce671b3a3ca02d17e92a0aa2918738fe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619224, "uuid": "35ac9e6d-4731-4135-8e89-0276ed0c542a", "comment": "Malware payload (Heodo)", "value": "b82db110a54b05a1287a49ca51c031bbab02de59e956394b00c8307f82c8e682", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619224, "uuid": "09e85879-417f-4b14-831e-cc44a341441a", "comment": "Malware payload (Heodo)", "value": "d8f0fe3253eeda6879cbaaebd84edc697882947f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619224, "uuid": "207c98a3-2e11-4b57-9c67-1cc273d1d531", "comment": "Malware payload (Heodo)", "value": "d937c049857104e81efe21acb0b748f4c11703a1d2f291c686297c370a3707c9f42f45553cf2c9ebc400c21d6f9f842f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619224, "uuid": "3bf15de8-5f72-4ab2-96e0-c33f971cbb0a", "value": "T16024AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619224, "uuid": "53f30a6e-a109-4018-9408-b1463552a671", "value": "6144:2MyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:tyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619224, "uuid": "7aad5555-e74c-4e8b-9b25-c0f5266706ff", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619224, "uuid": "2bc9b38d-8dbe-4d63-b1c3-787cfc3c1c18", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619224, "uuid": "b6a90b17-04b5-41d5-95ad-bb79aea0eecb", "value": "2022-23-02_1125.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd3e345-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "75387f6d-7ea7-48ff-afc9-3f9e4a317ae4", "comment": "Malware payload (Heodo)", "value": "f281750cc1cadbd0ec2c5ad5f72b2338", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "ffadf38b-591b-4f08-8f7a-e36e775cd260", "comment": "Malware payload (Heodo)", "value": "b906b39e9ddd7c6f61692d7b97a23dbea2e1ae528bee188711fff3b0b77c9810", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "94335f81-292f-457c-a20e-007838f4afdf", "comment": "Malware payload (Heodo)", "value": "8ab7e0a4af19119fa1d014411bcaed2e8ae64e67", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574964, "uuid": "a2e9a701-9071-4f4f-8019-3477cff75d78", "comment": "Malware payload (Heodo)", "value": "93a0c8981e9145362f63255a3293aa1a76e1fff5d48f9df153a077103e40e171658098adc10bb7899130bf2bde924610", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "fc97e94c-e202-4176-9e87-4158ff85c682", "value": "T1ABB42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "8d6b9bf4-2098-4ae7-97f0-1bbda43ce7a1", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "5b40bbd8-8308-48a2-ba14-902b6de77c65", "value": "12288:IOzyEtBX2ZHq79+n6/G5YgvmgZDa6A9TU:lnmZKR+BYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574964, "uuid": "a7245664-bfe2-4c8d-8af2-364a8a3edde3", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574964, "uuid": "0d67a7e5-786b-4028-8eb4-270df69c2077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574964, "uuid": "55edcacb-7663-45cd-ae02-2b24a21c2fb3", "value": "emotet_exe_e4_b906b39e9ddd7c6f61692d7b97a23dbea2e1ae528bee188711fff3b0b77c9810_2022-02-23__000920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df713a4-9490-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645610750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610750, "uuid": "4e2adfd5-ae75-452c-9f71-f06998b96122", "comment": "Malware payload", "value": "86130355a87805f658b124a4c532c791", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610750, "uuid": "85a04c67-07ce-47e8-b5ba-33bb028a2219", "comment": "Malware payload", "value": "b92a674e4ce693aa211d3fe01fa900cbac02940e8f739e99c44d0b0277079d3a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610750, "uuid": "579b5861-eb47-47b8-a35b-46f78be2af39", "comment": "Malware payload", "value": "e0130c027dcaefe99451ea0665c50f4d16483c04", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610750, "uuid": "44906b15-e2c3-4c4a-9215-968711f2f844", "comment": "Malware payload", "value": "c6bbec923019e5f6b101cfa803dd5101a35958d0f2304bc970215f30c1d0808d76e914b79bf2aa8c39cb623e5febdc02", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610750, "uuid": "fb5e215e-7f18-4358-888a-173aec1fb6d0", "value": "T1F543B0E066905CD1ED8B86935165FD5C13B2F177EDC61A88314CFBF52FB73426A08884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610750, "uuid": "2346d791-3bcd-4d39-9d3a-fd7c325be27b", "value": "1536:oLnmlpOnltX08jcQcWxdPgBNi/O0H9PaFkG/uUpv:oKlEnPja2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610750, "uuid": "4c3eaffa-39f8-4f18-a379-a07ef71e7080", "value": 58834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610750, "uuid": "fcd9219c-99d1-4e03-9580-1241d4e9f52f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610750, "uuid": "01920951-8565-4ef8-aec5-3a4eb0f052a0", "value": "AL HUSSEIN PROPOSAL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6b2a1f-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645630107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630107, "uuid": "0e083f30-730f-4506-849f-eef209a30581", "comment": "Malware payload (Formbook)", "value": "33a5073a73979db67359b321b931b480", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630107, "uuid": "98479e07-697c-4f25-a045-62241253e1a5", "comment": "Malware payload (Formbook)", "value": "b97dce71d3f1cb7de9810118c17121ec90307219be82f5f298997eaf888b62de", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630107, "uuid": "d240f84c-0a08-4054-b3d5-3fea84bdbb1c", "comment": "Malware payload (Formbook)", "value": "61debdde4c642974d32c64de5ee00cfa79a3d7f5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630107, "uuid": "6edb1d66-9648-4166-b66c-86d45b97cc24", "comment": "Malware payload (Formbook)", "value": "8863f344685e2e01b754d5206d9e35c8e7a668b3ccbcf6c48150be83234079c926714d0db411cf1f0672558e0137a2ee", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630107, "uuid": "1adfbd13-4267-48bf-9ee8-756e9bd020d9", "value": "T15A0444E310C462FAFC0E7172C50D67A822E659995C6EA749A7CBEF065D3F084884F5F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630107, "uuid": "fbdfb2ad-12b8-4069-a087-4d432e986006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630107, "uuid": "3804222e-9f3a-43aa-9d05-2996bff64f4d", "value": "1536:mBb+mE3bFXNMcT2hKsWzAz63W0+Sd+LP3E2d0B:mV/KbZNMcT24sZ6m04TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630107, "uuid": "06957d23-d17b-4ebf-9d62-c57530d216e7", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630107, "uuid": "882c201e-1d52-4d25-a42e-db1039f191a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630107, "uuid": "96a7ab50-1a4b-4211-8d5e-dd0960f74d0d", "value": "DHL-FORM_000912775399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3209cc8-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645611081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611081, "uuid": "7d232536-015b-48c4-abbf-54a5f57765da", "comment": "Malware payload (AveMariaRAT)", "value": "55f02e537091252f0665a311828f54f5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611081, "uuid": "931a2654-8adc-4685-baae-45f4e51663d1", "comment": "Malware payload (AveMariaRAT)", "value": "bbe3b00d48afec8fc7e35151feac211efece70e2381d3507557896b1e1afeca4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611081, "uuid": "6400849f-5896-4a3a-84b4-2a555732965e", "comment": "Malware payload (AveMariaRAT)", "value": "167317b38ef7da5170f40fac4156339965dce866", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611081, "uuid": "64244234-46c9-4192-8561-fd3fed7fa015", "comment": "Malware payload (AveMariaRAT)", "value": "06c0bc8f60a8eac1ad341977de07bfbded9ad3af59b70a8bcd77f13f94c36ee2829ac030b7fc6ae8487f13c4e3cea509", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611081, "uuid": "8d252058-d986-40c4-90e4-203bb897779f", "value": "T1A41402DB2B586E53D92D0A31D04EBC1E0AF9CFE47582F4A1AF69740D18B7AE9C54231C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611081, "uuid": "c051137b-121b-4561-b313-8833cb07e74d", "value": "3072:cOe1zPPzolcScXnxRe8wYBHc0Y8OasDg4IaxH8ejJInlcu/4SrN2b:1e1LCczXnxNwYBRlsU4IadXenSuVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611081, "uuid": "91a587b3-b520-4020-8ef7-84bc8ee783bb", "value": 190776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611081, "uuid": "1efd2e71-c644-4889-a85a-afe472a0f5f0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611081, "uuid": "6ef617bd-bc86-4425-b945-6675b43dc314", "value": "factura (2).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2330e718-949c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645615886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615886, "uuid": "2aae49be-2698-4fb7-a7cf-352737cc1ba9", "comment": "Malware payload (Formbook)", "value": "3115ab616f91b28ee2080122b9bacd25", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615886, "uuid": "a7180854-e87e-47e5-8521-95b2f2e4a89a", "comment": "Malware payload (Formbook)", "value": "bc9725662ab3e9f4373e3b7ecfb414440abeaaf9ae1feaa32a2e8cc4f30bb22d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615886, "uuid": "de8b98f5-1248-459a-ac10-43c85a620cdf", "comment": "Malware payload (Formbook)", "value": "82318fc884ee43033d434429b5fdd4e256837e67", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615886, "uuid": "357ceb91-b890-4812-a63a-e2c2d0fa7591", "comment": "Malware payload (Formbook)", "value": "2ab755eee516606d8b825c96dc9870297e58126a8fcd408ecdcc9dec2a717d8ccbc203b74a6b8fcf03d838b58567c89a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615886, "uuid": "32d367c9-0d1d-456b-ac5a-bc8b77c6cdfa", "value": "T15D140274660A435CD9EE57B82834EB6A7D1FFC151D847C64ACDE37BF0436A186A020BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615886, "uuid": "0383cfac-546e-4766-a29e-b3ffe509b75b", "value": "3072:cFT4piQewO60/ixfdmrTUw+KGV6drmfuandkxmVBp6VD1Ac5WoU:D+wO6ffgrTt+Ki6drWuanqxmVyLAUWoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615886, "uuid": "1390aee1-5795-4d38-98d0-bf78334883dc", "value": 191144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615886, "uuid": "d638f7d4-d5ba-4e98-ace3-26d0d9eec3d2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615886, "uuid": "e838fa50-f110-4f71-89ac-63094309507e", "value": "payment-deatails.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d776db-94bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645630903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630903, "uuid": "bb118e3c-4b65-4e48-ac3a-128b8dab82e8", "comment": "Malware payload", "value": "7b8f29418728888a5b09c5a3d62e5ca6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630903, "uuid": "c7be9d8b-b4df-4d5d-a3b0-38456354b485", "comment": "Malware payload", "value": "bca98ddae3bc80f5d20b9129782c117d3c8bce5ac3ae3f766ffcbc9be450cfb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630903, "uuid": "bc6f1078-3e37-44f1-8c11-f08e5bc32cc1", "comment": "Malware payload", "value": "e2dc7b8b56a9d15eb67d1e8cb3c459ad0a81519a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630903, "uuid": "855d68c9-5ebc-4439-be48-98f24de9e149", "comment": "Malware payload", "value": "5c5a645bb9702465ae4ce4d7111a772b98597d5d45acf6ded72d8196345e9bceb3da46c931f352cfe4ad3c8e58a42dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630903, "uuid": "b345ff79-3814-4b36-97e5-8996806a5eca", "value": "T1ECA4F10457B84B66E97E63F89938403517B63D9E2170DF4E9EF2A1DF2932B804422F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630903, "uuid": "faa2f4f7-014c-4832-8ad0-c67cb4e5cb3a", "value": "6144:wtiTZHacQ9Q70zpiGjokhdFrNGznlVj3xX8WzHjSXAEvxEsRYeOxRvn7tTkX35ln:wMZ6QkLjTOlN3h86jSjpEmY9RTkX3nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630903, "uuid": "98526f3b-7697-402d-b416-6eaccb390eb2", "value": 487646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630903, "uuid": "28ced0fd-5548-4364-8869-03158c4d3cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630903, "uuid": "0c83373a-3300-4918-94d9-59b91882576c", "value": "7b8f29418728888a5b09c5a3d62e5ca6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9adfbf-94a2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645618670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618670, "uuid": "73ce770d-ef2b-4342-b661-796b857839dd", "comment": "Malware payload (AgentTesla)", "value": "f05fc236ea3d6cfe00727fe8be079967", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618670, "uuid": "fa81b877-c337-4c65-8e6e-f55c5ea48260", "comment": "Malware payload (AgentTesla)", "value": "bcf6a83f81c40a13505d470eeed10b3d9a7870f82ee49b73ed768192c53aec98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618670, "uuid": "d0e76047-e4b7-4944-9181-d9995f5584fa", "comment": "Malware payload (AgentTesla)", "value": "42354160af467a5e97c251d95e083b95602dbc1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618670, "uuid": "8886d6e4-b22f-4f41-9952-aa69d4fa3a26", "comment": "Malware payload (AgentTesla)", "value": "5c95e2c903a8101933e9ac3a3c7349487ebe114f1ec98bc952b08dfb9f6774e7cd98a4e2dd2ae23a6cd9a14d2bf52d57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618670, "uuid": "ac101f03-9ee9-4f78-bafe-0e7e63521e41", "value": "T18603E61A7892964DC5D47BF86DB0A29366367CE10124C18FECF97F29E972223DCC126D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618670, "uuid": "b4b92b7f-050c-4170-9e35-2d3b4e1cb941", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618670, "uuid": "4c35e5cf-de72-4510-8762-2663957656fe", "value": "384:nYGpm3i0GYZ4AWCJwwzj7blw2ZXb3QEulai+MwCKPEH2S3dd0hUADkaq1:YG+iFYZ4AWk7bqq8lsMwCK63deVDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618670, "uuid": "be7c0fb2-eecc-42d1-9f0f-d9a32074b75d", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618670, "uuid": "f5a10af1-2c49-41bb-88bb-31f945a75996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618670, "uuid": "df801a90-3861-49e8-b5a0-3395016aeb62", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865658ca-9477-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645600161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600161, "uuid": "47538495-1969-4a85-81b7-21d5b84b3d2d", "comment": "Malware payload (Mirai)", "value": "b995beda34953519c586513d9399983b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600161, "uuid": "a81379b1-fbe3-4463-8533-70ba1dc641af", "comment": "Malware payload (Mirai)", "value": "bd0de843c0a0d574be10dec87283e5b9f41ddfb20a85c87ef317916499976dda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600161, "uuid": "f768dd3c-66ba-408e-8462-5a70dcc150ad", "comment": "Malware payload (Mirai)", "value": "2da06a43be00b1e9a12f7115fe7a98cc4c7d6e18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600161, "uuid": "96082392-8217-4337-82d6-b31a69767282", "comment": "Malware payload (Mirai)", "value": "efc26a984ab8ac5521ecfdfceede724c316766ed1873fadf66ab7123e36e1a32578866898cd04b8996d1431b3de20c14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600161, "uuid": "6dac7c5d-ca7d-42be-b107-e1f2f1dcf9ad", "value": "T1D2C2C09E9CA43ECEC6CE6D7CC2F563A15D8AE0C530071B4DAB344DA57A42C27B48E46D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600161, "uuid": "f05158d5-0bc0-42d4-aba5-47e722da853c", "value": "384:LqjQb+w72R3cjMaRzI0o/DGrsC2enQ24RTUfGyfxgG5lqKc6BA8AB4pRIpuEPPle:GMfCuj1RtaD4NVAlh5N6ltIplPTWMa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600161, "uuid": "ded4b4ad-166d-4bea-8f49-ff238ba4fca9", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600161, "uuid": "b7dae2a6-5c3c-4e57-b04a-d674b18e149f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600161, "uuid": "41b4310e-d948-4178-8761-fd241b126b72", "value": "b995beda34953519c586513d9399983b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c18966-94f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645655557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "98aa213f-bf9e-4c8f-935d-938fa29e7eac", "comment": "Malware payload (Heodo)", "value": "ebbda590af9021227583daad353e45fb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "8e845aaf-864f-4e3a-81dd-27e7eaaf6a3d", "comment": "Malware payload (Heodo)", "value": "bd57d24afb51fc0791dedfc035755d526788ad9c5f03147ee04ef6ec55f3c698", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "84366f6a-04b9-4e04-a410-e14e29bbf4f8", "comment": "Malware payload (Heodo)", "value": "76ab55527d220386487397b516aeaa5b915c318c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "48e16937-97cb-44a9-8463-59e34008de0a", "comment": "Malware payload (Heodo)", "value": "425ca9b235a3649df40cb20e3db2b11ae8f55b4c9db358795e508ac3eb7f70cb43e82cf7acea592d572f7380144c324b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "f04ffeab-259f-44ed-ab17-3daf3248e26f", "value": "T176E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "66c03955-c3ab-41e7-83cd-e9df2ce1eb33", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "8a43fcd0-c94c-456b-9cb9-1f72c3fcd382", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKze/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKzLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645655557, "uuid": "76d44336-9fa1-414d-b461-b950b4276952", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645655557, "uuid": "e7bff461-9b3f-49d7-bd3f-e6e2f9b48c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "27fd7a70-9003-4d93-b4a9-6bbf231368b3", "value": "emotet_exe_e4_bd57d24afb51fc0791dedfc035755d526788ad9c5f03147ee04ef6ec55f3c698_2022-02-23__223231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75ededb-94b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645626094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626094, "uuid": "f12026f5-106b-4b17-8d60-b826dfcb8276", "comment": "Malware payload (Loki)", "value": "df1edd7109db62fade68699009718692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626094, "uuid": "67136afb-0909-462a-95a8-bd11137c6a22", "comment": "Malware payload (Loki)", "value": "bdb1b580d5c5de031987c03e9004d912182d5c448fc4e8706454eb57b5a25ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626094, "uuid": "1dbc0b18-9f5c-4fd2-b8d5-2cb72ec882b1", "comment": "Malware payload (Loki)", "value": "6bcf53111c52f803a2ef6a34a1ed051a9862c800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626094, "uuid": "0f278746-62da-492c-b229-930e124e372e", "comment": "Malware payload (Loki)", "value": "83d2c72b96dca1a1b7afcf53f13d9b4656a0ff3ebe1588285d86aa6b0405c587cca2cb452f5bf7d77d41703531037138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626094, "uuid": "d1a9dcc1-9892-4f91-9768-3eb5e0e46570", "value": "T1CCF4BF4839679F3DF1718BB24DC5EC74BB9CFA331C08B37D7855268AC691B9088426B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626094, "uuid": "1ff0f802-2e11-4956-8b0e-fbb6bb0c7004", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626094, "uuid": "99c96e40-4f05-468e-926a-09de263ec3b0", "value": "12288:ifGA2pTNhRLK7777777777778Fxnojg0l376xPF6JmLquIzGyN9ElnwJbF3DXVS5:B5K777777777777WohxgAJmeYOBFXVSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626094, "uuid": "0c10bbd1-fcfd-4a04-9996-1850340c1d36", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626094, "uuid": "3b8241e8-32dd-4351-b3e9-dc5c16aec23e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626094, "uuid": "0dca9c19-54d1-4649-b87c-1c7aa0958c92", "value": "PO DL036821 LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3af4819-9486-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645606680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606680, "uuid": "74447f6e-243a-4845-a4c0-eed16ee6a887", "comment": "Malware payload (Heodo)", "value": "a671b5864240fc6215730c67ef576480", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606680, "uuid": "c4f400de-c2cd-494f-ac2c-7de55e7a0d58", "comment": "Malware payload (Heodo)", "value": "bed1a3c78e7f2b52eb6f657e2004e699c26bd8460e44e21aee5884d691a62d71", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606680, "uuid": "dae645e3-db4a-4311-9f27-0bbfbf35331b", "comment": "Malware payload (Heodo)", "value": "765cc4705b05c464501aa04cf237bd7ddcefd55c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606680, "uuid": "574dc07c-6e4c-4eae-8c58-f59b316d8d36", "comment": "Malware payload (Heodo)", "value": "613a8fa218df7b9bcd5a65fa8b3a1f1e2ca572a0a1e1032a8df67b4a87a0be0f620c3f500b1778e2b35949ac33f9d4e2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606680, "uuid": "bbab3665-ed64-402f-b6ca-3e2eca59db73", "value": "T136930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606680, "uuid": "9691ca5b-3724-426d-839c-1e83022c042b", "value": "1536:0yehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQ2zkWvgrPE4nWHPNc2AJ:0yehv7q2Pjx45uoDGTj+5xtekEvi8/d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645606680, "uuid": "4eec24a3-7eef-4aab-99a5-b88ec84ea0e3", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645606680, "uuid": "c1d98c3b-4d55-4cb6-8624-3128c32286ce", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606680, "uuid": "5a79bde9-cd09-4e49-9eda-ad486f3f327e", "value": "20220223_729296_005.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7c07a1-94a2-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645618774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618774, "uuid": "448c6195-53fa-4824-a708-7d802a0c7f76", "comment": "Malware payload (Formbook)", "value": "4b05214899e28e53a2bdd57a707fbdc3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618774, "uuid": "6eaf6824-da6a-422b-b0ba-59b227c159f6", "comment": "Malware payload (Formbook)", "value": "bf92972f43111d9cd6f254bff76bde01b69550877fd86567d2838ae99b062e57", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618774, "uuid": "f5a4bc2e-70f0-4722-a5a2-0e89f4a0c305", "comment": "Malware payload (Formbook)", "value": "6e3c8f9e5f614c66586a11751df5a811aeb314f9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618774, "uuid": "38e1c0b3-f2ff-4c8b-bf3b-fa9d2586d780", "comment": "Malware payload (Formbook)", "value": "feb67013043659c99e131477ec445a94a1bb7490c55c7f4750db0b2c14e4c736bfe10e0863e7c34c25bc059fbcd2579d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618774, "uuid": "d8e8e483-3845-47db-b88e-f208dd26193d", "value": "T1E34423666EEFC74093BD79D1839B40338F51412434CC71AC9278A1A415CDACBAEFB66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618774, "uuid": "0e8eb213-1aa6-450a-af68-39b128f70cc3", "value": "6144:ueBjSf31z121TJySUnpDCZr0d9qhaWDU+CRW+fQ:ueBjS9zK1ySbZrZhaeU+CR/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618774, "uuid": "eae8eede-6116-4d1a-bd3d-b5ecc73de7be", "value": 274548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618774, "uuid": "77a054a1-28d6-4cc6-a776-f447da1a4527", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618774, "uuid": "51caebcb-5029-4af5-a579-463a08bc7421", "value": "PO_#YBIC3892900183902328_Evaluated Copy.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af6051e-94b6-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645627039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627039, "uuid": "2ad1452a-f24e-416d-b544-a5d045ae1c8b", "comment": "Malware payload (Loki)", "value": "782a87515f5f863c004a16f6b6061b6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627039, "uuid": "098bca0d-43a3-4346-8fe8-c065ce678f72", "comment": "Malware payload (Loki)", "value": "bfb5fcd74f15111039951826831a93ad11442f27c637a27f7171a6ec9c131f84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627039, "uuid": "88a6a2f5-14a5-4183-ba18-580d2d168d9c", "comment": "Malware payload (Loki)", "value": "92c508a445006f06cb5844f9180b407cefbeb650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627039, "uuid": "c4958e3a-f1cc-4e77-8ee6-42d1cbad2c02", "comment": "Malware payload (Loki)", "value": "f14483db89028a5ec37f005b5bf512133ccb74b9b2ebee1478b3e87e046e1974d43401aa8223db1308cd8a24ef3d4d30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627039, "uuid": "16a633b1-6256-43fc-9062-bc98abc6960e", "value": "T19C8412110B71D49BF4A00A712C35E73A2B79689562798F8B0B503E4DEDA3FD1DD1EE09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627039, "uuid": "f16ef212-1fa5-4f20-b380-e6b075073f9b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627039, "uuid": "60d0bd2e-3c95-4f65-a608-e19b07c7aae5", "value": "12288:sb09tQ6S2H0mzcm0tFrTwUZMYCwXgpted:sb09tQDmzMKaMYCwQpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645627039, "uuid": "04c6d51a-d14f-49b1-9c17-199c1d353c0b", "value": 394648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645627039, "uuid": "e93a209b-e92c-47db-9ab4-9bcae2676af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627039, "uuid": "6d3fbdab-bc49-4148-9b41-e7be4d637648", "value": "CD 258 STENT-ENDOPROTESIS AF.ANTINORI SILVANA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a63ebba-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645622905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622905, "uuid": "1a4af0af-271c-4eb0-b470-2f1f930621b0", "comment": "Malware payload (Heodo)", "value": "30c314fb2acb190d14a46b28ae66f791", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622905, "uuid": "db187ddf-9e96-478a-867d-cfd620c3a1d0", "comment": "Malware payload (Heodo)", "value": "bff364dd9d87e6062e6e568da66b4eb86a1acc8ab3a595281f8a00fb81c14213", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622905, "uuid": "a74b2590-1be7-4125-b859-2c629176f63a", "comment": "Malware payload (Heodo)", "value": "0f4ea5b39e0a17d0ad0da0333a923f1e97c86c71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622905, "uuid": "3039f1fd-5e56-442f-8456-203709f84186", "comment": "Malware payload (Heodo)", "value": "4f96ef062658e40020847940397fad53ed07ac938181b1e55ede804bd2c34d67216246f259b7246579a8df5ac0021e38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622905, "uuid": "ba9d172e-412f-4387-bf82-5d1ade0150f7", "value": "T15935BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622905, "uuid": "6efd85e8-2e59-48f8-8ffe-a1cdbc07f536", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622905, "uuid": "4bfe1c1b-3040-462f-aa8b-53c0f9ac57de", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/+TewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/+TeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622905, "uuid": "d6ce7bd6-1881-41de-8806-aaf453ae0ed4", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622905, "uuid": "e8e6fc9c-b18b-4cee-a15a-e93b0813e05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622905, "uuid": "42e9d0e1-a49e-4f8f-a043-da6b25553b11", "value": "30c314fb2acb190d14a46b28ae66f791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec69f48f-949b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645615794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615794, "uuid": "5cc20894-3dbd-4961-8d61-4958d9e7e85f", "comment": "Malware payload (Loki)", "value": "c804b59a56aaf25f820fa93c7ab9c9fd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615794, "uuid": "9bd4a82e-28e9-4324-b186-5847d53b28a3", "comment": "Malware payload (Loki)", "value": "c066f1dad187305181ff6466162d9db5a6b5143646102061807fcdd3fa6398aa", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615794, "uuid": "6d0b3ed7-f31d-4b34-aaa6-0df59988ab38", "comment": "Malware payload (Loki)", "value": "82599ad7aefef9ea7346279a7c864349b314e462", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615794, "uuid": "393eabc2-3e2b-4fec-b97b-1f4a50473ac0", "comment": "Malware payload (Loki)", "value": "9dd456bdbf07ea17c3086ebb1344e87a7345b6646d9471e434d8f3d1215feb5fa4daf0efc812343f3f5bbe56a5f322a4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615794, "uuid": "74d81d6d-8161-4172-8b4c-bfbc4981476e", "value": "T1301412FEFD5B6873FDAAB73F1647CC7208A6DCAD2FACD810210279589131449983197A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615794, "uuid": "ce6539bc-f2ba-4af9-aaac-6390c963652e", "value": "3072:7XIqjYhB/mIkEqUIiq3BWkMA2/DpDsGUY3BFeX4+Kv0afS2dAHFev2fkr1D27vw:cqjYTm3XBWrXD5sGVBIX4HlddAYlr1yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615794, "uuid": "68c79862-d716-42af-8022-bdd79233ce1b", "value": 190456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615794, "uuid": "d3b80363-6257-42d2-940b-cd03d72e4c00", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615794, "uuid": "157caa43-035e-447b-96f0-d60f7aebd54a", "value": "payment slip.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20f6b17-94be-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1645630836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630836, "uuid": "39f98996-6bbf-4fcd-b688-efba0a45bbd1", "comment": "Malware payload (BazaLoader)", "value": "6907225e009dd358c87c4c17461f7a61", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630836, "uuid": "09082560-5b75-4a91-8357-604873cd8231", "comment": "Malware payload (BazaLoader)", "value": "c067193ec6e5bb54453c871bcd337a062297797584e24e97c13edc2867e27ae1", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630836, "uuid": "28dffff2-57b0-4e14-9326-bb6f9e5f0f25", "comment": "Malware payload (BazaLoader)", "value": "3482dfcfe92eeff6ea1f961dfd516883dfe79b91", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630836, "uuid": "749d8894-e828-4a85-a20f-da96b11ca81a", "comment": "Malware payload (BazaLoader)", "value": "59b299e4949a08c0a1432bc2662bf72c1cad5876e20bcd0560d02b3ce08fd31a93ff4a910eeec0f8c4acbe806b32faaa", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630836, "uuid": "e5991ea9-f6a0-4d9c-9cc7-1150c0c21cfc", "value": "T103F4D06A66A837B4F0135474CD674A03CAB17C7127B191EB9793324B8D3ABE4173BB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630836, "uuid": "7a156a63-cdfa-4376-8a2d-10c279ace8d3", "value": "64e5d7cce23479085f2b5c15b028487f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630836, "uuid": "ecc56a85-c848-4977-804c-724bdf5f9d2c", "value": "12288:jb2Z46I1dVNykv7csRVVPRWYco1fQTBYPjffcvAFF5tyS7HI:jb2o1dXykDrRbPRWPQfRPL0vAFN7HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630836, "uuid": "a9aad65d-63f3-498f-b4f4-9892dce3eb58", "value": 728814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630836, "uuid": "7de6ba11-8a2a-4fc7-91c6-2c56e22effa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630836, "uuid": "1e255e45-5b94-451b-a2f2-04087da2db6f", "value": "6907225e009dd358c87c4c17461f7a61.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63721ed1-94b1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645625014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625014, "uuid": "312da995-4d84-40b3-9908-118817e35689", "comment": "Malware payload (Formbook)", "value": "9db4d61aae959a5b9d2a4c3970a20e4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625014, "uuid": "f9bc2fe7-9ab7-4a13-b192-31d5f80ae2a1", "comment": "Malware payload (Formbook)", "value": "c0b711533265ba0808d1f7a5fc9b0dd17e19187c9566d9908763d27aaddf023c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625014, "uuid": "6e229776-ac4a-4171-ac3c-a30047b1817c", "comment": "Malware payload (Formbook)", "value": "9ea012a3ee703fdb52ea68e78f9a1eadd2bc57fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625014, "uuid": "1733916b-a6ae-45e1-b06b-4fd847f63e99", "comment": "Malware payload (Formbook)", "value": "6dd3b6984b982ae514eff26b00a140e0c85e8134d72c409fe33b14665e1431f7099215aa806f14a1f1c82a7fdc773216", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625014, "uuid": "a0210623-9983-4656-92b6-3bdf19777114", "value": "T15805CF043DAB5F3DE5718B720DC5ECB4BAA8FB231C08B37D78956686C691B904D422B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625014, "uuid": "ac8b9e87-6c36-4a5f-91e0-503ad22068ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625014, "uuid": "930a97c2-8973-4ef7-ad7f-0d0fac1403bc", "value": "24576:/1NK777777777777HyzsAmG3/B3oPyA5bTdZN0B9:a777777777777nAT/1oT5TzN0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625014, "uuid": "00c639fc-6393-4625-96fb-478b42121bed", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625014, "uuid": "8a74ede7-24fa-4e39-9d2c-31b69e57a1b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625014, "uuid": "50aadbc9-8ef7-4138-9855-64e390bd845b", "value": "9db4d61aae959a5b9d2a4c3970a20e4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313022d0-94ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645623211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623211, "uuid": "ed7b239e-09dc-40e8-8c51-d25011aa2165", "comment": "Malware payload (Formbook)", "value": "bb972e1d823538270ae1798d72ebd874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623211, "uuid": "a34ffe24-b6a3-4197-a1d4-0cdc6e34647c", "comment": "Malware payload (Formbook)", "value": "c0c24c7e5cf9aa6875d8ccfe72ab55cb74d5031e73f2b4aa1d97c333d15d608e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623211, "uuid": "ae290d6e-4fee-4bb0-bc14-cd9ffe88f166", "comment": "Malware payload (Formbook)", "value": "81b21a521ac03a9baea6ae608bc66caae2c0fdc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623211, "uuid": "66995229-9693-4d5f-832b-548f9737e346", "comment": "Malware payload (Formbook)", "value": "53fb3cea9d1e351c5bf89a061db56e6d2fadecd315a6ff4653a17e8c02945fe192dd910a38f9cc8907a8915967d1a034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623211, "uuid": "49972ac0-ea73-49e6-93e9-646c8bb72d76", "value": "T138847CE1A740C479D89796B9843BDAA7B433A20D9D68090D3ED2FF0B7D72347402799B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623211, "uuid": "f5dc76db-dfb1-4db2-895f-d9f38fb483f4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623211, "uuid": "6923d5f1-e60d-422b-bfd5-2243841db241", "value": "6144:ExDwuDA1+KsITpR5ZDhTjIQgi711nqc28SkzQ41e+GooHoyamKh:FgA0KTTn5ZlcQlnSAQrLoynKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623211, "uuid": "f1ff6adb-64aa-41ba-a9c1-b5d6f7895148", "value": 392838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623211, "uuid": "8b9fe144-c900-4ec3-9c0b-619dd5a8f370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623211, "uuid": "b076aa63-cefc-418f-83b9-3b6c1cd4be1b", "value": "Order- Reconfirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9508c2c8-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619084, "uuid": "1fdf994e-4ed6-4400-95af-86eaad82cc72", "comment": "Malware payload", "value": "db274bf07f020fd6f21ee96d3c423303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619084, "uuid": "9f1b10e8-9b4f-4b04-a310-dd00995812f3", "comment": "Malware payload", "value": "c0c99503cd7560d2ddc3d77662e298d4cc123b358e84d5972ef6b8eba02d0520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619084, "uuid": "f5f0e58a-c813-4ccc-af01-4b02f06b14b1", "comment": "Malware payload", "value": "3e04d20a32ef99355b75f8238d5368eecb763c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619084, "uuid": "b9887b65-894b-4eb0-998d-729fdfe9e079", "comment": "Malware payload", "value": "4c984c13eb3c0e1c00b520fd737987d7cce7776c5cc94256b7082c51c219697f418ea706f7c2ea07e26d62bd46054274", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619084, "uuid": "115da616-fbf1-4ec5-8712-5ecad0f6f306", "value": "T189E4E110BB90C039F1B716F549B5D3BCE52E7AB1AB2462CB62E46ADE16346E0DC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619084, "uuid": "48a17474-843a-4300-b44c-7342c6ae1549", "value": "791d76659e45e8da008e73b27d00ce69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619084, "uuid": "d170e544-a0c9-4f86-bc60-b6fe6755d7d8", "value": "12288:HRMmYgVFa/USVEN7e4Pb5TXCERhsvVNTIC63+pi/XsQ5CX9v0hOB+Fch+:Zd8/USmXl/hsvVNTy32ietouh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619084, "uuid": "4ca11124-81d0-45f1-ab46-505b9ae735f9", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619084, "uuid": "cc94f39a-bc19-4f1f-8f8c-2ef0ae61e1e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619084, "uuid": "979048bb-c7a0-4b5e-9043-d5f0798a0388", "value": "db274bf07f020fd6f21ee96d3c423303.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5036dd3-9479-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645601099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601099, "uuid": "d883f56e-3a38-4e9b-83a2-b6097df090aa", "comment": "Malware payload (Heodo)", "value": "f81ef2afcc8f45aca53ec48e8100f174", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601099, "uuid": "b03e7502-f13c-4229-be8d-91b585d1cba0", "comment": "Malware payload (Heodo)", "value": "c0fdd3d8aa840a0374ee1d8c6e377419bfd0599ccddf68f1963944e01644cd8a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601099, "uuid": "abf070bd-0566-414c-849c-0845e1f561f7", "comment": "Malware payload (Heodo)", "value": "e499fe5bc015c80cd614cbd2211df727f9041679", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601099, "uuid": "b37eb47e-3edf-4e09-9adc-b0adfb21fcc6", "comment": "Malware payload (Heodo)", "value": "72dddf19e99b303b9e1161f18febd2b43636b97b48a2b619b3d3ebf8015bde4ad4b23a54451b750db3615f2309cb0de6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601099, "uuid": "98a4b55c-d1f9-4167-8f2e-3cdd880b54d8", "value": "T16535BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601099, "uuid": "4c87e413-d3c9-4b47-bb17-5aa70cb853c8", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601099, "uuid": "59f3557c-1aaf-4638-b7d6-a11aaaf02f0a", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/TTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/TTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601099, "uuid": "8d617aae-5c17-42eb-8c59-32d4faa00130", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601099, "uuid": "58d580b4-e5f3-4b98-8920-b6008bc9ef92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601099, "uuid": "b743f45e-68aa-468e-9130-0cd74c58f0d7", "value": "emotet_exe_e5_c0fdd3d8aa840a0374ee1d8c6e377419bfd0599ccddf68f1963944e01644cd8a_2022-02-23__072454.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81338736-94f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645655558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655558, "uuid": "af4dda90-90cf-4fc2-ba21-68b83e5168af", "comment": "Malware payload (Heodo)", "value": "ed15c342ccceb06a202c563b634d6b39", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655558, "uuid": "10db8e95-95b2-4915-bef0-19eeff9a6404", "comment": "Malware payload (Heodo)", "value": "c100e1cb1eeb64b1937f5445c186433a2338e635216b46ce42810c38dfd65951", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655558, "uuid": "1a416838-5688-49fd-99c9-59297aff6c33", "comment": "Malware payload (Heodo)", "value": "b1b26b9b5d2ad4227d41a71a53ed1ae016fbccfc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655558, "uuid": "29ae0c3d-e7e5-4e9a-9bb6-55e4e44cc4be", "comment": "Malware payload (Heodo)", "value": "059e5d92ed42c618c10a329abfc4d210a3c6ebc79181a89754a6e64d79b51288441f8d5919b36b9ecaf775d96c15232b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655558, "uuid": "8bb3397b-3289-4bb7-9fa4-40714b4d58aa", "value": "T1CCE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655558, "uuid": "1b0a7096-7bb6-45e2-8767-6464bed97ac8", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655558, "uuid": "35e5f9cb-b099-4f46-acb0-c343950feb8f", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKMe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKMLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645655558, "uuid": "2e77b926-836b-473b-9696-7964aa457504", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645655558, "uuid": "1a596848-2bde-4218-a230-5138008bebac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655558, "uuid": "692227ea-265c-431e-91b3-e3ae5b2789b3", "value": "emotet_exe_e4_c100e1cb1eeb64b1937f5445c186433a2338e635216b46ce42810c38dfd65951_2022-02-23__223233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9130789f-94ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645622943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622943, "uuid": "e9d752cb-6980-4970-a9c9-961b92d6dc80", "comment": "Malware payload (Heodo)", "value": "4af61ef4287eb683eb2869e1fba61fd9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622943, "uuid": "0cc18636-af93-4be2-b5f1-ced5ac891992", "comment": "Malware payload (Heodo)", "value": "c11727f9a9ed0507d01dc4afae3ef14f1592218e113a91530e2f4609887ec791", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622943, "uuid": "74ad3523-e5c3-49dc-ab66-cb9c60bb1c9f", "comment": "Malware payload (Heodo)", "value": "55190216c272d3a4ad24a9529274c04ae99c5774", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622943, "uuid": "d1470ab9-00c3-4a1c-acba-1ebea0e1274d", "comment": "Malware payload (Heodo)", "value": "11f468c40226b312adcd2f41dab62b7ae3344edae62ae2f55463266e6a5402522097b9a48b8734dff9f1c7bdc85794ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622943, "uuid": "2aebd63c-6216-4045-bb0a-727a17b44841", "value": "T152A4AD5276C581B6E6E320B28A16732E73F3EB144737AAC34BC11D106A789E79739347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622943, "uuid": "6dd7a776-b835-4d64-af51-76f1776eebe4", "value": "6144:O42gtjrkcDk2KDn4J/+CHL0h+vWLEdxSrelS3DXoan0JFy/Edc3fgiZxAF//zgqM:hxhQ0pWageSXJ0JF0EdcDZKh8Sbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622943, "uuid": "7c880242-c228-437d-9ae9-5e566b7bc540", "value": 458696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622943, "uuid": "b461b360-7e99-4b3c-8f58-b2c4a2239d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622943, "uuid": "92327ebc-5b36-465f-a316-0cf7205eb0ff", "value": "emotet_exe_e4_c11727f9a9ed0507d01dc4afae3ef14f1592218e113a91530e2f4609887ec791_2022-02-23__132858.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4706591-9486-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645606681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606681, "uuid": "f8b76c17-77ee-4c36-83c7-133b62f5e48b", "comment": "Malware payload (SnakeKeylogger)", "value": "559177bb7acfda01bebff302e2da5631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606681, "uuid": "e540c39d-5424-4e15-8eb1-409651bfd95a", "comment": "Malware payload (SnakeKeylogger)", "value": "c21d05b5d07c71fa54c5ee5af0daeaa382e4278958b8f5abb2713e2a04749376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606681, "uuid": "cffb462c-c116-4c78-adc7-e155a4ad013a", "comment": "Malware payload (SnakeKeylogger)", "value": "c3faa22e0db468930942d5eab60a3ea1e1646ae6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645606681, "uuid": "f42530b7-76a5-40bf-b4f1-2a7a39079832", "comment": "Malware payload (SnakeKeylogger)", "value": "aff2621934baa759774828ac04d44f3fd1125f88b50d457a808eba278085adc90716ab0f8403ef43727156f0a33b26c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606681, "uuid": "9130a5b2-113e-4e42-859c-ed7cc265feb3", "value": "T103635B82E3DA5721E8144978643B9E242732BF4AAF02754B33DCB51A1EF7BC6DD22417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606681, "uuid": "74c9bdfe-5cb4-4312-aefd-f7d08b837ba0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606681, "uuid": "fb9cfa49-daae-4cd0-9b44-49de4c03a226", "value": "1536:Ig/tBiirbe8dAPvRs5zF0jaOgysVQEo7E:Ig/tBi4bBdAP5s5B07zA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645606681, "uuid": "443609ec-37ee-4e32-85ea-d51cf62fd207", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645606681, "uuid": "0ce0a7cd-8c9a-4a3c-9890-6a568fd2ba37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645606681, "uuid": "09e65d6f-3da7-4e4c-848c-3a48862e503a", "value": "Data platii 23.02.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ad485d-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645610567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610567, "uuid": "3dca6b60-3b89-414d-a4c8-ada99b135188", "comment": "Malware payload (RedLineStealer)", "value": "79c81688d9049308b0af2bb0bb882428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610567, "uuid": "49017b2b-f131-45bd-a288-f3c76f919ba6", "comment": "Malware payload (RedLineStealer)", "value": "c2214de09883744591c12880ba2ee40f0d83e66570fc8cf05f0d22b5812a8b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610567, "uuid": "c9facd23-0833-4247-a42a-4a2e18628a85", "comment": "Malware payload (RedLineStealer)", "value": "b5ec31ed4eeb878b841884e9a4c372f6427554d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610567, "uuid": "4fc1aa8d-cd63-4d2b-98c0-b6e028709d94", "comment": "Malware payload (RedLineStealer)", "value": "502e0e1bd598d61105cd83132e1ad09a88d00d031c5f642d2b937c94f3cf359ede290c0f2ade3ff095c4d94c595d078f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610567, "uuid": "e77ffb07-b6c1-4dd2-bda8-ed842b459a4c", "value": "T1D9559D4137F9A17AF5B25A3A563786188F32B82559F9860F1F20FD3C1879944CE3B722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610567, "uuid": "aed05216-46fc-41dc-bd6b-9a43f3185f66", "value": "adfcd21a893a1afd60ec246ddb9da69d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610567, "uuid": "587bdf04-3837-4cc5-b1e3-2aa00b36e665", "value": "24576:PZCiPKke8O2eRndL49FwTIKa/szs1Kx/fHdLoF6MWDUbI1:PZCiXH+dLew6kb9LysU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610567, "uuid": "65b6d484-bd05-4853-8309-849d3c317f4d", "value": 1399376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610567, "uuid": "fe83cd0e-01d0-4173-a7cc-7e4feb9b463b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610567, "uuid": "ac464783-3430-4c2b-afce-bff372329b48", "value": "79c81688d9049308b0af2bb0bb882428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37354a5c-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645618926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618926, "uuid": "5c59da19-1432-4912-8245-880687e7b165", "comment": "Malware payload", "value": "8142c8883e12ffcd1ec60706c979e68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618926, "uuid": "d1e2c9a3-406c-42d6-a7c1-afb6aceced96", "comment": "Malware payload", "value": "c2bc8ddefad9b9764c499ef3da2fd1f74661d4c01b35b5422a4cc67d4d3eaa7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618926, "uuid": "b3e7ff0e-0aa4-40a5-a6d7-77452c166ab0", "comment": "Malware payload", "value": "a857623cb666a4dacee5b44a2825d78a9bce339f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618926, "uuid": "5c214670-cf81-490e-9acc-46abaf1f5ed8", "comment": "Malware payload", "value": "b2c1b276877e4316ec303884d7f9511566b4478a4ebf90a2da18f46fbeddb0772927be2dffa0dd921363f1fc1f493086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618926, "uuid": "d23686d7-a8ea-47c6-b0db-de7a481bbe03", "value": "T1C8F4BE2F497F223A85BCDB9199C4CE2FF8A2C5963537991C29C616D90516BF330D222F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618926, "uuid": "dec88f2f-cd67-47a8-b7c0-bbae3bb865a3", "value": "12288:opjbBBwbaJt3LcrOwlhAtOZHdUMoTmt0sKH2Fmf4akNJKW8s/q/K3DFj:oVByWQHlhAQZC7qtblmzk+uaK3DFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618926, "uuid": "fb4eef81-be4b-495f-9c6e-81d273754259", "value": 723670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618926, "uuid": "34bf5c37-8fbe-4fa1-803b-22179a3ba1fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618926, "uuid": "232ea0f4-40fd-48e2-8d16-ef936f4705fc", "value": "8142c8883e12ffcd1ec60706c979e68e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba462f26-94c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645631602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631602, "uuid": "eee78ffc-fd50-4884-969f-1343dc6bdd53", "comment": "Malware payload (Heodo)", "value": "1c71353a41a2a225f334d0754a34b33c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631602, "uuid": "cce65870-cf06-43cd-994e-53aa381abd31", "comment": "Malware payload (Heodo)", "value": "c3d22a6dfb73f48cca54c526522d392500f1a40dc847180460d02e3d46a10055", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631602, "uuid": "3a0201ed-15c5-4f77-a087-edc9e522fd85", "comment": "Malware payload (Heodo)", "value": "d71c1048fe5f7b67dc1c3c5ac0b1cd28dd3d22a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645631602, "uuid": "c038ea52-888d-499e-b7bc-afa69b4875c2", "comment": "Malware payload (Heodo)", "value": "6e7374bbd6ead03259217f7813c3286c373c7a87f6c612847787bb12da9b5f3865b826804146aa2157c90d4c39e79255", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631602, "uuid": "44c61d4c-1895-4cf1-bf1b-9ba062e9a81d", "value": "T15135BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631602, "uuid": "ae5b2074-8167-47eb-af85-ac669d7c475b", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631602, "uuid": "0ba3ad02-2ff1-4826-b357-005e61d4df1e", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/PTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/PTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645631602, "uuid": "31cd6e7c-6032-4c37-b023-3ab6f5bb71c1", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645631602, "uuid": "7a344e7d-acfe-4633-b46e-1a0d11e57740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645631602, "uuid": "495a6112-17fb-4b94-929e-38fd8b45d3ae", "value": "1c71353a41a2a225f334d0754a34b33c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84cb718-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645630283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630283, "uuid": "6898e52a-0fa7-403e-ba1f-5a1d04664b98", "comment": "Malware payload (Formbook)", "value": "005d25c88ad7084e0b6fd294b4dd8dda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630283, "uuid": "8fa0c338-26c6-4a00-b30c-4f19c214fda9", "comment": "Malware payload (Formbook)", "value": "c48deffa7188f31de3b9347530cad3dee6b5f4a5afbe89c9e50629a6611bdec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630283, "uuid": "1f9fc04b-3993-4eca-9d3a-daec2bcda54c", "comment": "Malware payload (Formbook)", "value": "bb9f11ea6c174e5a85e67c8aab4e561ea6fde03f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630283, "uuid": "ac01700c-1eb8-4aed-8646-2b4faead08e1", "comment": "Malware payload (Formbook)", "value": "c853e2624843c5c081011a666358628780180e0a41fce15b9fcb051aac07a5292e02cabf731e8ec648351e19b4a85dad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630283, "uuid": "3adf9246-f053-4122-a425-c042586b0e4a", "value": "T1BC05C04839A78F3DF1B58B725DC5ECA4BA9CFB232C08B37D78556246C691B904C423B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630283, "uuid": "7b462d7f-0d23-4c50-99ee-8e3e37c85497", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630283, "uuid": "215c9dd2-729e-455f-a095-19afc58c644b", "value": "24576:dzYK777777777777nqQVQ1ge7Uqdiczkfv6djeubk2Fs:px777777777777nqtzUOXQfv61euh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630283, "uuid": "6ebb4b08-38dd-4b41-8d5e-8f7345de9692", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630283, "uuid": "35feaa22-b76c-40ae-a4b3-87ac4f037569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630283, "uuid": "b64c107c-f0b2-4ff7-af9d-7b6353ce7bbf", "value": "purchase order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6055769e-949e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645616848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616848, "uuid": "60fd663f-7cd3-419d-8943-bec3af4ffe1c", "comment": "Malware payload", "value": "6155c52358b8566e9bd7eb765bb71965", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616848, "uuid": "6bfb83d7-0755-4838-9ee9-50f0c89e8492", "comment": "Malware payload", "value": "c49dddadfb953435eb767641e18084eaed9d2784e0c7eaf8c9234bd48ad97366", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616848, "uuid": "b207dec8-ecea-44cd-851c-62b56d0e7a58", "comment": "Malware payload", "value": "2e84844ce1b8cdb4162d815a71b7375e213d2d93", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616848, "uuid": "4e2ec711-5ce5-442f-8d44-daf8279d8c36", "comment": "Malware payload", "value": "6a759d4e4b5a78d4efe486353916242da44be68ac1eb0a1dd85e6075539be817cdc6a49090d5acb278c3e7346f245c12", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616848, "uuid": "573c4886-7eb2-430a-a69e-a9777f61dcf6", "value": "T1FEF49E2273D9C937C4BE4A706D3ACB4A1638BE504BF2C0EB57C9699D0DB66C05331B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616848, "uuid": "871dfe70-6697-451c-b387-be9655bb9247", "value": "12288:sW4OfYBowv43bqKlRH1Vq9iyXNA+lZuNF7M/37M/37M/H:sW4uYBowvitjVqoANAS+MTMTM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616848, "uuid": "5120f5f8-3850-4c38-a323-5b0a7102ad17", "value": 777384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616848, "uuid": "8db2f4ef-bb21-4d57-b2c9-22f59f17d847", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616848, "uuid": "e2ea341b-29d1-4f3a-8bf5-340738071f5b", "value": "Dep_09952663.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f5ab52-9497-11ec-9275-42010a9c0029", "comment": "Malware payload (LockBit)", "timestamp": 1645613869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613869, "uuid": "359edcf5-b01b-4956-8896-f9d9510e18a7", "comment": "Malware payload (LockBit)", "value": "50d14819961e1a522eb2ab9544e1da4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613869, "uuid": "9672f6d7-6865-4ae5-a1f1-f62d6d8cb5c1", "comment": "Malware payload (LockBit)", "value": "c6902f14bafb0fa5c7b46a3afe0ff71245c0bb26ac07b187ff58fd3fa381dbcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613869, "uuid": "08e95d4a-6e2b-41fe-a240-75ef9967e959", "comment": "Malware payload (LockBit)", "value": "02cd1fcd0190af2fb41d0b5bfb9f28febab532cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613869, "uuid": "02e1750c-8cf5-43c5-b925-5d47c2b845a7", "comment": "Malware payload (LockBit)", "value": "4d73a6f2ee29b1376a5f742d047c7d0f85722782416d26bd31984ac65d497d9b2dfab58c5861f04ad6f766e7f7ec4138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613869, "uuid": "dc5578cc-cb16-47f8-bf42-1df2d1b963bf", "value": "T15C253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613869, "uuid": "9087c07c-9c39-4c13-85c9-7da7bc7b4c38", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613869, "uuid": "ed812167-80d6-4a94-878c-2a9ac9f42448", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdhF:Ujrc2So1Ff+B3k796f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645613869, "uuid": "25ccfc08-fef3-4a5c-bf7b-3e9c8b53f31c", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645613869, "uuid": "8c9d6912-b40a-47f9-9899-3cfb7075e651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613869, "uuid": "c8fb5ff1-76b2-48a0-b3b4-fa97cf7d736b", "value": "c6902f14bafb0fa5c7b46a3afe0ff71245c0bb26ac07b187ff58fd3fa381dbcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0145640-94d0-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645638430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645638430, "uuid": "84a17f14-d427-4663-b70f-b6110be8eae9", "comment": "Malware payload (njrat)", "value": "ef71b16a6859667fe6e44bd096ddfabc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645638430, "uuid": "b3ef0efd-87f7-4718-8f6e-ae50e2bc4d90", "comment": "Malware payload (njrat)", "value": "c7209e3258893afe54ddada4ee950f241e26f3e82525a7ff9d6cc0d6b856d0c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645638430, "uuid": "9a67e49d-32ce-4d19-b895-8609f6d9f364", "comment": "Malware payload (njrat)", "value": "4051c803e0f199fdf8d844b5882076fb92963049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645638430, "uuid": "16f8a1ad-94eb-4bf7-a9f1-5072423b740a", "comment": "Malware payload (njrat)", "value": "8a5d590e61a69a896c641a0c15bd8be8d617c859468a67e4b0ee2716bfd54c75cedee70d6d2879dc124be01255c2ebe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645638430, "uuid": "9ac158d4-88aa-4794-9592-ddf58e2704a0", "value": "T12C94EDE64FBC8A36C978D9387045267431BD5B4070DAC2700D63E4E5BCEABADC2761DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645638430, "uuid": "454d6eb7-38b9-425d-80c6-752b92826a69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645638430, "uuid": "fe00cc16-ac22-4117-8577-fe63c3f4895e", "value": "12288:Z7WK8oa3vzyDRiVRSHrPJXC2QQgfaPvZOFLj:Zadoa3vzyDRiVRSHrPJXC2QQgfaPvZON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645638430, "uuid": "149d61d9-1996-40ca-8b8f-96b90be2d1ef", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645638430, "uuid": "495a51f1-5429-498d-a863-9ce5e91633b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645638430, "uuid": "ba14a591-ed09-4e92-a027-b4bfb4e2dc43", "value": "C7209E3258893AFE54DDADA4EE950F241E26F3E82525A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21cb941-94fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645658244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658244, "uuid": "c63f5284-5071-4ba7-8864-3af27326f030", "comment": "Malware payload (Heodo)", "value": "6538bab1ab8b2b125fd1bb77accf5667", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658244, "uuid": "a544a7f2-03ec-4658-90cd-a70e3699dc52", "comment": "Malware payload (Heodo)", "value": "c7651f4c7b73652eba42cff05e983b3c45317255010f29aeeb7c561ba4f2aee4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658244, "uuid": "0fe9960e-9d34-4007-90f9-e2fa6c4eb3f4", "comment": "Malware payload (Heodo)", "value": "9a34a4ae0131cc94f64ee2ccee8248f76fde2b17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658244, "uuid": "f86334fd-5a6d-468c-ac48-8df5c674dcfd", "comment": "Malware payload (Heodo)", "value": "16fe9ddb93bd7ab3c8fd800b1bc0f0610ce8ab0bf0b4290fd69a5aae03df0e963b8bcd5e62cf867266369247f6ca7563", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658244, "uuid": "5ac7e3ae-92e4-40fb-89a0-5ac8e4fe71c0", "value": "T11DE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658244, "uuid": "ce4ef333-3e82-4c0f-aa6b-4894f26e82f4", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658244, "uuid": "2556d648-f3a5-432a-bbb8-961a60a8ee18", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0YhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNf4PhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645658244, "uuid": "186ef438-fe38-404c-b95c-0e4f6ddc416e", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645658244, "uuid": "532d9132-342d-4c5e-9aff-71df5b710fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658244, "uuid": "d23320c1-ded9-42af-b5b9-9e62557502e6", "value": "6538bab1ab8b2b125fd1bb77accf5667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5c4aca-9458-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1645586937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586937, "uuid": "355b1006-fbb8-47d4-af8b-f521394f9c8c", "comment": "Malware payload (Quakbot)", "value": "588abfb77400b325002835769abff167", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586937, "uuid": "88825179-1c0f-4db2-85dd-324fc4a8fc59", "comment": "Malware payload (Quakbot)", "value": "c7665be16e6633d97b36311d0d67c697c4d26ed628441039c9bf37d6bab74b4a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586937, "uuid": "01e4bf37-814e-4bf3-bc74-675f01fd6106", "comment": "Malware payload (Quakbot)", "value": "00fb3f5ea0cd0f776e6f182b3e322b0456f23378", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586937, "uuid": "1e789b17-ef42-4a10-9454-08d58d3542ca", "comment": "Malware payload (Quakbot)", "value": "f83f05ad8e3c167c27caa50b4f554e3ca54e78fcc8e56112fe7edf52e58d8a1469459d763a8c8b1fd39051497c2d6fb6", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586937, "uuid": "5a8d56cb-b918-46f8-a20f-57243c86cfa7", "value": "T11E44CF829885704FEF1FE833CA57DBBAF089A574B472E0872EDF44E39E85342564570A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586937, "uuid": "9102efcc-d32d-4353-a0df-699bd3225ec7", "value": "6144:4O4xg53oqHWu0000000000000000000qSfPhTD7ANHbA2UUUXWp9BW+:N8gvZw5UXTBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645586937, "uuid": "e206d6af-3c78-45a9-adce-cb8b893fdb5f", "value": 270795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645586937, "uuid": "25defd85-8c4e-40d9-864f-81cb6bfc41c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586937, "uuid": "2132d47c-c18f-44b8-9375-a2eb2a75d9d2", "value": "414.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5fa7ff-94be-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1645630751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630751, "uuid": "b03b3270-ead8-44e1-ab72-b4afe5e52e2c", "comment": "Malware payload (RemcosRAT)", "value": "f47ede3af9a6ca374a0a54a4194dd7d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630751, "uuid": "1904a565-ca6c-416f-887a-019c2dbbb2ba", "comment": "Malware payload (RemcosRAT)", "value": "c793394ea0bd214459520e1403e523cf59936ddfe5a1a60ad59e0457143725e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630751, "uuid": "f11224cc-0848-4a38-9fa6-4446867ee7e0", "comment": "Malware payload (RemcosRAT)", "value": "523f74e5de756049cf0445ee135879678c93c80a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630751, "uuid": "d545b5fb-d5a9-41a6-874f-17870404a3fb", "comment": "Malware payload (RemcosRAT)", "value": "791b1c44159cc43b4d9c398c715eebec9def46612b74625ccfbd8a6cda542694dff2909cd454a1e276cb7b7bf1951982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630751, "uuid": "994e4620-c89c-461a-98d5-84214b191d79", "value": "T1F245E1543DA75F3DF1718B724DC5ECB4BAACFA231C48B3BD78552246C6A1B808C426B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630751, "uuid": "e7cb6422-6883-46bb-b87b-b0fff073e02d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630751, "uuid": "8c413ed5-325f-4ae5-bdbe-a6734c39eb8f", "value": "24576:PK777777777777dFYVE6/Lf0BfGqv0xs7qdZmTgwOK545tq:y7777777777774feG1CqXmUIW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630751, "uuid": "e352cd9f-87b9-495e-a4e0-9191223a6e26", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630751, "uuid": "7815cfa9-20a3-4295-8c6a-1a96a28d4390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630751, "uuid": "d21f60d3-3dca-43f5-bc69-3a0b179091c2", "value": "f47ede3af9a6ca374a0a54a4194dd7d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3edf46d-94df-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1645645013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645013, "uuid": "872334a9-117f-4472-9025-84aa9e8575ac", "comment": "Malware payload (DCRat)", "value": "4425abbab2955795fce5eacca089b5d0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645013, "uuid": "38bd16e6-a4e1-43ea-8e77-94e992d211b0", "comment": "Malware payload (DCRat)", "value": "c81c670ecb7554229b558031953b894e101f1cc05c565d0182b3d879f38909bf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645013, "uuid": "69271e14-746f-475d-83e7-6a7125470d72", "comment": "Malware payload (DCRat)", "value": "9689423c5cf7e7f3b2cf70274dbec8a19004a712", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645645013, "uuid": "94da1722-2d1e-40af-971f-a0829cade61c", "comment": "Malware payload (DCRat)", "value": "0660760dfcaa5b5ca6b0a64f0b49378aafaaf55a0cb85a0ff7a6393626209100be50bb043b3a0618693f42a315950486", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645013, "uuid": "c0cb0a3b-2a54-4f85-b4e1-9d44eafd1cdf", "value": "T10BF4B40A7A9DCED1E0252F36C0DBC41443E9FD8D6676E70A7D4A336825A23A65D0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645013, "uuid": "b8734ddd-885f-4069-8e33-d5b552b596c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645013, "uuid": "a5bd4000-9d36-42ad-819c-8264b2421ea9", "value": "12288:5amow93fJeV5f234wJkZCKIo3xheLqCJoqny:vLNJeV5OowJsxheLq9qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645645013, "uuid": "6c1b6032-455d-460b-af35-199c6b350167", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645645013, "uuid": "b7c767e4-62e6-40cf-ab01-51ae2c6b6c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645645013, "uuid": "ed87d62e-39dd-4aa1-b2d3-8dd89d89fd5a", "value": "4425abbab2955795fce5eacca089b5d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19929816-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645619306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619306, "uuid": "4977a2fe-5d53-49cb-97ab-e9243fc8bbad", "comment": "Malware payload (Heodo)", "value": "4edbac0d3b894b7d586ae54c8a7bcdf1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619306, "uuid": "0e4507e7-4bad-452e-9ed8-66dbb572bf7c", "comment": "Malware payload (Heodo)", "value": "c9690c354c713eea969ca8a991124b48a207baee916bc6364a658f6b25e99c96", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619306, "uuid": "8072929c-b386-4e55-8c6d-9432ad7efdb3", "comment": "Malware payload (Heodo)", "value": "2c7ab2ca2343afe3ad38a00b10974b4585f591a2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619306, "uuid": "886229e1-9d58-4113-a4a1-b848258bd12b", "comment": "Malware payload (Heodo)", "value": "bf272058d0129b473ad5855665a0aea667def05943ea0dc006c5a1d6ffdd3abe6bc6ae0e3432729ed575fd0b2ebccbe4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619306, "uuid": "6a3a5c4f-a84c-4def-b269-2f252bcadc6e", "value": "T13224AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619306, "uuid": "b2ae0139-fecf-45df-8cc7-0d2904fd6ede", "value": "6144:WMyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:NyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619306, "uuid": "07b4c945-bafb-42d5-b4a4-8fd1a8646afc", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619306, "uuid": "c5934fdf-601f-4202-b8db-beb25e80fa2e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619306, "uuid": "74b0915a-9783-4168-82d2-a5db76a1a0db", "value": "2022-23-02_1326.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f677ce-948a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645608328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608328, "uuid": "31851373-2aab-474c-b606-532ebc627ba6", "comment": "Malware payload (Mirai)", "value": "56a0e85e28806fb48f712df4dcf94c5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608328, "uuid": "a85ed2ac-737d-45f4-a93a-917054735fb6", "comment": "Malware payload (Mirai)", "value": "ca55fcd8e789b8e1f8479870a1f44505fa2071bf10dea4ac93a11bc882eb81d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608328, "uuid": "b331dae4-4a40-45e3-b504-a92a2f63a59b", "comment": "Malware payload (Mirai)", "value": "4e1fca1e9df0eecd978f2a1cb5c1cba9c975cf2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645608328, "uuid": "f1e2a677-163c-48f1-8009-b84858567ddd", "comment": "Malware payload (Mirai)", "value": "557ca7a58ec35307427d1c3d129f47a10b99583a27208a06cff31a7a92e523573d4252e2f7a3605dddff69d61baff22a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645608328, "uuid": "155dd57f-464e-403b-9948-8a76a310b3f6", "value": "T11813E12E4AD05DE9E7AC9CB95DB30B8008323F365493DDE72258DB46EF966783053D88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645608328, "uuid": "194b2a69-0d78-41ee-84fb-26e503639716", "value": "768:dYP6t5MtOjlRTUG+hsNSkFROKTY4pf0FsI66KVC2OwSdR+JgGlzDpbuR1J2:d+WSmRp+1kFRO1VSVC2brVJus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645608328, "uuid": "edb042bd-eee3-404a-8e18-0fdfe028ae36", "value": 41940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645608328, "uuid": "da06e335-c8ce-4d85-a69d-ec60c7edb1b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645608328, "uuid": "14687466-0997-4693-97e3-0b69b276b287", "value": "56a0e85e28806fb48f712df4dcf94c5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7a830d-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645630159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630159, "uuid": "5e1504ab-a109-4fd5-9b0a-1ad7c70a4e0a", "comment": "Malware payload (AsyncRAT)", "value": "6a40a14dd218901c7074181cca3b51e7", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630159, "uuid": "9aa51fd1-7128-4de0-ae87-2a7f9fd871b0", "comment": "Malware payload (AsyncRAT)", "value": "cbec3422b10baa9a0631354fcbc059eb61eaf8d4d33e27de4befcb3e7eb06573", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630159, "uuid": "ce520e61-a17a-4b43-b622-678b0398b29e", "comment": "Malware payload (AsyncRAT)", "value": "3be1c58f091e882744a3b466f0b52a30871a3e60", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630159, "uuid": "462becef-5dcf-43a3-8d36-29c307543c01", "comment": "Malware payload (AsyncRAT)", "value": "410b3d7a00dbe3201fbc0d3cfefa8c0a24f94fff75bbffc380aef74fee493d2de39fbfd251daaecbc83e38c0848fe2fa", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630159, "uuid": "73439571-5eb0-43f1-bee6-01151be6cec4", "value": "T16DF19E99BE426081C723C23DA9E504EB3927787BD8B5D91F3104F2CC19E25C74B4A91C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630159, "uuid": "cc85445c-62c7-400a-9fd5-181aabaeb3df", "value": "96:ZEKr9NP114Ugdn9th/LNIJcTV1Ih3HSxghdWwEx5igg4MPrpHKWddTC4eFfBX/:xrXP/4Ugdn97/LOcTIQg6IlzPC4eF9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630159, "uuid": "f0633912-9e1c-4c49-8b0c-03020fd72725", "value": 7736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630159, "uuid": "0a344eb8-e12c-4924-bc78-3a4a69f1b50c", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630159, "uuid": "a37b5ef6-5662-47b6-8ee6-da6f5e66111f", "value": "Documenta\u00e7\u00e3o.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb5bc6a-9457-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645586535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586535, "uuid": "9e8a56f1-6b1e-43d3-bb50-1fb4a224bc95", "comment": "Malware payload (Mirai)", "value": "4866c8d6f298a6b582027fd67238a4d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586535, "uuid": "0d8da9d5-f7ae-47be-930d-95520d38d3bb", "comment": "Malware payload (Mirai)", "value": "cc6d0652ebdf229a29f494630fc46764a86b0a70de5ad3ca2aa215924ec352a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586535, "uuid": "96052f61-b0b5-4cb2-903a-332087408c15", "comment": "Malware payload (Mirai)", "value": "6cd45ace1a505762bd367c87f07daed7812ba9b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586535, "uuid": "bbf96856-a7e7-4b3e-87e4-335b885a1b8a", "comment": "Malware payload (Mirai)", "value": "3e32d782b35455ec0a9a736c8027b78fa8895ba93a5ebb8cd7ae2eced7fe8313378347f92e07c6dc9c0d22c45751b3cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586535, "uuid": "1e19309e-40e4-4216-8468-2d1da3c8d74c", "value": "T1C3820939FB431C27C4959875A1E7432DB6F9831F98B84F2A3C621E8DEF50D84A6432B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586535, "uuid": "3c517173-d2cf-48b4-835e-00925d26489e", "value": "192:EFbkE+2o3tizxDJUpr9DlRRuH1wRPuZVUCyu4P0eB6kd+D2rrPllTTTo0GB6QzDM:kbkEzoARJUprlli7FU+p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645586535, "uuid": "51a0ad49-8a06-4346-bac3-a64f1965d0ee", "value": 18472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645586535, "uuid": "85dc5dfd-916d-4536-8a63-ba9134948cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586535, "uuid": "faf14290-74fb-4aa2-b0ee-b54e6022f668", "value": "4866c8d6f298a6b582027fd67238a4d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5837f7-9470-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645597215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597215, "uuid": "eb32d4f5-d452-4fa7-b556-86876289a465", "comment": "Malware payload (RedLineStealer)", "value": "14eaba51c199c72755334950da0ea07d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597215, "uuid": "53f7eb9d-f644-4e66-8988-fd26f482d975", "comment": "Malware payload (RedLineStealer)", "value": "cd3c72abed935a7b83c5dc1cdb1383922e42ab145b2cf0206d5f0d1aa6382f37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597215, "uuid": "bf439f40-db4e-406f-8deb-8a9a61832eb0", "comment": "Malware payload (RedLineStealer)", "value": "906da4864d1ad66b93ae768dfcf54096b8a6dfb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597215, "uuid": "c9b9f0ca-b4c5-4e82-9895-0b46672b4adb", "comment": "Malware payload (RedLineStealer)", "value": "e0f221f44d3d8069ba7112d811f1d31ce870248267933469f90e505e3afec52dd67168993344bd3e6ea4e698ce3da262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597215, "uuid": "9a988015-6916-4ff7-977f-e5945e4a9ab0", "value": "T1F636330D916D34CAE4CB8C3FA685651F1D2AE9CAE8E41C8BD055A7EADF4106BFB34710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597215, "uuid": "61ee049c-fe2d-4b7c-807d-58b84b81ebe6", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597215, "uuid": "2db8c889-ea69-4907-82a3-124aac31a056", "value": "98304:MAuowCgIaaFWTgvHy/u/4L5pQWXN9gPGEjbFiFV7uq+fPCJ:MFp1IaBx/uK5pQWd+LjbFiFV7uqSPCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645597215, "uuid": "1813b8c8-e9ae-4973-a32d-66305f54c0b6", "value": 4903216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645597215, "uuid": "72684e5c-423f-4a3a-b976-627792c64833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597215, "uuid": "4cc8e69a-9042-4e52-8d69-65c1c30266ef", "value": "kaspersky antivrus_installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24779a36-9504-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660556, "uuid": "9fc0a416-166f-4ea2-826e-0a3354480e45", "comment": "Malware payload (Heodo)", "value": "cdd029d93ba1cb15b90e0188f4c82552", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660556, "uuid": "eba92198-b383-4fcc-84f1-16c82d2dc4fc", "comment": "Malware payload (Heodo)", "value": "cd73e6eb1b6eaa25e8f2e512fed8912b95d59204a9fac2afd16f859dd55e08d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660556, "uuid": "acf918fd-86d2-4290-9d43-ddd8576fbfbb", "comment": "Malware payload (Heodo)", "value": "cc52b421035e6c145196f07e362002836c5c0a2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660556, "uuid": "53952f94-b311-490a-a75c-9b2572e5663f", "comment": "Malware payload (Heodo)", "value": "dcfd053b613c98d90b4a60b333f9b7f1523a48b0c57370772b54a50dc04a52915c31b7aa4d5f1c30a9f2908b7e37f316", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660556, "uuid": "4348c673-fd4e-4614-946a-32d9aa732d0d", "value": "T11EE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660556, "uuid": "a2bb4a17-2e63-4661-a705-8b1c5b185e72", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660556, "uuid": "20656208-c3d0-4b95-a825-a47876ef9221", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0bhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfhPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660556, "uuid": "2fe47d10-3868-47e2-babb-f52d30970e75", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660556, "uuid": "e64364df-57f8-4ac3-98fb-08590f336d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660556, "uuid": "357969ed-9136-4cd6-abde-591d7409d29b", "value": "cdd029d93ba1cb15b90e0188f4c82552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03799c80-94fb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645656635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656635, "uuid": "d3bda2d0-3528-4a71-9ac9-fc007a822768", "comment": "Malware payload (SilentBuilder)", "value": "7cb97aa9672025502c9abe0955f864d3", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656635, "uuid": "de21029f-1b6c-405b-8585-48fbe1e49fda", "comment": "Malware payload (SilentBuilder)", "value": "cdbcf32e052c6c714f140cdccd8aef55dc624e56ab3f65cf5f3f204fcd95d5a5", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656635, "uuid": "a549724f-8f94-4766-a99a-55cf6a16d775", "comment": "Malware payload (SilentBuilder)", "value": "0311cc263fa4b6c9e156cb1eae9f55c5bb25e9a1", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645656635, "uuid": "b12614a8-0e74-4448-89ba-cbdf69f0a17e", "comment": "Malware payload (SilentBuilder)", "value": "d4b1afed0b68cf0b4eb84cec028a7e8c37e0513585c5a5942b0fe021db676479f55608628fd3049b0d79afae94204f63", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656635, "uuid": "c81e4029-5bc3-47d5-a99e-55a8b34ee113", "value": "T17FB3BF5AB21EC86DE965873048D747EA2737EC114F6F4B873A49B3227FF89904B1341A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656635, "uuid": "00672867-191c-4d32-a40b-6cb71b746081", "value": "3072:VfKpbdrHYrMue8q7QPX+5xtekEdi8/dgVyVIBk6h2bsllScQjnxw:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645656635, "uuid": "612acc62-2ecf-4227-b0ce-7a5a5ae3932d", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645656635, "uuid": "a2c2ebcc-08c9-4b95-800c-82d955185e44", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645656635, "uuid": "4b0f13c9-f8db-4e50-acd4-2a1dd2004089", "value": "SecuriteInfo.com.Exploit.Siggen3.29238.8399.31383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6598faf1-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645611273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611273, "uuid": "bf0fd066-121a-4288-b764-85554a53d1db", "comment": "Malware payload (Formbook)", "value": "b71c39ef103144e293804edb6ac7ad59", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611273, "uuid": "d90628f4-7bef-4bc5-ac53-41a954306844", "comment": "Malware payload (Formbook)", "value": "cdeefa09740a9a4c7b80f27a243f84696b30334f68b10dbf71f10a595c362ef3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611273, "uuid": "c9634fef-e518-49a6-9f57-19773f749000", "comment": "Malware payload (Formbook)", "value": "1c32046b339b6fa0990c517a43717fb269eb317d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611273, "uuid": "084fc60e-b83e-48ee-86c0-93a164bc503f", "comment": "Malware payload (Formbook)", "value": "9be4495902a73d36f986af4d0088fe22d14f260ecca11a5a80654f8bf1c25e5beaa9dcb411b32d17c7a11f637a1f5b6a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611273, "uuid": "bdade8da-cc69-4d3e-9668-b8106aec6239", "value": "T1051412462662818CF5E23B714D9FE954FC57FFA2D0B3A902694A37C1603A993C7C0B8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611273, "uuid": "7cc25d5e-c521-4557-b69e-94bc534935e5", "value": "3072:erZnO4jFCMS3KSo6qg8SgePd28/RdaONUx1EhT6Y7/jtbFrbc:9IA7o6qnCEe3NQjY7bt5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611273, "uuid": "bc931d1d-0ebe-47cb-893b-9c05ebfc5666", "value": 190744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611273, "uuid": "5bf28dc5-3886-439b-8ba3-d8532023b9a3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611273, "uuid": "13e94ad9-920d-4f98-84d7-021ea4a3a2a5", "value": "Enquiry 220062 Krause K + K Modustrebinje.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc027210-9471-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645597674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597674, "uuid": "386a49c6-b385-4089-8f20-f37f99996790", "comment": "Malware payload (Formbook)", "value": "778c68dc615f59f79148e07662cd8089", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597674, "uuid": "c7c56f05-760c-43ce-ab8b-3ef4a455d702", "comment": "Malware payload (Formbook)", "value": "ce4e958ece0f47475ac63b2b9f02ac7f86119e960aab1c4e8af303f5db853be4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597674, "uuid": "ddaeedac-c090-4a98-af1e-fffabde4ff39", "comment": "Malware payload (Formbook)", "value": "b831e66243bea2aa385790b9f6ac10840f03454f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597674, "uuid": "3220b1da-0643-4c73-95d8-d6ed349ecf83", "comment": "Malware payload (Formbook)", "value": "891bfdfd976e988b14c644e3eaad95dadfc4a75587eb7fd7695f335d6eb7c4ce854381817a19b7dbd0961f6e6d218e9e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597674, "uuid": "4074e92e-993b-44e3-a7ec-ed10597fd00a", "value": "T1C63423E3DDFB6B8C2CB4CEADA03A7E099131B28B0147B2C44BBA712994D91D701785D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597674, "uuid": "d3c05932-e805-4917-a558-700623545505", "value": "6144:A3iMrZDI/o9AsQ3f+eFUOWS1LbiN16sac+sCg1spwm2Nit7o:DMlpTeF+jzQLg1sANiZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645597674, "uuid": "2b937081-98fe-4d66-be99-45ad0b5ea178", "value": 243540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645597674, "uuid": "c92baf1a-6959-4fde-b0c2-5b19b87c6954", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597674, "uuid": "3877292b-7c07-47e3-a9d2-5b8ed32316ad", "value": "NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225d5b74-94ab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645622327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622327, "uuid": "7b22f0f8-03dc-41bc-b51f-fddd514b22f7", "comment": "Malware payload (Heodo)", "value": "492ebe377b5974b4a9f47e9831cc6555", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622327, "uuid": "f53d79cf-1444-4944-8e1a-1c4d9b4792cc", "comment": "Malware payload (Heodo)", "value": "d034fd64931c293d458754c99e057ac4938dbd2761ca89043e5272a4ecd1776d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622327, "uuid": "20aa7cb9-1b70-47ec-9834-25f05b35c35a", "comment": "Malware payload (Heodo)", "value": "bdb2c87434a65090a4f698b52af950e1312a102c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645622327, "uuid": "ff46fb75-c8fa-48ba-a297-b9962880dc3f", "comment": "Malware payload (Heodo)", "value": "5fa1d3c0efc613751be2146577f6c4a22c2ac03f79cc010405ab97eee5ba73f1e002ce416139a0ccaf495fa5763061a6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622327, "uuid": "aa3eb576-9e1a-4713-82de-7d1ef3d3e74b", "value": "T1E2B3BF5AB21EC86DE965873048D747EA2737EC114F6F4B873A49B3227FF89904B1341A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622327, "uuid": "1567e10f-ccf8-484b-a2cb-559e8ae8318a", "value": "3072:VfKpbdrHYrMue8q7QPX+5xtekEdi8/dgVyVIBk6h2bsllScQjnxE:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645622327, "uuid": "94d1c84c-b369-4d7f-a85b-d357102d3a2d", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645622327, "uuid": "ffd028e4-e78e-4c16-8feb-58491797dd1c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645622327, "uuid": "0f3095a4-bf23-4057-956b-71a4141c3664", "value": "SCAN-5450.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cbb6fd-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619347, "uuid": "89225598-0e5f-4bf1-a3a1-6ad44dd37bfa", "comment": "Malware payload", "value": "0ddae47b33abab8019d29f1a7aa1a849", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619347, "uuid": "07b81d1e-a6f9-407e-a00a-5e0151171f9b", "comment": "Malware payload", "value": "d112476564513dd097eaf0e7cbbed386f5647856e0d3feae31b75498a1cddf94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619347, "uuid": "0930eb4f-f05a-43aa-99f1-068e60f21864", "comment": "Malware payload", "value": "6478135a34744baf5b49a645cb1d22c317fac2a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619347, "uuid": "7c7d96b3-6f70-43bf-9a87-a01f4c32c075", "comment": "Malware payload", "value": "30c89670e1881b789f21fe281f327249651416b91693d034ec7f1bacacfca366f8b7670d0e7c6f7b80118f66439a56b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619347, "uuid": "3fa3065d-1998-4e14-847f-ffe687b25143", "value": "T1B6B53386FFC8D9B0F2626D761C8370896B3AFC2A6E64854B76D43F4E3D39A81444C5D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619347, "uuid": "d4de6607-78da-45fd-bd16-daffb03c22bb", "value": "de1fa96ad5bc81910ffb7ed552e29d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619347, "uuid": "cc81c3c8-0027-49fb-8fcc-7b098def912f", "value": "49152:RxH3KTyEJdyyUa6PrvMrKQHBhzFrBRucp2uBUYYs2aoywX7Ah:RZ3KOMFkxQHBBZOtuBUg2aKXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619347, "uuid": "046dd507-d180-4562-9081-0d734e34ba87", "value": 2400099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619347, "uuid": "26b8c393-aa4d-4e59-a960-54246728bd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619347, "uuid": "1ecf2130-fcb8-4439-a893-56493eb68491", "value": "0ddae47b33abab8019d29f1a7aa1a849.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02707743-9483-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645605094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645605094, "uuid": "1e36d894-36e4-4ede-acaf-4eb36ba1c78d", "comment": "Malware payload (Loki)", "value": "73359f2ff74816c845c2c6ec61ec1842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645605094, "uuid": "b133e6c0-8c89-4d3e-962a-2e5d7f751a73", "comment": "Malware payload (Loki)", "value": "d2e8a0bbcdd8de777ab3121862fe095200a2d4eda052ead71ccf2ece74c5706d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645605094, "uuid": "e490d3ef-7a9b-4777-91cd-9102ae1761e7", "comment": "Malware payload (Loki)", "value": "91cfbf263c53d20805a1d85734060c33487380e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645605094, "uuid": "549c1b6e-9374-4a62-affa-b31b4b4e3591", "comment": "Malware payload (Loki)", "value": "2179d46091e7779d6f77a0dd5edb085aa92dc153eb25ce0541174798336340026b4cb7b37dada013c84e3a3812fb7fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645605094, "uuid": "2e0f6c54-2ade-4d3e-8269-dc6204119c53", "value": "T1DF25399C365072EFC85BC972CAA81C64EA60747B930FD243A01716EDAE4D99BCF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645605094, "uuid": "911e4571-0b08-45f0-9eb7-c65d88ac0f17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645605094, "uuid": "f96aa1d8-348f-45c8-92d2-f2d2a5be1267", "value": "12288:bHbQCO/x7G6EyFWzm6QIIlCWoaZzqQOKm2G8Azf8iXiGEhOgKTzwoAQzt6bao13f:bbfO/vE0WBQIVWpZKKNMzfZXahOL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645605094, "uuid": "6844eecc-5b60-4fca-85a0-c7150307dae4", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645605094, "uuid": "aa36db7f-3d1e-4d15-8e90-82ffbc91e381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645605094, "uuid": "1daeeb93-6246-4052-b161-0f51ff74adb7", "value": "PI SXDG21040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed074cb-94a1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645618402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618402, "uuid": "b09aebb0-c4ee-4d22-8551-43f3ba4dd246", "comment": "Malware payload (RedLineStealer)", "value": "7500145b56d23056aee4ebde92aa30b8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618402, "uuid": "9819fdc6-dc3a-4b72-8fa9-d2781982cf4f", "comment": "Malware payload (RedLineStealer)", "value": "d340898f14aaa9f884b022b4be1b849eae4be5e275432348dc6bcb1fa09e28cb", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618402, "uuid": "dcd43762-eae5-4f54-907d-58a03b1b4396", "comment": "Malware payload (RedLineStealer)", "value": "6bf95c7e51a68f24cabee20184f9423ff8a9cff2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618402, "uuid": "e9fbfd28-ab25-4251-81bc-4d3ab3faee59", "comment": "Malware payload (RedLineStealer)", "value": "44b00f9fa988cc1211499fec45f0b40c8c0d1738d1ee1a87d68e9f528d8e68ac1cc1b122d3cd64d49ba4ca887b0914c1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618402, "uuid": "9372372e-7519-4804-8190-fadaa3d9f280", "value": "T117C47E57F7DBF6B0E6BE827A86F1851C52B774620260A78F664072886D23392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618402, "uuid": "49cd9273-66f0-47a3-9646-7389e5071902", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618402, "uuid": "cead9b10-0a18-4cfb-b9e5-3c764cbc23f9", "value": "12288:Un/zDvGHAykH8vLW/4+8bzbBSreMdjBY4ZyrE7K3yl8PeVooA/AB2LEJZxfAQPUG:2zbGHAzHKjX14BY4ZyrE7K3yl8PeVooz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618402, "uuid": "85f1b4b9-aab1-4162-9d44-c4e0dfb94151", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618402, "uuid": "8c919802-b4d3-4da8-acaa-a49a5c24ea1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618402, "uuid": "485dd502-c54d-4b34-9d81-8f64eae4c713", "value": "Scan Payment list 64.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe6cd95-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645611317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611317, "uuid": "f44f77ed-8f85-49a7-ae48-78b68fb36ae8", "comment": "Malware payload (Smoke Loader)", "value": "5caed85490c42e22950fd11494b2b75e", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611317, "uuid": "e67ffc6a-db8c-4492-8b44-2c85ed536c45", "comment": "Malware payload (Smoke Loader)", "value": "d35463be16cad8283234c6a78996d6667899f260049ae103f4c46050d9c1312d", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611317, "uuid": "01411e79-e62b-4dbd-b258-a21eced4bad6", "comment": "Malware payload (Smoke Loader)", "value": "4f2620b95655a0cba485d05b91709424fa5e715e", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611317, "uuid": "f1f479e6-f120-4fe5-a41b-638eaf66ec33", "comment": "Malware payload (Smoke Loader)", "value": "a21e04ca226d9e2d54e530c58f542817b15a4ca80401290330c061cc3b7fbe12683e452ff09efe3db162fb22160749ad", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611317, "uuid": "5adb36a1-1fcb-44a3-83b3-29bec708af5c", "value": "T1D66412F9317AD5DED05F98F19C9920A20271DE04CDF7900F255CB2A2A4BDA83FA9B119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611317, "uuid": "7f459e8f-d7de-4ddc-8b5a-4c9019868ac9", "value": "6144:zmpe8Rwz4XUSUOl6DgrUV9K+xz+14TSDEp88jP8g9WWbqY1:zmpe+XUbPgrUf2TKlblFbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611317, "uuid": "4805b607-b36a-4e05-b045-5fedeead4ef2", "value": 311976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611317, "uuid": "2eb041dc-48a3-44da-83ed-f964c15ec5ab", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611317, "uuid": "4d25bf33-9740-4edc-9b0e-d01e3b2a8fab", "value": "MegaPaymentAdvice0023022022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094dde53-949e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645616702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616702, "uuid": "5edd4a0a-ab4e-40ff-a3a7-a71119db6b89", "comment": "Malware payload (Heodo)", "value": "e37a14e7c8540513035184f0d9d33d5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616702, "uuid": "a0198a1c-e3cc-45a2-a78f-c3c7807196ef", "comment": "Malware payload (Heodo)", "value": "d35e533d083f63aa10afeffc1ff189a1d6cfdf7095532a09c32834d5678c7933", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616702, "uuid": "c8f139dd-5006-48ee-a429-0ffc63ccef2d", "comment": "Malware payload (Heodo)", "value": "9edc757600531350f9a33e2b06d82c290f6148ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616702, "uuid": "8b574a8c-8147-4a83-92d8-85a0c4ea8ee6", "comment": "Malware payload (Heodo)", "value": "dafc7d8e418a66e4ec6835e24cccdff37eb36a0af7717f03390c74fecbc1fff99ed173c5a112c150aa28938ebbb3f27e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616702, "uuid": "e70bce3d-6d05-4295-a3cb-f88865d27ec1", "value": "T14135BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616702, "uuid": "a4980a0b-5e84-4e94-8fa0-91b201c4675c", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616702, "uuid": "9c00fb28-3976-4029-911c-f12795689f26", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/YTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/YTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616702, "uuid": "b50a2b2f-2f0c-4f58-a203-b3bd7e8e2d20", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616702, "uuid": "3113666a-9b36-4de6-898f-16b5bd894432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616702, "uuid": "cd1cc794-992b-4348-a648-ced0fdc7554e", "value": "e37a14e7c8540513035184f0d9d33d5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fa683b-94f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645655557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "e4e4f5a2-77d3-42ae-80c8-29eb666b247f", "comment": "Malware payload (Heodo)", "value": "92081c75d6a769a647ab92bdd129e520", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "bbb96f08-b346-45da-981e-8f3168cd4c0b", "comment": "Malware payload (Heodo)", "value": "d38a2f0890814e745e9c2f5ebc00ba9c241f7affce6c465151394eeba7d9a63b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "978fde1c-bf31-43d4-a10d-c05a291e22d4", "comment": "Malware payload (Heodo)", "value": "2876a3d1ef4afba9f7d0056d3d057a85fc2f327e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655557, "uuid": "ec4413cf-ae7c-4058-8987-ac8936e03324", "comment": "Malware payload (Heodo)", "value": "3fab9987195079bd081572077b0157066721c809a9998d63a4eaf65433f2dd91313009bdf73d618172b3e92da82f0ccc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "1b6a5f66-f81a-4907-8361-4f3e18539c37", "value": "T1E2E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "42cc7f0f-5911-4c61-8498-daa0da4674bb", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "3c1c003e-79bd-47be-a8dd-9e5a0114ceb0", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKKe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKKLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645655557, "uuid": "630356f6-d3e3-49c5-baa9-f199b96b95aa", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645655557, "uuid": "f2575152-0d73-4ada-a11e-fcdfb5452d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655557, "uuid": "52b36e14-deb3-4df4-b64b-53d9f32ed590", "value": "emotet_exe_e4_d38a2f0890814e745e9c2f5ebc00ba9c241f7affce6c465151394eeba7d9a63b_2022-02-23__223232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c2803c-94ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628799, "uuid": "7abc42b7-2039-4e7c-a872-0ac9b09aea4c", "comment": "Malware payload (Heodo)", "value": "e2c84ffa3404526093b9c676796c7a52", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628799, "uuid": "3ddc4e6f-b73e-4067-81e9-703b0daaf411", "comment": "Malware payload (Heodo)", "value": "d3b2558b3567dbffd0e50b5decb499f42cfeb1dd9602ea56cc4bda6d3019f3d7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628799, "uuid": "4b844c48-3e1d-4c39-b403-ee48cfeec753", "comment": "Malware payload (Heodo)", "value": "4e7f38a97b2855f901f144dcb20586f61a52dc0c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628799, "uuid": "f5d4cde1-8cf2-4906-9148-1db63e450719", "comment": "Malware payload (Heodo)", "value": "249111d5bb156c6f2adf0397761dda9b04764e328ac41646d825b2dd2e65093a681ff18894db4ba1aa1c89ace46e433d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 8728", "colour": "#84D730", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628799, "uuid": "a250c8d7-92c1-459f-aedb-bfdd3401fb61", "value": "T18735BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628799, "uuid": "3dbcc6fd-67a8-4b14-9407-42f3aac746dc", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628799, "uuid": "5de03e9f-fdca-4ff7-b863-4953757f8104", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/mTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/mTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628799, "uuid": "4f8de216-1998-42fd-a29c-8909d615aee5", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628799, "uuid": "cd6d6d54-9052-4fad-89e0-8493fdef87d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628799, "uuid": "cff8ca9e-b017-4ddc-9d56-64957fee5ca7", "value": "41ZDs1cYpg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4354e6-94a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645617812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617812, "uuid": "2448a618-de48-4a3d-9419-56f142986169", "comment": "Malware payload (Formbook)", "value": "f1687f3be4be9e1f09ffb4c6800e8d3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617812, "uuid": "810d58f4-0622-46a1-8fca-0e6d1c2b8957", "comment": "Malware payload (Formbook)", "value": "d3c632c33688b9d7ae817a7932ddb1a48dbaad0410a681304c6c88211a020fdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617812, "uuid": "e45fd53e-ab53-438a-bfaa-2a2304ea4f7b", "comment": "Malware payload (Formbook)", "value": "0c23e3d068b01968b0a6ba2d30be95c2f01fd3fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617812, "uuid": "38d4b865-4b27-4617-942c-a1fde87ff844", "comment": "Malware payload (Formbook)", "value": "677f056913591fb10e678a45eebeaf5ad07c2eb71a64ef2e231a6826c551cf80628ffd53b9d1653ed0884edb77191cd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617812, "uuid": "e384a283-7eff-48d9-9c70-c96b1a22eccd", "value": "T1CEE48D62E5E18832E06B157C6C0E5658F9297DF0392CE84A6FE43F483E35649391FE93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617812, "uuid": "f4cc75b5-c59b-4bb1-b2d7-5585901eeaf4", "value": "9a208a82f2ac1ed3524405196188a65f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617812, "uuid": "c31322e9-6cf4-43a1-9fa3-3e87de03314c", "value": "12288:wqPCYSx1alrmI6WvcmOEgJCegF63A5WSS2x3pxjsf:wqaVIiI6WvcykBzw5WSd3/j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645617812, "uuid": "773ca695-cfd7-4f1b-bbfd-f519e0f015c0", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645617812, "uuid": "b3eaa7e1-601f-43ea-8070-68d4b73aa3ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617812, "uuid": "0c6ba8c0-c849-4ea7-8f0e-3677e2169985", "value": "Satin Alma Siparisi listesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5762040b-94be-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackCat)", "timestamp": 1645630577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630577, "uuid": "ea72057d-0bd0-452f-a634-be0773b54b4a", "comment": "Malware payload (BlackCat)", "value": "8413137bf3054105396fd8eeadeba72f", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630577, "uuid": "f5709839-e54e-4225-84b4-622c109b7226", "comment": "Malware payload (BlackCat)", "value": "d3fd49f8f42fa571209af568a65119433e114bb66da21eda12b96a16b5ebfe21", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630577, "uuid": "1a65295e-c4a5-48ee-899e-274895220c45", "comment": "Malware payload (BlackCat)", "value": "27e1ff8d0f0886e2d98ac77ba913e811a2e92e9f", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630577, "uuid": "5b6a14a9-5b39-441c-bf85-2f1310e8789e", "comment": "Malware payload (BlackCat)", "value": "7983135c49761178782b99e53d13e5987307489a4e05d9fec821cfbe8dd25e56c8f8c3924f740987d22e18d861b6933d", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630577, "uuid": "8d5c3db3-7c82-4cb6-a934-c9b6d15936ec", "value": "T173E59E46FA4356ADCB971570305EB33AE63A491C602D9FA3E7E89D30FF2E71019C8619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630577, "uuid": "fd3080a1-1aea-4845-8fbe-53f2424ac033", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630577, "uuid": "71d66507-3f82-456f-948b-89da14c2bdce", "value": "49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4NE/RgaJ2w1M6:rAnCs8pVblGyNM+l4UxUc1BhFyvww1M6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630577, "uuid": "e091ed15-5bda-4ee9-a5bc-0bb6152a63d6", "value": 3068939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630577, "uuid": "64045832-6a14-4370-aaad-cb475a404cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630577, "uuid": "915b74f9-2445-4d01-8ac1-92b66c7cc653", "value": "d3fd49f8f42fa571209af568a65119433e114bb66da21eda12b96a16b5ebfe21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550b48d6-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1645630143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630143, "uuid": "dacdb1ee-c1d9-4347-99cb-c07164ae9bce", "comment": "Malware payload (STRRAT)", "value": "42460167408beede7780df26c8113dcd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630143, "uuid": "8cef0b9d-e54f-460e-8375-0f9b4ba42249", "comment": "Malware payload (STRRAT)", "value": "d45fd76f5d116880a79b778fb22513e9c7c44cf7d70e476828639f8d7fd36949", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630143, "uuid": "dfc7610a-a092-480f-b12b-af308737c377", "comment": "Malware payload (STRRAT)", "value": "790b2df2d8e9716e93f4a7662b38134a3cad2e3b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630143, "uuid": "a8238dee-bbf2-4007-8696-c9ec28dab715", "comment": "Malware payload (STRRAT)", "value": "d014e2b0922acf65a65a568ad36b340b1b0ffed253520fb3dea31167e2b1a68cb173ef6c7fd56c813c4d9e02c113dbd9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630143, "uuid": "188a129e-695b-4cda-84b1-1ddc068491a5", "value": "T16693CF2F38BBC369D107583291698533FA4D4698D54E611B22FC0852BE30C7EAF176EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630143, "uuid": "d3a6c423-dbcf-4718-b556-b57f5a3da52f", "value": "1536:Um/n1AfMP1d9Qx1+jKkcVJnGSooD02pLi+j9TlXRhe5lqHGvWvxjpGHrEmQ:UmSfMP1TQejUGnoI29i+xTk5ljv/LED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630143, "uuid": "f7358c9b-918a-4137-a776-afec37cb2128", "value": 90103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630143, "uuid": "18ec1165-c605-40bb-83db-3b8907af5a2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630143, "uuid": "a47329fd-9aa4-4069-9c21-30186a202a53", "value": "JUSTIFICANTES PAGO .jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b73aa45-949e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645616705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616705, "uuid": "d15cc646-3324-4fff-b9b7-a7b672b5bdd5", "comment": "Malware payload (Heodo)", "value": "fde0fd3a5fb7b0ac12fae7140ca91e26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616705, "uuid": "872d58fd-218b-45e5-9bd1-999ad2e01788", "comment": "Malware payload (Heodo)", "value": "d465cde7be89fe60b78f8d51abc022ec616d179f862d79207e414829b0e68708", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616705, "uuid": "df32c991-6a27-4a85-9620-261262bc7a02", "comment": "Malware payload (Heodo)", "value": "6f1b90bca3580237182f6df2d254db8da4a1b1e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645616705, "uuid": "d6563178-349d-4fb8-98b6-8a3f297d760a", "comment": "Malware payload (Heodo)", "value": "a9db606b37d0d64427df926d2beb13115c7fce75ed07875b8f3b93459a34e424571c6c13f8cd8d317be4f379a6c7f186", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616705, "uuid": "d5fc5b9a-4efb-4379-8ee7-570a2df323f9", "value": "T15F35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616705, "uuid": "ab51bdce-5a48-4438-8ddf-cc3ed14a6e00", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616705, "uuid": "d16d2d11-81ba-4553-b0c9-d92fe538dc1e", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/zTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/zTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645616705, "uuid": "b079c086-08a0-4da7-8111-596474672bc5", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645616705, "uuid": "97c44b7f-8fed-4397-9b16-de7d86ed2f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645616705, "uuid": "8edb0134-1df9-4fd0-ae81-1b981c0453d1", "value": "fde0fd3a5fb7b0ac12fae7140ca91e26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9b6012-947c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645602106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602106, "uuid": "a631cb30-c2cd-4479-ac11-b29363ee8486", "comment": "Malware payload (Formbook)", "value": "a38a8b416b954df908edda30b2a0643a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602106, "uuid": "37fa012d-9120-4bef-87ed-a424ae7bf8c0", "comment": "Malware payload (Formbook)", "value": "d47e799b60887d2f6520b62955e7595cb6f42774633c88c2024be1d0a48e650f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602106, "uuid": "22a11ff5-6ea3-4d60-99f4-cfe15d039439", "comment": "Malware payload (Formbook)", "value": "5296fb33982f5045493f4744e72bf478b65c8dfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602106, "uuid": "1782d4c9-fd7a-46ca-bc72-76498ca87bf6", "comment": "Malware payload (Formbook)", "value": "77d9548ccccdf36df8a07fa53feb568042aec6dc7400b0d3a5af2848b7a5ccb7ee6b6219c9d383c993c147a3f4661e46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602106, "uuid": "3107268a-6b6b-4128-bb06-6bfdeb6a5233", "value": "T1FD05CF4839AB0F3DF1718BB21DC5ECA4FA98FB371C08B37D78116696C6A1B448942677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602106, "uuid": "dc3f8c82-d322-4147-81bb-238803eccf90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602106, "uuid": "05512e6e-d256-4ef7-82d5-710e18d8159c", "value": "24576:JUK777777777777HPYbfRSCybDYnEE0l94Z7:j777777777777g0QnEhl94Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645602106, "uuid": "7c71f60e-3801-4814-9fac-711db5c2076a", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645602106, "uuid": "c7e62244-a27e-4160-b95b-86bc15abca44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602106, "uuid": "2012954b-202d-49a5-bfd5-97ad1f2d3092", "value": "Order file No 3028802232022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae39fa3-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619094, "uuid": "668d15cf-0f2a-4ade-9f57-3c84279baff5", "comment": "Malware payload", "value": "ba35660c493e5eb77a66a64b71aad145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619094, "uuid": "2e3999e5-9be3-4fb6-a43e-e86c659d136c", "comment": "Malware payload", "value": "d4ddaaba947c59b188039e2ad0d2326028b5e909fe2a902571b826259d83b420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619094, "uuid": "19f8ffb5-e747-4e29-bf59-a3dd31682252", "comment": "Malware payload", "value": "c8157349aac631a72e96f8b16dc172cd34e7611c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619094, "uuid": "38340518-8b5a-404f-bdb5-4d05f51416b5", "comment": "Malware payload", "value": "0ac3d1094b91e64555b44f144ff09db221be3ba4a5b2cb4d4673950f7d02af829357813a66adf8c11e92bdcd8ca66f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619094, "uuid": "b43174e7-dfcc-4514-8744-11910fbf4ae7", "value": "T100163386F5F38577CB12CEFC6466509CA46E0F104B338536A5D3189FACC96BC930A76A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619094, "uuid": "e0869afa-99e1-470f-acdd-437dd4288ef5", "value": "98304:J0deaIj6VibW3TxhLZXmWO9/idyp3+++XN8paVT5aPwcTx:J0dHIj6Qb6hLFOgGpvTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619094, "uuid": "301bdad2-8245-46b8-8d99-15d707553c9c", "value": 4192159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619094, "uuid": "4c933706-d1d5-43bd-94c6-af4dcb9bbe27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619094, "uuid": "5c3d7f3e-fef6-4923-9c3c-452728c581dd", "value": "ba35660c493e5eb77a66a64b71aad145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152c8287-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645624453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624453, "uuid": "cfcb4dd6-18e2-4f0b-b301-75b15ae309e1", "comment": "Malware payload (Loki)", "value": "5a6a2e05b27a10cfe476f5d10e5d2380", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624453, "uuid": "1ed328b4-d26d-4c68-8284-fd182cf84b13", "comment": "Malware payload (Loki)", "value": "d4fdf2cac4afc367dbb08d890df7755b7a8c3aa2fbb22c8131e0de67d550b872", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624453, "uuid": "6b69dca0-1ed6-4351-85e1-7ef837139ccb", "comment": "Malware payload (Loki)", "value": "22e9162797b3f3778c09e601ebcb5d0b15fd1aca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624453, "uuid": "145a5cf8-59a3-435c-a9e3-80f4a5468e8a", "comment": "Malware payload (Loki)", "value": "b0176e7baeac491c62a4911ab0403145781386371661b94f3a8d70b6e7c0e4c8a8faee846cb5032c7540e1eabddd0127", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624453, "uuid": "c2ebf77e-3474-4355-b88a-f3e752d1b184", "value": "T1875423DB25D0BC7BD65162702F7F22A1EB72AB141E3422CB5FA4EFE75153283E608191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624453, "uuid": "8c51f34a-a983-4eed-8444-fabf5e3bea8f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624453, "uuid": "72ec435e-3745-4393-a588-929e308f1464", "value": "6144:TxD7mBTajh1hHtzmbrBewjJXcDjez7BUp6ypPp:Ms1V8MwVXeimoOPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624453, "uuid": "92dd9fb6-e013-4030-a045-aaa1b9299110", "value": 287753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624453, "uuid": "31e5891f-389a-47bf-bc9e-248ee9a23e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624453, "uuid": "a395e363-0fbe-4454-9c80-01aec9c00af2", "value": "5a6a2e05b27a10cfe476f5d10e5d2380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe80c795-94af-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645624415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624415, "uuid": "2f474b94-abf3-4108-aebb-ce09eb4c3e4a", "comment": "Malware payload (Heodo)", "value": "3730ab43f28ba873c0bd95558bf03c9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624415, "uuid": "ad50c0b6-5ddf-4fb4-95be-13fe2a1366ea", "comment": "Malware payload (Heodo)", "value": "d55d45fd5c17be657b85dca9797d811172bdb539df07b2ebb5682eeffaaa03c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624415, "uuid": "31d9a0e9-a750-4fce-b08a-8d0be09c44d3", "comment": "Malware payload (Heodo)", "value": "003871e9df1edf95984dbc8f81717774259f0796", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624415, "uuid": "db428298-eb43-46d3-8c72-3d7a4099deb6", "comment": "Malware payload (Heodo)", "value": "9d64b01e57b942f3f0d47e46b8b87cb380cf9cf27ba6ddcdb312b1e12fff5b2cdf1567a48a52add29bdb3d69ae0a33f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624415, "uuid": "ee8afcb7-8000-4359-9e7d-cc7cf0456889", "value": "T13035BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624415, "uuid": "6df2d7ee-09b6-4675-a20a-7c8fa1b7bc93", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624415, "uuid": "2ba2ab42-52c8-4c32-b949-86f02ead3117", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/eTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/eTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624415, "uuid": "a0648a83-39cb-4b88-9ca0-f6dfc84d808d", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624415, "uuid": "2eedb89a-baff-4256-8e12-8ed2131f6b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624415, "uuid": "26a52f46-cbc7-4247-aee3-371813383bb3", "value": "3730ab43f28ba873c0bd95558bf03c9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462b7415-949c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645615945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615945, "uuid": "355a9c19-43ad-4779-98da-a3bcd010b61b", "comment": "Malware payload (AgentTesla)", "value": "0fb2c099e59995dd2910a865d524aadc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615945, "uuid": "b9996846-3d69-4c29-bad6-9f77b21dd84b", "comment": "Malware payload (AgentTesla)", "value": "d58ec7c9e50892c9fbc74eb7490958996f99b422ca470d2a89eb81ed15676991", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615945, "uuid": "eb15f15f-d481-455d-a76d-188c93ce8b85", "comment": "Malware payload (AgentTesla)", "value": "4fc2e7025490add6c832d870748001f4c2ab902d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615945, "uuid": "399960eb-5b56-4f35-8382-5a9e72366375", "comment": "Malware payload (AgentTesla)", "value": "52cc62192703bcca4bfde0fdf17f47d665ea73f6576617fc5d878101de5ea027f80fd58c5d7af28d8319ff2dd0924de5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615945, "uuid": "a34b2cad-8ea6-48bd-8d75-0e4e61e700e4", "value": "T14314025CE2E022D2E5E09F7B9AD64EED6037DE96DF748D5C61C2B63019F402E42E221D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615945, "uuid": "930b8c85-4255-43e2-86fc-62769ffd783e", "value": "3072:NuO3fwdKBr4SYeW9aI+kHdJyP46UwQjmQrnTYaov/VW+JoSINhs/J9EH//:FLBr479aTkHdJyg6gmlv/VySS6XEf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615945, "uuid": "392cc153-41b7-4685-9e95-3fcb4a1bcb8c", "value": 191528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615945, "uuid": "2766205c-534b-4855-988e-f0a784024416", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615945, "uuid": "3f0f7fa8-e069-4a5d-9d59-b6ce653e4ba5", "value": "order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ace86f-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645623702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623702, "uuid": "da2c55a4-949d-47f1-9ba9-86b6bbf62057", "comment": "Malware payload (Heodo)", "value": "02421688c98c70c4d69fb9c4dbe987ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623702, "uuid": "eb66d60d-73ea-4462-a5a4-5de63517c601", "comment": "Malware payload (Heodo)", "value": "d63da4a5dd7575b12887b797ce3e72e764be5ed2edf327706bafe20de3c0a8d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623702, "uuid": "1555ca3c-dd9a-4593-b956-898525542f69", "comment": "Malware payload (Heodo)", "value": "e16883e766acb1a7b9494bacbd15d233f10235e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623702, "uuid": "c6e06b75-0954-454f-8ea6-17b5d138e7c6", "comment": "Malware payload (Heodo)", "value": "8a02f7cc4b0a8e606fd104e84f256f7f31deda6ca281c7042a459a4455a523804aa5a6cf5726646704a382ac3576e76e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623702, "uuid": "6eb02a3c-c5d7-4cbe-b7b9-a3b5b1bfb1c2", "value": "T1E035AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623702, "uuid": "82021266-b4d2-47f5-9c5a-cc31f609c85d", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623702, "uuid": "2bb80d1b-2d9f-4773-b5ff-74e44d714c34", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNgTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNgT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623702, "uuid": "c5359ea0-be63-428d-9ab4-efbc353379a1", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623702, "uuid": "f5623ad8-c954-4f64-b395-0409db8d0712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623702, "uuid": "61796696-3acf-4c1b-a906-d137acec027c", "value": "02421688c98c70c4d69fb9c4dbe987ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47654fc3-94ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645623678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623678, "uuid": "b1eb5526-4bc7-4600-9bad-c234401601a3", "comment": "Malware payload (Formbook)", "value": "4c077d585b030adc7bd7c38cfb5a5963", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623678, "uuid": "25b571a7-2d09-4df6-af69-fd18a71d4c1d", "comment": "Malware payload (Formbook)", "value": "d6b928a4292c14dee552691c4955bdff07d038470ec1419c88a4018fb06bd399", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623678, "uuid": "636f374f-8aee-4915-a981-f8263f00d2dc", "comment": "Malware payload (Formbook)", "value": "dbd1be724d0778b4e5871b48827d6d6772a60bcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623678, "uuid": "0f623b28-b058-41c3-ab98-d5012dbc7bea", "comment": "Malware payload (Formbook)", "value": "0994d4695376db042256df21cce261c07259d6989f2f5613481edbedecaf6a1d27354b7ccee390d96636b4c048e1ef13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623678, "uuid": "3136b47d-c1e9-4a6b-926d-681a374c51e6", "value": "T13DF4121167F88984F4BF9BF959B180505339BB23D077E32E4A8060ED1D72B94C6AB367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623678, "uuid": "8dc93e87-5923-4fa7-8f93-c406caa55395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623678, "uuid": "fd59a60b-2558-4de5-b87b-7ffe22e7f70a", "value": "12288:S2NdWXmfaIzzGEhovdMj4OwMW3H9iOe2kTp4iswEKcYILF7vrRNGlVa:SXXP/dgw5pe2kTp4Jw7cBLQlVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623678, "uuid": "8de0ad9f-ff84-4b4e-aa9f-fbc549f143c5", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623678, "uuid": "7b5f9402-a25c-4c9d-ba6c-cb214ed922aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623678, "uuid": "7f6b311b-3d0b-4a44-b8b9-c9105d5a6983", "value": "4c077d585b030adc7bd7c38cfb5a5963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587cd877-94af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645624136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624136, "uuid": "6a417714-d36a-4f6b-b8b9-0940a335f77b", "comment": "Malware payload", "value": "c05f39c01d0a631eb235c2dc1e2e3f7b", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624136, "uuid": "41861665-7cd9-4405-9916-2040967f4660", "comment": "Malware payload", "value": "d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624136, "uuid": "32226038-9e22-4b41-a935-f7e4e9cd6283", "comment": "Malware payload", "value": "16b001deb9dac8d3e1620329bad18e22634580af", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624136, "uuid": "44d8376b-6f38-4c11-a7fb-c97efc2ea8a6", "comment": "Malware payload", "value": "875f38bb2c931a11c29ecc1ae61f83cd5eea0bb225faf6eaacccb60ab77132def24a3266c8d8bc83964506baea742596", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xenomorph", "colour": "#70E18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624136, "uuid": "b62a31f6-565a-4042-a1ff-641723ac7a16", "value": "T1429533D67C62E008ECBBED384107E35479AE4B45E229960698CD799DBF01CC0DAD9F78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624136, "uuid": "a90b046b-b324-4bbc-86cf-04a0bf6e8535", "value": "49152:oZKnMLkhYWxbr9UKWI4W9q8c+o8WM/fhcQw1qsxCHcUTi6Yq:oZKnM4hFxbr32W0so8HfhG1qsxgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624136, "uuid": "18b44fde-e423-47d2-9f22-990d37e6f1d7", "value": 2008527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624136, "uuid": "dc9e5065-b1fc-4248-8317-9b8d615361c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624136, "uuid": "88edfaac-705f-4824-916f-aefcc8bf9441", "value": "d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1938dc15-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645624459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624459, "uuid": "456c3468-ca93-4915-af0e-3a7db56d62d8", "comment": "Malware payload (Loki)", "value": "25b3648ee8c45977c767b51eb90ea79a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624459, "uuid": "e0fca30b-e634-4ca1-adaa-d0a12488a0b7", "comment": "Malware payload (Loki)", "value": "d6e4c5da653439df49206ee4e58b1238735d1b92353a3d38ded94bf78807c474", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624459, "uuid": "5aedf23b-b56e-414d-8d81-2e99baf08a0b", "comment": "Malware payload (Loki)", "value": "18105e390c2fa762e356ae4e2db1b8124b661c6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624459, "uuid": "6c889159-f689-4ced-b091-50f758966b01", "comment": "Malware payload (Loki)", "value": "06ac734587ab14b491ac1852fe59d5e830e01f50853caaafad205a4590b9656fccf1e0d693be8ef881ac79e951905db4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624459, "uuid": "2c469759-a0fd-4692-a7c8-220e91a183f8", "value": "T11D64232863C1E8AFE7A60432B77729A3D7FDE69307D1529B63500F274C3C465D62960B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624459, "uuid": "347eac48-7f76-4887-918d-bba799123ac5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624459, "uuid": "1196461e-03db-45cd-9eed-dad9b495f31c", "value": "6144:TxDlJdv6BhuE4WTWMbrX4DTQSLwGDy8Y2A9sET7W1OMLhG13dJe:xIBhuE4c4HQSDDy2AacSGfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624459, "uuid": "745a1bab-48ea-4326-ad52-836cf63b7446", "value": 314165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624459, "uuid": "0c162156-79f4-4828-9dd0-f82eca83eb04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624459, "uuid": "bb9c5cb9-3ad8-408d-ac54-e4e9ad92547c", "value": "25b3648ee8c45977c767b51eb90ea79a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb4c872-94a1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645618404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618404, "uuid": "38e82c7b-b2d8-4be6-9765-779265bbf170", "comment": "Malware payload (RedLineStealer)", "value": "4ec6690cda3dea826ac307b3d2461f0e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618404, "uuid": "2034d963-5e97-44ef-9f1a-1f5bb162d634", "comment": "Malware payload (RedLineStealer)", "value": "d724eef097700915a348d42dcfa0255e3edb3c644cf8740fd052cddab2c81b54", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618404, "uuid": "fc0c8539-b38f-4a46-90e2-f7a77af08bef", "comment": "Malware payload (RedLineStealer)", "value": "6fe22be92274b39ae3f9d8038839eac9c998c156", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618404, "uuid": "f5b3e939-24b3-4108-96b8-bafcfb9a3925", "comment": "Malware payload (RedLineStealer)", "value": "01d6d3c9cc22926b0a4694d47c77886a9e5b58643d7dae394cf51c780d0341b6b4a253d2e52eab5ceee84f69930fc125", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618404, "uuid": "6589dedc-afcb-4494-a4bf-536d9ba42ddd", "value": "T12DD46D55BECA6EA1EFBF47B78361DA2D1126736D03A0A6CF6603019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618404, "uuid": "fe6514f4-cb19-4705-b018-d42b5abd32e0", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618404, "uuid": "cce86e8e-b9b1-47e2-aa79-b667ebdbc56f", "value": "12288:Q0Ws7IMsR4yVld8bzbBSrexBY4ZyrE7K3yl8PeVooA/AB2LEJZxfAQPUqj7:Q0bskX1BBY4ZyrE7K3yl8PeVooA/AB2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618404, "uuid": "c0980b60-2f7e-4dbc-989e-133cdfb6cdce", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618404, "uuid": "22a29404-1c5c-4728-b446-5bfccdc65ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618404, "uuid": "4ace1a8a-f2cc-431e-b728-1191047d8998", "value": "Scan Payment 32.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36afe527-94f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645655433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655433, "uuid": "c321e338-466c-4af7-b1a0-6635a0fccddb", "comment": "Malware payload (Heodo)", "value": "99c0396eca84d39690141175e57b7b69", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655433, "uuid": "5960ee07-59a3-48f8-b603-83ea4c6f86e4", "comment": "Malware payload (Heodo)", "value": "d74bf346fd5a67d1424a922cf84fe9a8fb251c9d88c94f5410e4e86babfcccfa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655433, "uuid": "9f2f4215-d11f-412f-9997-6427ba396b83", "comment": "Malware payload (Heodo)", "value": "abf616a9199149de14074bb16d3c5f08f1759984", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655433, "uuid": "43255ea8-c955-4c13-ab6c-91a1acf5494e", "comment": "Malware payload (Heodo)", "value": "db19317169cd964a90f5b2f566136c1ee4ce766dd754fce31d19eb94a447236377e5435e87f78f834eb98086cf651515", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655433, "uuid": "332c9ee8-e05b-4538-a5d3-f6b8bae5c1aa", "value": "T10CE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655433, "uuid": "264ca711-897d-4c8c-b147-fb717b3115d6", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655433, "uuid": "0b6378c1-a1ac-4bf9-80d2-8762b69b985e", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA07hR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfZPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645655433, "uuid": "7337ae47-8563-49e5-97c7-826eb928e173", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645655433, "uuid": "dcaf05c2-9093-4b62-be27-e06bddc17d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655433, "uuid": "63625f14-8829-4211-bd9b-acec95b840ec", "value": "emotet_exe_e5_d74bf346fd5a67d1424a922cf84fe9a8fb251c9d88c94f5410e4e86babfcccfa_2022-02-23__223027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde995d1-949a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645615314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615314, "uuid": "34efb0f8-5cfb-48b1-b38f-2d5c2a647589", "comment": "Malware payload (Heodo)", "value": "0c9d46599900a60d350387973c35ab63", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615314, "uuid": "5dfbdbd5-1515-4d23-a312-6b4302bbf46c", "comment": "Malware payload (Heodo)", "value": "d767a2f9b76e16ef3538505a8780e3d031479af927581082628edfc8749d7d9c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615314, "uuid": "4dae8b35-39e4-4347-a484-07fa24cd6843", "comment": "Malware payload (Heodo)", "value": "1ad002a8abe465d62861d9d03447ff13718a57c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615314, "uuid": "f77f6c90-5a64-4616-a2f9-44b4efe38253", "comment": "Malware payload (Heodo)", "value": "adc2f5f9b2958128cd358c4729600059d7777aec473330e6868a85356e6bec5266b1eba0dc97e63da0f5ec9d13148fc0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615314, "uuid": "3769ddf7-8f9b-44a5-ac39-40377d5bbab9", "value": "T12C35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615314, "uuid": "47391e5a-6c70-4316-a271-86eec73eb964", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615314, "uuid": "2cca0eff-18bf-47a9-aad2-df2af47dbb51", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/6TewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/6TeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615314, "uuid": "7a8f8d3a-709a-4ab3-95a9-0938c45c902b", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615314, "uuid": "2a76d91a-614c-44d8-b811-038c8b19d492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615314, "uuid": "ec1ea308-4f4b-426d-803b-8515bccc93de", "value": "itcWdrMgV.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d8ff15-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645611373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611373, "uuid": "11dd7a7a-6659-4104-938d-a350424d3f3b", "comment": "Malware payload (Loki)", "value": "12e2360f2d1d2ce3364680d289bb142c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611373, "uuid": "193fe152-4c6f-4269-9b1e-31a456301d3f", "comment": "Malware payload (Loki)", "value": "d82ca79be91091b651cb0a1042f36ee3163c6705d1cc9b3c3c9fe6604885ada9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611373, "uuid": "49957e1e-289b-4a77-9f0f-025bc9f861b3", "comment": "Malware payload (Loki)", "value": "ddde13f6236be88a3415b901340acde2ab7ccc6e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611373, "uuid": "3b941598-bbd0-47bf-99f2-44ae83e5aa22", "comment": "Malware payload (Loki)", "value": "34a894aefc0161fedf5f62e0489f03d43a6c375fafd8034ea677492a44699b55de3f1eb645bb0ef2cac3d600a072b4dd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611373, "uuid": "42fc90b3-1502-40bf-93e4-a572ba79aec2", "value": "T1C21412B3B6165509C53038B04F9998F49D4AEC37CA8CE6FF6264FB7867B1192249EF10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611373, "uuid": "a1b13133-b220-465c-af13-fba1d8b405cd", "value": "3072:9THkrmWiEXQRpxH7xLevRFVta5lBfsG0YrW+qKBy5TCwKnnAwRGIaQqfRwyA3ATr:VWRHQDOFVta5nE3YrW+sCwKnA+GIa/2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611373, "uuid": "7ad669ae-6368-4f20-805f-a319008e11da", "value": 190360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611373, "uuid": "88b47eb9-1fe8-48ce-a211-b5e1e995b906", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611373, "uuid": "0cedd161-a45a-496b-afee-d36547156205", "value": "Shipping Docs.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe71675-9493-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645612042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645612042, "uuid": "ab10fdba-5184-46d9-ac2d-c0d43e385b18", "comment": "Malware payload (Formbook)", "value": "197dd0edaa8b54d0d603e91784c69a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645612042, "uuid": "4a7ee7e1-a94f-4b17-8643-61efb6becd0f", "comment": "Malware payload (Formbook)", "value": "d8842d4c311c9e35f77ef0ee038f34061be70a55b38f949e0624d32e5a6a4212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645612042, "uuid": "c58490bb-01bc-4c6c-9183-6639d017c82d", "comment": "Malware payload (Formbook)", "value": "449a9453eac70fca50a13f372732971372259a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645612042, "uuid": "f81f9469-4e79-4ad4-811b-131e4acc8b4b", "comment": "Malware payload (Formbook)", "value": "85efe4044c5f5d6e045374c881a073dae0dd88b5f419e7f318ccfe6e6d539874702d7e8bca921937929b59db0fa857e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645612042, "uuid": "48fb4748-9997-4a55-83de-0347be5d8775", "value": "T151E49E12F2E19433D01B15399D1A6694E8257EF0393CE447AFE43F487B39A88B51EE93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645612042, "uuid": "059fec4a-a9a2-4e58-8d4c-fe962d852768", "value": "9a208a82f2ac1ed3524405196188a65f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645612042, "uuid": "08bcbb7d-b5f1-49ed-b927-bc72364fbeb1", "value": "12288:wqPCYSx1alrmI6WvcmOEgJCegF63A5WfS2x3pxjsf:wqaVIiI6WvcykBzw5Wfd3/j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645612042, "uuid": "d4ee793e-4b14-48ee-8c86-d0abf1f03fbd", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645612042, "uuid": "132fa3d6-38b1-4bc4-9023-b9e8bcf71b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645612042, "uuid": "02702f9c-b47b-4aa5-9431-b296b7cde464", "value": "PO_#YBIC3892900183902328_Evaluated Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf941f8-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645619070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619070, "uuid": "6b8b9c8e-d804-4f48-b952-d0e796cd970a", "comment": "Malware payload (SilentBuilder)", "value": "223d7d3678094abd2983bb137b12d0c0", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619070, "uuid": "ab7d935b-ed7e-4a4b-937a-318e2f56faa3", "comment": "Malware payload (SilentBuilder)", "value": "d8ab97ca075cb8a5345ec92ad43686a8d80be43da7ea1936c8e512e86be48214", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619070, "uuid": "b192155e-4406-4172-b706-0906531fbde8", "comment": "Malware payload (SilentBuilder)", "value": "3519005267a2dfe11064edcbfc2bb6c48e0216b0", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619070, "uuid": "77306a37-4424-40d8-829b-7d6cc0de555a", "comment": "Malware payload (SilentBuilder)", "value": "b7d968dda438317d403e25591efd58bd06e774aeb3d7391174e2816e7d725fc1184f12aee7c42f6ec09496290996fd3c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619070, "uuid": "5247fad7-a72e-46d9-8025-2b42fbdde0bf", "value": "T1DB34C04AB84A5C35FD45C3BC89C387CD84E5AD3A6B5B815E4D28332396B3EF425025EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619070, "uuid": "42503683-045a-46a8-965e-ee1c8f1e45fa", "value": "6144:DKpbdrHYrMue8q7QPX+5xtFEdi8/dg/ThvsiKIjvl5fd1Xh8rsoX/w/04:ghEXs5fXR8rsNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619070, "uuid": "350f2265-e36c-41f9-893d-3f69924771be", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619070, "uuid": "129af0e7-c16d-41b2-ba3a-c005ca889674", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619070, "uuid": "aa61944b-4c35-4ff9-a498-cd75019f422f", "value": "Liste 2302.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac3aba4-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574963, "uuid": "68c5677c-d142-4f9c-9284-35e2f0a188e2", "comment": "Malware payload (Heodo)", "value": "9eeedc37ec0a2f01ebeee7cfda73fa91", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574963, "uuid": "19ac9b6b-568a-4966-abe2-d1f742bbbcc8", "comment": "Malware payload (Heodo)", "value": "d8abc890273c6558fb62a08bfa013f6c49b0b342eabcfc1b10888fbc26879414", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574963, "uuid": "f847c385-4a47-4631-bd05-b073d8000ad6", "comment": "Malware payload (Heodo)", "value": "a977888303073e0d57c49806a6426da2fd982508", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574963, "uuid": "eab8f7d2-6d95-448c-964f-1dae88d3c4c1", "comment": "Malware payload (Heodo)", "value": "936341ef6156bf6d873ba43a9d41627146122be1755ae7ebb667e1f0574eadc9edc678d3a52df70daba924b16f3d6a2b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574963, "uuid": "9953e8df-78b8-4d55-83b1-61a3ebbd2658", "value": "T1B7B42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574963, "uuid": "0d1c494b-656e-4f07-a995-950974484753", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574963, "uuid": "e64cefb2-b60d-43ae-afc6-64c83aa616ce", "value": "12288:IOzyEtBX2ZHq79+H6/G5YgvmgZDa6A9TU:lnmZKR+hYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574963, "uuid": "9a6fa1ab-67a5-4f37-9846-ce39361e9a4d", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574963, "uuid": "acfc7752-4336-43d6-b209-b5bdb7dead99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574963, "uuid": "e98006c7-d8a0-423e-b025-f665ecaf4054", "value": "emotet_exe_e4_d8abc890273c6558fb62a08bfa013f6c49b0b342eabcfc1b10888fbc26879414_2022-02-23__000918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4484936c-9489-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645607782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607782, "uuid": "806dafe1-bfac-4512-a36a-76c62c55bacc", "comment": "Malware payload (Heodo)", "value": "4032aba1cf573f205bdee88e5634fa69", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607782, "uuid": "e041385c-8758-4397-924f-b15bc9aada5b", "comment": "Malware payload (Heodo)", "value": "d8e9b1c11bc1fe177b51306d6a4e69ff66cadc07d5c9df6fc316a2c368c5f635", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607782, "uuid": "141885ab-adc8-46fe-979d-45722c33b8a6", "comment": "Malware payload (Heodo)", "value": "91f0e7f4be79082a033a8aaf30eadc055a2a7638", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607782, "uuid": "50d3989c-1f9d-461e-b827-09aac65e0fa5", "comment": "Malware payload (Heodo)", "value": "cb1b1aa4015ba22e2ebfe52c7bc98dcf45328e9097b0e4c51c86b8735e134cc75a14a3604017f2e9f911367ffbeb2d48", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607782, "uuid": "97f9b6b9-d505-4fed-9a1f-874a96af4d8c", "value": "T1CF35AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607782, "uuid": "ba9b781f-3587-496f-80b8-21db17e54d17", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607782, "uuid": "aba40768-17d3-4c66-bbe5-177969470a32", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdN9TEMJdHuN3LafJSrN:hDQhXJ1Td2CpdN9T/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645607782, "uuid": "3ffd44fa-3c4e-43a0-a212-fa71471d86d0", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645607782, "uuid": "90302fe0-73b4-48f2-8679-b9f7053cfc75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607782, "uuid": "d9a4c64e-20d4-41f8-972c-0bb276cfc804", "value": "msdhxoIAbdYNeBnO4FHgskABMpGCGtFf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b80cff-94a6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645620296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620296, "uuid": "014043b2-3389-4649-b0b6-c0d6a6139161", "comment": "Malware payload (SilentBuilder)", "value": "7580186f36cca348041fd2e55ecd5dfe", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620296, "uuid": "6f447e99-7f32-4702-bb9e-da52a4643abc", "comment": "Malware payload (SilentBuilder)", "value": "d934ef2b76b31171accfda7380d00113e3120ee203a2abd5c866743e21b10cdc", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620296, "uuid": "8cc69b93-7009-4128-ad40-939ba8d22cf6", "comment": "Malware payload (SilentBuilder)", "value": "72b231832fe9c40c9af2f4ef97dc164b22299ef5", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645620296, "uuid": "14c29ae9-a4db-4dce-8161-1bb8df9d9da0", "comment": "Malware payload (SilentBuilder)", "value": "7321291b96027341298e88ffd3a1e60b74c90b49032a04aa6dd33327a02be75aee6a92d0efc83f290be1db330dc17aba", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620296, "uuid": "9caded2a-c132-48cd-8321-cd832b8d7bcf", "value": "T18653184ABA4A991DE51587358CE747E96732FC104FAB0B873A49F3257FF99D04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620296, "uuid": "0eeb62bd-9848-4fe3-9d6e-785ef65f7b9f", "value": "1536:sp+KpbdrHYrMue8q7QPX+5xtekEdi8/dgJ5+4kKF3XOCmGanK8oWIa:sIKpbdrHYrMue8q7QPX+5xtekEdi8/df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645620296, "uuid": "30174e9e-29d1-4a67-8419-0a63b377be63", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645620296, "uuid": "2e7def4e-924e-4f43-bffd-76e4eb7f311c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645620296, "uuid": "eb62a2a6-e915-4bb5-9246-252b8f39c08a", "value": "doc_68818032.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acf1856-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619335, "uuid": "22887db5-7644-4a99-b914-d75816561ac9", "comment": "Malware payload", "value": "d0a9e8136108b9dd6673994bdc9c4e93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619335, "uuid": "8c6b91dd-48ed-4fec-b0cf-a3d57deb7366", "comment": "Malware payload", "value": "d95f3b43c792e6d683feea0ccfc62a57f75cb4f52e420c53b1243993c475f6dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619335, "uuid": "859c41e1-e6b4-496c-bf18-a1e086087a51", "comment": "Malware payload", "value": "2a40c407dc3c3157e12b81d496f5ab81ef19902a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619335, "uuid": "27c67e65-f955-4842-a680-7492d3b43545", "comment": "Malware payload", "value": "53366b67739bc6ed6433f23676d47ad8c135ffe82939d99916f9e0f5b35844a5159202bd42ec9037c2b16854a6e85d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619335, "uuid": "dfae0e82-1cfa-4f49-bbaf-cad9858a12c5", "value": "T15EF39D23F188E835D455CA3D4022A5B001E23D582AA25779BCE979CADCB32CF1767F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619335, "uuid": "8daba69c-0f29-468a-9669-88dd816ccfe4", "value": "1536:3WiyNgm2MhyzWAJ4GzL7CyQskUzF5z/36Q6Q421DFYSS+BBre5PyxZqLYpc:3Wum2MgTz/36bIy+jrAyxwL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619335, "uuid": "dc00af66-f48a-4686-8e2e-d0a7d852f465", "value": 157502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619335, "uuid": "f5c52abe-2282-459b-a233-32388063ed02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619335, "uuid": "a87d5c8e-bd89-4cd9-8f45-8a6b25e32348", "value": "d0a9e8136108b9dd6673994bdc9c4e93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcabd62-94b7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645627605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627605, "uuid": "8809fabd-5685-4888-8a4b-798c47e74a14", "comment": "Malware payload (SilentBuilder)", "value": "0857246b26b5b70303d714e16693939c", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627605, "uuid": "88d968f9-af06-492a-b345-821f7b2c4463", "comment": "Malware payload (SilentBuilder)", "value": "da12a3cbac2f145d75567f74aaf896fdf0c0f352116fa0c8559404391ef69121", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627605, "uuid": "cf67962c-b89c-4b47-adb0-615a3dc229d1", "comment": "Malware payload (SilentBuilder)", "value": "7fbfea8710d512f9c82aed8cb9bcee795d35137e", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645627605, "uuid": "e34f4446-2949-435b-84d9-a495a37f0685", "comment": "Malware payload (SilentBuilder)", "value": "2272905f3603cd5945efb7f243ec8cbe760f28dd48a20ee388e7a2d325409b0411454e262975ac42524f2dcd14579d0f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627605, "uuid": "265867f0-5a0b-4b6a-b756-bd4b9ab13663", "value": "T14C44C04AB84A5C35FD45C3BC8983C7CD84E5AD3A6B5B815E4D28332396B3EF416025EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627605, "uuid": "82e71202-eb39-4853-b50f-5cbd855c5786", "value": "6144:EKpbdrHYrMue8q7QPX+5xtFEdi8/dgUThvsiKIjvl5fd1Xh8rsoX/w/0b:UhEXs5fXR8rsNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645627605, "uuid": "51fc42dd-ecff-44a0-9107-16c29f36e328", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645627605, "uuid": "c50b342c-cd6d-44ea-824e-f2b295a5ac15", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645627605, "uuid": "f70d3908-050d-45fc-aaea-83566834763b", "value": "J 23022022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c42244-948f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645610581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610581, "uuid": "7b6cb17b-d72c-4c74-b6e7-f3476097bcca", "comment": "Malware payload", "value": "e27fe0911faeca5f95f71437d0eaa05f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610581, "uuid": "14bd7e1d-fb11-4dec-af91-225bb41cf36f", "comment": "Malware payload", "value": "dbf971932abb38cfa4d965ccc62158a5ab1d94d55022d5d32a91da2379936742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610581, "uuid": "5e153c79-2e67-44d5-85f6-72144331281e", "comment": "Malware payload", "value": "f3da202c65b85b31bdd66ea2c488cd83256373a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610581, "uuid": "c5cb4368-9427-4aed-863e-cfc9178d26ba", "comment": "Malware payload", "value": "a02ecdf3f977260887485ef3ea6c12012ac825d5a0cd9e03428361c3e7cffd747164b6efff5ac4333e78e9d74119522a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610581, "uuid": "4b93e95e-7bb1-4eb0-a3a7-a2b5527c3994", "value": "T12A2733CE73C65C63DF15A936BC9268820B20D823A5F9496EC7ED29ECC534C44E6677C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610581, "uuid": "2783a32f-7305-4af4-872e-6f60208d29f6", "value": "b7eaacd233d458d6ca29b3fc8a12daba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610581, "uuid": "614ce6c7-6646-47c5-9d70-42d4c98eb611", "value": "393216:bpm4KrncGT18NnNaKNZqouQ9ibrDDFlTigOZQw65uEq5ztULc5KxyGnor:UBLcnxNpNiXjTY65uT5ztGAKxyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610581, "uuid": "1b335838-8b76-4408-8c18-4166eb2daa2c", "value": 20943954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610581, "uuid": "aa17519b-3d56-47bc-8ff3-cf816a1ae4b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610581, "uuid": "3d2598d9-a790-4e21-b1e9-471068122877", "value": "e27fe0911faeca5f95f71437d0eaa05f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d131579-949c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645615930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615930, "uuid": "98d5518f-a1e3-4770-87dc-591067d51389", "comment": "Malware payload (AgentTesla)", "value": "fb103379e1eeb894ff9e8b10c4ba5f12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615930, "uuid": "aa216ecc-ffe0-4a03-9345-c673c4397208", "comment": "Malware payload (AgentTesla)", "value": "dc259d65f9609cd9adf24a00aee3888ce83ad9dc83a413e4dfdca36783295913", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615930, "uuid": "507b82f2-3a6f-4c21-a6c9-2dca03e7594f", "comment": "Malware payload (AgentTesla)", "value": "25ec54d2b9d341e2d17152b2aa217455cb7d258d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615930, "uuid": "b1121577-e6dd-4355-a12c-db5c1a38cf90", "comment": "Malware payload (AgentTesla)", "value": "064932343d50f5c2e5a510eb46a76d7b90d3490b69c3d869b436169a39d603fded4f363edc162dfb898b22531d7883a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615930, "uuid": "e64e823d-271e-47e0-945b-9f8b8a4ae9a4", "value": "T171141238B9627862F9A526F513FFC4896737EFC5020C73C620A0BBC516F76926C56742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615930, "uuid": "e0a300f1-0ca6-4b1b-a70e-2e76c0b07137", "value": "3072:AjZ7ThFv0NLmQ4OiBoivRwwuk3szgETF4hho6V9AVlBoYMb9N/PGh7aQlu4x:KZThFMP47vOwruVofV9EqYrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615930, "uuid": "5cce70e4-fe42-470c-8e1e-c5e0a0474b78", "value": 191800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615930, "uuid": "c19a83f1-c146-4b01-8fec-c5713de54b81", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615930, "uuid": "cc0679f5-9477-4b3a-b3c3-5d0a433b669d", "value": "PO # 0001290001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1408dd38-94d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645642060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642060, "uuid": "24dc08df-9f82-44f3-9088-c881b233447a", "comment": "Malware payload (Heodo)", "value": "e9a090c3e7fa6ee41ea14c8d4aab4831", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642060, "uuid": "d9a1ca99-b990-49d3-8916-6b52f21827b7", "comment": "Malware payload (Heodo)", "value": "dc49d6e40fccf772947d3040ff19675784cf44448968003536eeaf8a08421853", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642060, "uuid": "3f9e6e3a-7f6d-46d7-bd8c-d6c467662af8", "comment": "Malware payload (Heodo)", "value": "3f884f764d0242c33df9ebb4a1b5d1159d07a877", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645642060, "uuid": "a3678e84-2fe0-43df-a39e-4208ea4b2c5e", "comment": "Malware payload (Heodo)", "value": "66be8733741803427b43cfbefcad60b3ad7a5e87b4143152ff266d83697f41fb22d029ca0df34a2ee8ae4f7367f69cb6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642060, "uuid": "07ad191a-6ee1-480a-b7a1-7da3fa4ac575", "value": "T1E793022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642060, "uuid": "d1c71363-efeb-4670-8772-92a6110ad506", "value": "1536:/QBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:WDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645642060, "uuid": "a21b1f50-6ebe-49fd-9deb-f08762ba5cca", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645642060, "uuid": "d1abf4d5-6200-4cb5-a4ab-3537450776f6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645642060, "uuid": "fb179124-4d2a-478a-b8a0-7a6bc7e83088", "value": "OPAST GROUP LLC.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd48273f-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574967, "uuid": "5523f8f8-a213-4594-aa7d-e312a99e92be", "comment": "Malware payload (Heodo)", "value": "0d5e10a9b6003b6407eb45ec6574e4fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574967, "uuid": "3f4c8908-58f6-40cf-813d-f02895eac100", "comment": "Malware payload (Heodo)", "value": "dc720f43c775c280a127428e6828866184267599b06d4a15f957facd67648837", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574967, "uuid": "68682203-0c25-4c1f-a729-087fda0e6b68", "comment": "Malware payload (Heodo)", "value": "13f23f140379c621a6e524ea188611eefe8d5659", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574967, "uuid": "414867e7-48c0-47a1-b498-03e94c53dada", "comment": "Malware payload (Heodo)", "value": "acd3374834e57db6507504b0463cfaf332641e66e696b883d40ac1079b6670652209b33a5d702da205b8f2631a9a1ba6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574967, "uuid": "bbe17606-3a0b-4e9f-9ac3-b2a75063d45d", "value": "T1C6B42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574967, "uuid": "594c3b48-aefc-45bb-841a-84c5b4ac6a86", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574967, "uuid": "3357c9b9-9617-4074-b6e0-736f461090e7", "value": "12288:IOzyEtBX2ZHq79+a6/G5YgvmgZDa6A9TU:lnmZKR+KYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574967, "uuid": "85dd1538-998e-404b-a8c5-305d544e94b8", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574967, "uuid": "3cd1d9bb-91fc-4b34-936d-049a06107a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574967, "uuid": "ce3fdb6d-c3c8-4f3d-9f26-00afe41bb714", "value": "emotet_exe_e4_dc720f43c775c280a127428e6828866184267599b06d4a15f957facd67648837_2022-02-23__000921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa7cd32-94af-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645624408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624408, "uuid": "faccfd60-23c3-4f93-99d8-9427aebbe6b9", "comment": "Malware payload (AgentTesla)", "value": "120186a516bd1f6bd92352bd5c02de59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624408, "uuid": "0a98ec26-706a-4ce6-9fe9-6a33b9cddc2c", "comment": "Malware payload (AgentTesla)", "value": "dca28929ce24a9444358c655e67c7e4cd2b994e9d1821de5e744a407cc4cb0bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624408, "uuid": "1288194e-7c9e-485e-92d5-585f0bb6c79d", "comment": "Malware payload (AgentTesla)", "value": "8b66592789419e9017e955d8e50f3421f389fd44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624408, "uuid": "3531ac94-2bd4-4568-a613-028bd07ec698", "comment": "Malware payload (AgentTesla)", "value": "ddd8ba32e6c78bad9091b93fb0b3cc2ee3bd6623810bf57d4148e0c5aed0ff291ed04ccfe83caf3e4598ecb735514e7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624408, "uuid": "ed3773c5-5f0b-43cf-831a-27355a76e93a", "value": "T1F1F4AE766BC86F94F07D93349030905053F1B94BDB22CB9DBD9641CD0E32F86ABA6762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624408, "uuid": "97c96b03-91f1-409e-a2d3-58b5b19ae89d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624408, "uuid": "303b3471-f299-43e6-914a-f4b143b1f075", "value": "12288:r7MGr/YelfvctNWNirqEnVO3722TFXUyVKiBlI7PPVLFaKj:3fr+aAGEnyKiW9LFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624408, "uuid": "f3ff22c9-2c22-41f2-8791-7269c78b2299", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624408, "uuid": "7c86a578-7a7d-4431-8ac0-921b89ecdabe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624408, "uuid": "a64f8703-276b-4f32-a84e-26057ca82d53", "value": "120186a516bd1f6bd92352bd5c02de59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c00bcb7-9477-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645600010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600010, "uuid": "a66c75d9-d37e-4efe-b607-d60d33769f98", "comment": "Malware payload (Heodo)", "value": "7020099efee0a79ab80d134392241379", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600010, "uuid": "5ee34212-3993-46d9-a14c-96e77b2f4faf", "comment": "Malware payload (Heodo)", "value": "ddde04715bb76c5b2b6a2b0db3b1d70c736604360078d2341af7461913d614cc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600010, "uuid": "c0862764-7f05-4bd0-8cf6-9f2020d3b2be", "comment": "Malware payload (Heodo)", "value": "fc5f8ea3208dc5588b2addd95051ea825f576e92", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645600010, "uuid": "f786f0de-2bd6-436f-957f-791ccac51117", "comment": "Malware payload (Heodo)", "value": "f8d296fe9763922e647e36064e4781cedbc6d8a854a76d4d3ac9475106828fdcfc3d2d4fd0ad3fbd33474f1350226b33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600010, "uuid": "a3cabb97-0e31-4e0d-aed4-7d94901f4b7b", "value": "T12BE43A9B368F717CF177013E23A0F740E5DABE0A9F7C28EB5A5A608C8771D154A29D42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600010, "uuid": "1476381b-def3-467a-a722-4e4cf66e4c6d", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600010, "uuid": "d11651f7-9ac5-41db-97da-2568985ea67a", "value": "6144:x4Kvac/hrq/4wi/fRBe06AHAc8/giQECzcvIpxUIVZFoEXlbeZhp4giti0:x4d4wwRBe01Ht8/giQECp3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645600010, "uuid": "a31475eb-0f33-46cf-8698-85ed143604c9", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645600010, "uuid": "d52e0e01-6ea4-4862-a3d5-461a600645d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645600010, "uuid": "e6fe30df-064e-4570-b305-18ceb0f6d710", "value": "emotet_exe_e4_8ef2fe74bf7270737a8cf1a4788ee9c9be351c34a26f23360561401df6316d63_2022-02-23__070645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658ecb4d-94d3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645639620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639620, "uuid": "f711432f-0f8b-4858-906d-1f2fcfc275a8", "comment": "Malware payload (RedLineStealer)", "value": "efedde2c40b752d4dfdb73431364bd28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639620, "uuid": "f37effd2-bfbf-4c40-acfc-54850870dc4a", "comment": "Malware payload (RedLineStealer)", "value": "de1ae614a8a926b44989594d2bd4615c14700e575662d7c4689789d6b228f79e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639620, "uuid": "c41284dd-e230-4f9f-b1b9-9d81bfc54da6", "comment": "Malware payload (RedLineStealer)", "value": "410226597057c4fa0507032977e4d19f3b209025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645639620, "uuid": "0980d24f-79ac-4775-b463-a1046840415b", "comment": "Malware payload (RedLineStealer)", "value": "763c9319e38a3a4ba02f9aead1188a8a382a9c25bb91b07f4a3e6858c1072e21bb5709d1d03eec49f07a229bea575230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639620, "uuid": "2ad83a72-844d-4d15-b944-9ab45eb40c42", "value": "T1E2245B35B750F426E4E20039A4DE87F5553D7A303B64C8EBB7A54F2A5A716C29230B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639620, "uuid": "eced3cca-359c-466c-933a-3ecb24689e5a", "value": "35cc2ab6d0964b2714ef2cb777d98843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639620, "uuid": "f9d19191-c4ea-47a0-90c2-cde9992185ed", "value": "6144:jszRnLTfPrXNl7tBLr8yWFs0zBuwM8/H15:jshLNlHLrcFLuwM8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645639620, "uuid": "a40f00ca-3ff0-4afb-8315-4b9f6e72c9a6", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645639620, "uuid": "1db56a2c-7194-40ee-8be9-9cdb50644aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645639620, "uuid": "d14af70d-2f32-49bf-8229-28e7eafd4b2b", "value": "efedde2c40b752d4dfdb73431364bd28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83f3855-9490-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645610956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610956, "uuid": "57041161-294c-4aaa-8382-c0a32dcc7c56", "comment": "Malware payload (Formbook)", "value": "89f1dddfc98c29126be2d9d34549de39", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610956, "uuid": "7cae2df0-3a31-484e-9064-cbd1d94434a1", "comment": "Malware payload (Formbook)", "value": "defb7130d8372ad6f0790bc790c581691a84877a2adfc9e790e5c51c413a825b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610956, "uuid": "d1f11ae1-c873-48c6-900b-e295d5392ebc", "comment": "Malware payload (Formbook)", "value": "9dc877dcad99866788f9cffb3a09247938d3880a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610956, "uuid": "8266d0ad-323a-4d22-ad25-a0143ff9f93e", "comment": "Malware payload (Formbook)", "value": "b36b0fcd6dd207dd705657a75ddabf130cbb1f42f44ec9889ce44f86546079984315f93e01b1c32a92370e3cca8e0b0a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610956, "uuid": "250af223-f576-4fb7-949c-3e757e27b826", "value": "T12D14126D69D2CE6DFC3042B2B484A26F00B7CC11A60ADC3DA2C57BE7A5F750058BDD65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610956, "uuid": "a3dac42a-6891-4f4e-a296-d462988871af", "value": "3072:s5LKKIi4rB3yRkQR/K2naTG30AJH4DBsUv36CNuK0hLhHgvXeoOarQqft5sFqqEo:2LK9is2iCaTG30KH4DWc36/AOakQagqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610956, "uuid": "392ec206-fd9e-44a7-8c05-c97dc4c5a9ff", "value": 191176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610956, "uuid": "a175c0f0-5e3e-4c84-981f-6569aeb16804", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610956, "uuid": "c1ae52a7-8bb5-4c11-abf2-8a2f9119da98", "value": "20220223_STALMA SA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17952ef1-94ad-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645623168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623168, "uuid": "7104eadf-7e70-4385-ac55-8daf61e9f2b1", "comment": "Malware payload (AgentTesla)", "value": "7bf50b77962c4d1f146907b96a52e535", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623168, "uuid": "a81a92b5-4322-452e-b9cd-f8ba0450c4df", "comment": "Malware payload (AgentTesla)", "value": "df8090270c1119ee5ca9ed4e5dcf7d5d9919bdfdcfb4d7648ec4303ee04c17f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623168, "uuid": "f6a8bc72-1052-44cf-b4c8-1166fd64597b", "comment": "Malware payload (AgentTesla)", "value": "cd0204b9dd9962315ebfe5547979efd0a5b0c0e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623168, "uuid": "c19e706d-0556-495d-a06c-4dbc3e24e22a", "comment": "Malware payload (AgentTesla)", "value": "39ea935d7f679e321ed2cd360b2ec15aff7e62eb502fd21439ec5837d90502db628a5ada2156b039abb126c1e67545e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623168, "uuid": "13a03bd2-32cb-4ddc-ac87-49c59b666bb7", "value": "T176F23B2AAE788110C919C73BAF8391FC06B5BF50DC12951BA4D5BF4EB9FAB808531635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623168, "uuid": "cf79cdde-825b-4879-958d-d8ba7b71f4a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623168, "uuid": "a5798f17-80e4-433f-861f-67a9b0333c2f", "value": "384:6M+2LnoXOmk+VHUCQurb9g2yldWvJsv+D4UM6Rf4Mwwwwwwwwwwwwwwwwwwwwwwz:A2LnoXOmD9nZbmv8JspUJ8Qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623168, "uuid": "ef9b9204-8a04-4e7f-bae2-6854172f9a09", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623168, "uuid": "60f63bc8-ac9b-4c58-a90c-c65f484c91b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623168, "uuid": "1a613e5e-c5d5-4d93-b75a-157f6bca2c5e", "value": "521103123003xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de89939-94a9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645621515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621515, "uuid": "69c83cd9-f438-4213-9abc-418583c2e143", "comment": "Malware payload (Loki)", "value": "2c9174c021707f5b0f1e51f168a397a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621515, "uuid": "a7d60ba5-33b0-4b11-a8fb-58d350a02dd6", "comment": "Malware payload (Loki)", "value": "dfbd0454d410a8eecba728864c1c9c04144ddef2c009ef719d6ff72ca2dac701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621515, "uuid": "39463a51-5f3e-4054-8b9e-a70c77b35838", "comment": "Malware payload (Loki)", "value": "473dddd781a3c9e3e45ae9b563a70756534e8a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645621515, "uuid": "4b34f329-2954-4233-ad0b-be1fe82b06d4", "comment": "Malware payload (Loki)", "value": "a0f7670f43ebc9d59b54b129c4bc22f4b0b7d8917ce4b881d3613fa3dca74cf5d7629267742ec17029a3cddb35949af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621515, "uuid": "3cddcef1-2755-44c7-9d97-28a00f054386", "value": "T16854127930D4126BD64A49706CE7E32AF7F6E51067E6210F2F386FDC6930258AE052A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621515, "uuid": "94660770-9b2c-44fe-af1f-f05040f9da0a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621515, "uuid": "529b2336-6b88-4964-8349-fe52de98d357", "value": "6144:TxD+me0P6bknhnKZbAMthZY0IyyT6oPqNMNIHxKY1s:le0P6b0JKbAIntIyoHP+MNIHxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645621515, "uuid": "fc4d47fb-9543-4849-b08e-1b584cdfaec1", "value": 285800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645621515, "uuid": "477cd3b2-013e-49e1-8bb9-917d1a655d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645621515, "uuid": "697c6672-4d36-46a6-b3dd-defe8f04c474", "value": "2c9174c021707f5b0f1e51f168a397a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc26c91-9497-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645613887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613887, "uuid": "265d8a03-4304-4f13-a4d9-351030bbd222", "comment": "Malware payload (AgentTesla)", "value": "35e9a5c223136bd50a0eadc1bddfa3d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613887, "uuid": "4ca39b3a-183b-4304-b660-7b7dd9239b8f", "comment": "Malware payload (AgentTesla)", "value": "e0886a1b048ef2f277eaf130382af5f5fc55e10fd6ded22c26eff24464bb5102", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613887, "uuid": "89987b9a-8942-4d57-873f-936b80d018cd", "comment": "Malware payload (AgentTesla)", "value": "c10d91700c304c1951423214a8dd7ef81ebcdcf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613887, "uuid": "de7eb5c7-d81d-4bf7-bbb7-73b4151a7efd", "comment": "Malware payload (AgentTesla)", "value": "afe45a7249fd907d11c7e53f79788ebdd68239bcbebd01c018cc29ac8c08d596aa3c4180d095454060ca8dc35eb7f8a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613887, "uuid": "99dc7e9e-0d76-4765-8807-a4f4b16696de", "value": "T19D734A52E6A70523C5694A32E0C346830771630F25E3CAAB6ACD315A4B5F3C72697FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613887, "uuid": "c5c0f0e1-d96a-4a86-ac1e-7b3b87c9d2f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613887, "uuid": "bb60a32e-83b8-4829-a89e-82bb8ea5a088", "value": "1536:fbHYm93RnRnIzK4qrH6Mpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrX1+Q:f/dRnRIzKfpga/eHUTQQQQQQkdBft/2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645613887, "uuid": "c63de106-7cd5-4584-95fb-f3a62e4102f9", "value": 74440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645613887, "uuid": "37be683a-1f15-4908-8b62-2a3ac01b77b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613887, "uuid": "ee7c26c1-fc10-4ca1-a1f2-98863d018a6b", "value": "tf-49403-377484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75158208-9456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645585959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585959, "uuid": "5a436ff2-fcc8-44e0-a124-2a26669bfa01", "comment": "Malware payload", "value": "b4ed5273634bbb616566409596279f77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585959, "uuid": "e3420d47-e82c-439c-9874-c0cc688b587c", "comment": "Malware payload", "value": "e0cfca52c2dd70feda295eca74e2d12a286b82108fb8979f4af4c4425332632c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585959, "uuid": "84b9d5b3-e0b8-48f8-a5da-c66e28f437ff", "comment": "Malware payload", "value": "3d931df033424a4bf191c876bb236ece72fe249f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645585959, "uuid": "a260d7df-99f7-43be-ada8-36e2ec6f1091", "comment": "Malware payload", "value": "32ca05978c885f101a44b08fa1145bd170738866c49618acc0737fbf7d6dc97e5a66173048f8c5fa73b682597639bdd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645585959, "uuid": "2e38a461-4b01-493a-a16c-3ad324441fcd", "value": "T1BA8250852E229FECFA7CC63547B74A20A35823D526E1DA84E3ADD9040FB034D565F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645585959, "uuid": "0e3b2070-3f1d-4a0c-89c8-fe1d9421cd28", "value": "384:QLuneH/mK/hhk72GT0cUppG22uoR/kAfQOSxaBHrM:QROKvLPERno3xew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645585959, "uuid": "21a110d2-c330-4d40-b6f2-861a60df0c57", "value": 18224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645585959, "uuid": "7b07483c-b505-4b9c-a766-4ad66bfecb0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645585959, "uuid": "008295e4-fa46-4ec2-a5db-652727bab0be", "value": "b4ed5273634bbb616566409596279f77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13033ca-94fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645657356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657356, "uuid": "fe1292ce-c3e8-44ee-8367-b0d850fdbbce", "comment": "Malware payload (Heodo)", "value": "070a7c77a3f6f677e76f561883db2c6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657356, "uuid": "a3642774-e7ac-4269-9af7-81b6c54bc243", "comment": "Malware payload (Heodo)", "value": "e1842e10e2df612e784a86aea6cd7f6836ddbfd43284ecfbde3503d4c2cd96ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657356, "uuid": "2c0cc75d-65b0-4380-a68d-f3f546fceda2", "comment": "Malware payload (Heodo)", "value": "c670647d1a7ed2b304994dac7432fa791f80faae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657356, "uuid": "b3d91fe6-97b6-4682-ba68-7b32977411ea", "comment": "Malware payload (Heodo)", "value": "f62cfb72ed65ce1e5ce2f0637b8d90111d7ce0cc8ca1931a562b6afcebe447f120ca4cffc1b1ffebbc3c02304e106dfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657356, "uuid": "94879fe9-2eac-42a2-866e-0b14bfa45ddd", "value": "T18DE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657356, "uuid": "bd1749c2-28d1-4581-af71-e945a82bf780", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657356, "uuid": "e8a26af8-5665-41a2-9075-219f79d10b6e", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA07hR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfhPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645657356, "uuid": "df28eaa2-2d53-4f64-9d46-614eeaf3d59f", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645657356, "uuid": "4511bd42-f938-4200-949b-e438668e3532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657356, "uuid": "8a68732b-d986-4346-80ed-6994987597e7", "value": "070a7c77a3f6f677e76f561883db2c6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fed0b4-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645630137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630137, "uuid": "ee67c254-7ec6-4400-98d0-3408503a302e", "comment": "Malware payload (AgentTesla)", "value": "e63344d0a6a4b476f899195915aabfe7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630137, "uuid": "4ff8fc91-9c92-46f2-9e14-1c7214eb7447", "comment": "Malware payload (AgentTesla)", "value": "e230c4b82bc8c591ef3c4c5bccb49baffd3f04230eab9342afa5216ab6fa5d5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630137, "uuid": "9f6f26a1-02ba-4654-993b-d3715a9c5a5c", "comment": "Malware payload (AgentTesla)", "value": "b9d72df241a5c9dcd231df753f65f51207911575", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630137, "uuid": "eb576b2c-46fb-4462-8b34-6df42666a807", "comment": "Malware payload (AgentTesla)", "value": "869b9b882b7acd4b682007b01473a3e02e22e6383fb9c25a7b791c7bdede26f5b0e06013fc0bd6fb7870799f59aca918", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630137, "uuid": "c12c4a7a-1bb7-4548-ac9e-ff01ce84b3d1", "value": "T195C47E57F7DBF6B0E6FE827A86F1851C52B774620260A78F664072886D22392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630137, "uuid": "503ab0d3-8ad9-4077-8c25-c7e8073da041", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630137, "uuid": "7a3f19b1-4a78-40c0-8ef8-cbdcd8917927", "value": "12288:Un/zDvGHAykH8vLW/4+8bzbBSreMdOBY4ZyrE7K3yl8PeVooA/AB2LEJZRuAQPUG:2zbGHAzHKjX1ZBY4ZyrE7K3yl8PeVooY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630137, "uuid": "5f47bd6f-7d78-4e72-8565-f035a33d2d08", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630137, "uuid": "b298cbbc-2003-49fc-a692-a8a41335c902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630137, "uuid": "20c18027-fcab-4049-a699-86085174a929", "value": "Quote.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf550ce-94fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645657351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657351, "uuid": "57bf322c-de70-4dab-a0cd-97367295ce69", "comment": "Malware payload (Heodo)", "value": "b93b8e948476c0f8c62e83e49ba10d24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657351, "uuid": "8b5ec39b-0e8f-4981-9a9f-a3199ec03358", "comment": "Malware payload (Heodo)", "value": "e361bcda1e4a17ba9d0e35b3e6ff66272ebb85f34d78847c8495a4f9a6e1c50a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657351, "uuid": "ca5cbee0-7d25-41ac-917c-556f2ea57fad", "comment": "Malware payload (Heodo)", "value": "0f3adead75a4be5656aa8cc9b30b52188030cdad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645657351, "uuid": "da81ba47-a1d5-4e39-bad9-e6596f68c878", "comment": "Malware payload (Heodo)", "value": "dcba0c0ff0d6201ab24edf72ab8e3aa7525b040e20ee64d9480806f956d0d4ca973fe2498282b38acc6205e9bfb1bde3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657351, "uuid": "8ca72082-5e38-4c3c-abc1-f91f19af472b", "value": "T1FBE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657351, "uuid": "c40e2300-1482-4697-a9a1-a8f786b6f386", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657351, "uuid": "3f66f1ed-c534-49d4-a472-71ff22d01d13", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0VhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfLPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645657351, "uuid": "4081a793-df74-477b-a86e-4d46c279b198", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645657351, "uuid": "2c90e33f-f0ca-46d0-91ed-5771b6472acc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645657351, "uuid": "34dadbdd-5259-4165-b0b2-1e0922d0a688", "value": "b93b8e948476c0f8c62e83e49ba10d24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821dfa36-94e8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645648687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645648687, "uuid": "b8802797-639c-45ab-ab1d-7f7587847562", "comment": "Malware payload (Heodo)", "value": "6bce8ea2de2883073685c3cf3d9e13a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645648687, "uuid": "acb06991-1a54-40a0-928d-15578974492e", "comment": "Malware payload (Heodo)", "value": "e480177c0758a44fb5b561d010f783e2c3acd754dbe66d543888fa4d0ad26c83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645648687, "uuid": "4b7dfd81-2945-4f9c-8d66-97aba00ea35b", "comment": "Malware payload (Heodo)", "value": "3393e91b40d66faddd90198c3810321220280000", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645648687, "uuid": "ce7a5459-6468-4aea-a9b0-257aae3b87e0", "comment": "Malware payload (Heodo)", "value": "bd216c98de8a9a99497d43b538027fd45e5f64a7501e3ae9367c5da4fd3e61097caecf8969eaa0c2f058feec69ce081d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645648687, "uuid": "f45bcbc4-bf36-46c1-a108-5c5f45533e53", "value": "T15635BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645648687, "uuid": "e08a6962-3f25-4124-9699-86d124d175ff", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645648687, "uuid": "42b09189-7a16-4ee4-87c0-a0e695d4eda3", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/8TewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/8TeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645648687, "uuid": "72253099-a357-47fa-9fa8-98f5f10d0e72", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645648687, "uuid": "a282b386-ceec-4afb-b07d-073647f10df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645648687, "uuid": "80e0b60c-90e9-446f-bf8f-f78108ad85a8", "value": "6bce8ea2de2883073685c3cf3d9e13a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220dd5d5-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645624474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624474, "uuid": "bd8e388d-cc91-443e-8a5f-a332a07b4e21", "comment": "Malware payload (Loki)", "value": "ed8fc62ec42f6f25332573319a7c061b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624474, "uuid": "dce4f7cd-b2f2-4d06-a9b4-45b2b15423ef", "comment": "Malware payload (Loki)", "value": "e51b3fe69d13c1e2a81a41f3adfbc319b804daae6dacd0da9caa3b042502f2b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624474, "uuid": "998ecb25-96e7-4a70-8fd5-82425b9411eb", "comment": "Malware payload (Loki)", "value": "1a4a4de5387da8e995e57ad2c18f9a2ec90e500e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624474, "uuid": "24512478-7327-4e7b-9fc4-95adfecaa088", "comment": "Malware payload (Loki)", "value": "83e82d960d53a1c2015023dae5fce0bed2d556b6e2c47e20eb79eb1f3e0ecb9435c72049e7cfa0627162a4c4541f1039", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624474, "uuid": "8d945bfa-10e1-4108-ba09-381f821255eb", "value": "T167549D10ABA0C035F0BB12F8457993BDA53E7AF15B2465CB93E51AEE16386E4DC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624474, "uuid": "9065c6f0-8063-4493-a39e-f69f0169e1f2", "value": "32f2c538eab8007c123c6eaeceead9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624474, "uuid": "235fe0a2-fad6-457d-a1be-aff238973671", "value": "6144:lB80EbNALZKpIxn51bibd66+drFH1InQxacWDSIazn4:Pqb2Lgyxn51bOWpVInKaxEr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624474, "uuid": "0fccb879-0b05-4427-b076-dc64c254d553", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624474, "uuid": "a84c60de-db01-42b4-8d1c-3569dbcac04f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624474, "uuid": "75f504f8-9d6e-4ea4-8ceb-789b7a77b67d", "value": "ed8fc62ec42f6f25332573319a7c061b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13308a43-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645630033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630033, "uuid": "f2dca30d-0d9f-4711-82ca-632ca535fd17", "comment": "Malware payload (Formbook)", "value": "8054e433b9b6d92bb36783f15142f05a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630033, "uuid": "efbff3ca-b28a-4c12-9de5-98a7d445d180", "comment": "Malware payload (Formbook)", "value": "e52254d8c7730c4bbe9110dda0fb110e1a9a7359b1790bfb93796ed663496f46", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630033, "uuid": "19d0777f-d0d5-4a77-9853-13f76fd9ab95", "comment": "Malware payload (Formbook)", "value": "16862ed809890972763506e5e6f2b85592b3dd84", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630033, "uuid": "7295e57d-fba4-40c5-8033-188559831f2a", "comment": "Malware payload (Formbook)", "value": "c9a583fdd4362e9b30e07b2540815e8473aa390c7c23b912ac85ce4c0b0abe7567ec76569012ec425bf9fc4db77fc683", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630033, "uuid": "00471389-13f8-4388-824c-7fba248dffe6", "value": "T16B14028C22D2630AC6A74E78CC287A6D25E6DEE05511A34FB4C63979733901B648F7FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630033, "uuid": "f6bd0f98-d51f-42d5-a9e4-f8f8d85575c8", "value": "3072:XH7jkX0kXR5Hlq1LgW1PoPLVwaVuAnT7WaZ2SMIY1IGqGYEc5Ub7tUYyP9xM:LVOxe7BoP53uqTKavtYNfYF5qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630033, "uuid": "ebdcd484-1a1e-418d-8864-d9e31b750ccb", "value": 191128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630033, "uuid": "b59486bd-8c02-4a8a-94e3-ee65eb4ff9c7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630033, "uuid": "74df628f-a94e-48e0-9b3a-2ef04a68af4e", "value": "Purchase Order SFOWRN5.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ac167b-9462-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645591105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591105, "uuid": "f75affa7-72ba-42ce-b202-2eef3a007788", "comment": "Malware payload (Heodo)", "value": "5aee3d56b92547ae8e7e09db9e65fe9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591105, "uuid": "b14692d1-00ad-4e58-9655-8afbed399e44", "comment": "Malware payload (Heodo)", "value": "e567c20c907e8d6f4f52d0524b4b4f946c16b596308383b3748c80023f3f9d6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591105, "uuid": "6ebf52c7-d2b7-4f14-b2d2-7bf76f65e6c6", "comment": "Malware payload (Heodo)", "value": "62d1aecd08bf302d5e5ef7f5ef25e4e5f476f05d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645591105, "uuid": "0bb25864-066f-4da4-8e22-b1382519c7a6", "comment": "Malware payload (Heodo)", "value": "78e304b8cc6bf7ddff9fafee808f1fcb097cc5c7660e5b57e5583f0acb6710e2d4455f544e06781a3dd8c3ac187cd883", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591105, "uuid": "8add9f5e-a87e-4566-861c-01f68fb5fe18", "value": "T144B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591105, "uuid": "6d4aa3f1-2b28-4207-97ef-4fc7346764e0", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591105, "uuid": "901feca8-30db-4fb1-9617-98f5d76a018f", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wUIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWjzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645591105, "uuid": "5ee0faec-c805-4ed6-a221-10187c2e6eee", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645591105, "uuid": "865356a0-2b08-473c-a575-aa3190331f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645591105, "uuid": "66295b04-4ab0-4a1f-9fb4-8cb38afcdfb6", "value": "5aee3d56b92547ae8e7e09db9e65fe9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e075d062-94c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645633813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633813, "uuid": "dc45314e-65dd-40ab-8720-d7d3f0918a7f", "comment": "Malware payload (Mirai)", "value": "9a28c1c60e3dfe1a75d82015e3f5279a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633813, "uuid": "4cfce25c-f37e-4455-ba6f-580e6d76918d", "comment": "Malware payload (Mirai)", "value": "e72d8b8d35d035c6456837ebf0bdd277bbd3132081dea0d5406ab3465cb7c6ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633813, "uuid": "9664fd8c-7dce-4bb3-b65e-732b407d802a", "comment": "Malware payload (Mirai)", "value": "3fe3700850f11672a14f02fa62b0bef8d81f29f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633813, "uuid": "b50a2e25-1e05-4f4d-9a4c-93fbc7cc923f", "comment": "Malware payload (Mirai)", "value": "d4a4eb2076667751ae05bc8276b19679cf2264bd99587fc6d9c4428cb33ada0c6e5b61996bccd9415f4fefc8a7e3a428", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633813, "uuid": "14438ced-cc61-49e7-97b2-d9dfc8737a1e", "value": "T1B2735CD67401CEBDF58BD6B9B1320A09BC3161014A920B27B7A7FDD379321A9F817D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633813, "uuid": "c0fee344-3978-4fe7-9b60-ea24b91040db", "value": "1536:ZeWaU9S70Fy4SmTfadpb+6b07Zpkg1pszVl1Hs9j8xpEAvSLs5G10guyf9+:cWBTfOfwpJpgMCGsY4yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633813, "uuid": "ff91f82a-a513-4ffe-b107-bbb2d333bd05", "value": 76996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633813, "uuid": "2bfa9dc5-8c3a-4c7e-bbcc-a5af2b3b0518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633813, "uuid": "460ab226-9410-4dc0-8ad7-0acc6fc7f941", "value": "Zeus.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77bc1667-9497-11ec-9275-42010a9c0029", "comment": "Malware payload (LockBit)", "timestamp": 1645613881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613881, "uuid": "cd850f37-4697-4ad9-a434-0390a655c5b8", "comment": "Malware payload (LockBit)", "value": "69a71b0205edb7b13fb5837e910854a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613881, "uuid": "379db814-627c-4159-b86d-67354228ec04", "comment": "Malware payload (LockBit)", "value": "e786673320cd80373f1f1bdd717082d5ea074c4464e2b15874d93dc3cfe35ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613881, "uuid": "c05deaeb-76d6-4c03-8d6e-0c7328954ee7", "comment": "Malware payload (LockBit)", "value": "eafc95227f5695bcb7c41b754772d83d55fe11b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645613881, "uuid": "a7866199-6545-4f17-a4c4-b9c5f3c7a2c6", "comment": "Malware payload (LockBit)", "value": "33313ace886bc6baf391ebcdc6b837cb25620b7f1d12081b9e3af9d9615ee11e559f5fbe1ae22a6706a079a6c92991fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613881, "uuid": "171ad337-50ef-4371-a99c-c914338199b7", "value": "T154253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613881, "uuid": "f535d762-8058-4181-a9bd-12ab2d6f7d45", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613881, "uuid": "39ed1209-3a00-49c1-abc3-36bae739bd1f", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpd+F:Ujrc2So1Ff+B3k796M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645613881, "uuid": "3abfde0d-a44a-4543-a5b7-f4a3fa13158b", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645613881, "uuid": "e0c0b09e-3122-4a5d-aa37-85d0d23a991b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645613881, "uuid": "c1a67046-16ef-4f8c-82e3-93aea4254473", "value": "e786673320cd80373f1f1bdd717082d5ea074c4464e2b15874d93dc3cfe35ee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b9fda3-94b9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645628609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628609, "uuid": "7fe9269a-63f8-4839-b3be-91a48cf25bfb", "comment": "Malware payload (Formbook)", "value": "cf80558eb44d749850aad70fd8237f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628609, "uuid": "6a64848e-0fdf-43f6-bcc6-1c3f18ca6598", "comment": "Malware payload (Formbook)", "value": "e812adcd8f8470a1be64d92dafaebf717db1c45d58fe04a9160d88a468cf7e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628609, "uuid": "afd4987c-0f61-44e7-a78e-085117f5d0a8", "comment": "Malware payload (Formbook)", "value": "1c15af77ead16dbc2d7c3c1da7f189043532acd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628609, "uuid": "c8426f86-0450-462a-b569-a45b6dc20104", "comment": "Malware payload (Formbook)", "value": "6c3d345770f8d428c9b9340268ad4faedc1936d8b0f102b363d5a957175c85afdc46262076224427cbd7098f8cbca199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628609, "uuid": "b3db80ea-caee-4a90-8cd7-b5d823371ff6", "value": "T140F48D08EB876981EDAD727A95F523023355F9748C8F920B71ED657EC9E73E42F40288", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628609, "uuid": "140291d0-3d42-4307-88a6-689e94e7a73a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628609, "uuid": "a27344e8-a8da-4960-a417-25b9054dafce", "value": "12288:Y1yDENc6pleL8SbrzH22qla5w/yXbxYws1nfrfD4d2D:T8c63DSfzH0MW/IbxStL4d2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628609, "uuid": "162aa0cc-d84b-4bcb-b3f9-74943faae935", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628609, "uuid": "d45641f0-77c6-4ceb-a09a-6d2077d70e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628609, "uuid": "d75657b8-ad9b-454c-9562-c8f1d6857393", "value": "gon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74d87f7-94f0-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1645652266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645652266, "uuid": "58319e9c-d8c1-4365-9039-04b298c04a9b", "comment": "Malware payload (CobaltStrike)", "value": "7a7c1556cc9c5bbeee5fe20b3493c707", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645652266, "uuid": "831aa4e5-53b9-4dca-a6ca-cfa8302dd635", "comment": "Malware payload (CobaltStrike)", "value": "e8710133491bdf0b0d1a2e3d9a2dbbf0d58e0dbb0e0f7c65acef4f788128e1e4", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645652266, "uuid": "5c11e4a9-0a62-4479-8ae5-d0ec1e6830f1", "comment": "Malware payload (CobaltStrike)", "value": "5cd1788d0e61bdf8e151fc5023de78c9b582f9f5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645652266, "uuid": "6d254310-12cd-4998-b646-018993c2a33b", "comment": "Malware payload (CobaltStrike)", "value": "9f98d2c7b5939bfc88417995edcecce801a182c16549cc3c182e2fe1cbb01c8eb8f6ccd8b5450b445d6ee2bdb53f8ac8", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645652266, "uuid": "3d4f001f-8adc-45d3-96ba-43c23ad7af1a", "value": "T10092ED24684DDBFA3453DD8FAFCD65A088C408E39939B3B8B4B9D1CD45A055C7A9E703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645652266, "uuid": "b04e027c-6876-4353-b88c-5adb90d1092d", "value": "192:JgVwLjUJpJf0t59KLKnVlxiuc6Xsn4XwS85p:qVwLjmpJfC59KLKnVlxiucusn4XwS85p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645652266, "uuid": "460bde47-3881-49b3-abc5-a3a5258250f2", "value": 20570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645652266, "uuid": "d16037d1-65e6-4d78-92b3-c4a6f24c8532", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645652266, "uuid": "bb52f411-f447-4336-83a7-fbe13dd7cbbb", "value": "evil.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a513a32-9493-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645612006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645612006, "uuid": "5b3dbf4b-71c3-4b75-9c99-e7868ab96a72", "comment": "Malware payload (RedLineStealer)", "value": "de12037f42bdd6f29db455c04b6738ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645612006, "uuid": "e989cd4e-72bc-496b-80da-9900fad9fef3", "comment": "Malware payload (RedLineStealer)", "value": "e8c487c86e3221999449a42a1c82235b5c6f399539d4db1d436c1cce6a125d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645612006, "uuid": "94ded33e-69f4-4971-bb58-2dd727096143", "comment": "Malware payload (RedLineStealer)", "value": "01dadbc65aace71928750c94da99f517231aa84f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645612006, "uuid": "14a6c5b7-ce74-4c7a-a185-f6813538831c", "comment": "Malware payload (RedLineStealer)", "value": "601413b635dc0cfa0c1adb485ddad2ef6828ff21c0b5883ba31057c90426ae4667252bc62ec4729a382dff4e04ee2b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645612006, "uuid": "4f002fec-015f-4220-b565-5dafad2c1906", "value": "T1ED252422D2C9AD86D36627B23D514C540A74FC337A48E9AABD4F7786C5F424DCB3438A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645612006, "uuid": "4a663381-c2a0-4009-b77d-d28c2f7e1d61", "value": "1522ee7cfa27cb2f520f721ac57ec148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645612006, "uuid": "35f78709-3459-45bb-9e9f-2cb526810fdd", "value": "24576:Ui333gJM8SmM1+M7nbB9lG3QRy8m4Eyl+jLsB:d333gJM1N59lG8zm1yluc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645612006, "uuid": "5d48e94b-c3cb-4747-aac5-1f761640113b", "value": 1056736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645612006, "uuid": "96215436-03e1-4349-90c2-1b030ae73769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645612006, "uuid": "6f406c26-2db2-4cc0-9064-10a9e124cb6a", "value": "de12037f42bdd6f29db455c04b6738ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65dc7c5-9457-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645586552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586552, "uuid": "834808c3-70f7-49df-a0ea-296b7a43d59a", "comment": "Malware payload", "value": "ac242e25cce11b4653b8052fd9e07655", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586552, "uuid": "95c75009-2648-4fd3-99c2-a9b07f03f5f3", "comment": "Malware payload", "value": "e9fe327f7c6296a7feeee721628d8a99ebcb0bc52e2b5ca7aa51b9d2709e4302", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586552, "uuid": "ff1cb70c-c72f-4355-8129-767e252f79b5", "comment": "Malware payload", "value": "52c932a381f163cd9445e40fd66352410ac55d2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586552, "uuid": "6430b87c-f44a-4900-887d-c834c75b5e83", "comment": "Malware payload", "value": "0f504f803d9e7d7d7b4bec454accf450464d81b75ae614b1a00b79fadc3565d50b7eea6aa1494a0e02d81576052ccc07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586552, "uuid": "0d892281-844b-49c9-8a44-f5cadb350728", "value": "T1AE825109EFA58E27DC7FDE3349ED0B4531CDA00B22A46B2A3175C828B65F54749E3C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586552, "uuid": "52dfc5b1-e3de-4132-af2e-d2be79b0dc75", "value": "384:D/Si/bI4PGgjZqyKdk56Y5XiqCceOWGeL7apBCDf:2ybI4uiZqw5P5Xi3ceOWGeLO3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645586552, "uuid": "0ba14e0f-77da-4c79-906c-8fba84b87476", "value": 18288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645586552, "uuid": "76b27bc4-c74d-4c90-9fa6-cfa9d478a362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586552, "uuid": "5f81cc91-e2d7-4ffd-be23-874e035e211e", "value": "ac242e25cce11b4653b8052fd9e07655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89a36cd-9488-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645607628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607628, "uuid": "5f8800b2-a509-4657-b759-8895b8137521", "comment": "Malware payload (Heodo)", "value": "b39cff56440976d93ad2a9544b2d6e51", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607628, "uuid": "2312499a-7285-4f60-9964-7fb005db2f44", "comment": "Malware payload (Heodo)", "value": "eaf12d08140e603b5195db2f017da9470531acd45f3d450e2f8b30663173f1dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607628, "uuid": "3d1d8a04-b4e3-4081-80c5-50bd99b4bbe6", "comment": "Malware payload (Heodo)", "value": "62fa98b895107d6fe1f9382e38ab3347ed781c6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607628, "uuid": "ad1b8f72-8af7-4e3a-b836-05c23077228e", "comment": "Malware payload (Heodo)", "value": "b3969c67d0296947830d972b833df32ee00e560d02ab924f589b130253eeb3f57e1797b87e3436d0e1bb000efd72450e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607628, "uuid": "445da571-3300-4efe-a474-5e35878e7332", "value": "T12335AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607628, "uuid": "ed1a8bd6-187e-44cc-91bc-96f6647b90ff", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607628, "uuid": "1b1cff46-51cf-430c-86c7-4529efddf06c", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNMTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNMT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645607628, "uuid": "859d373c-a603-43d2-bfe4-432f33b04666", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645607628, "uuid": "e59cd107-f813-458f-b86f-471d11b76482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607628, "uuid": "f63cf54d-17aa-4f7c-9c4f-aa7953553f0a", "value": "J2G1aE93vbvxbFZ6VJ4POLt4Y7AX5UxH.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf8085b-9490-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645610747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610747, "uuid": "b7174182-adce-494d-9ae9-0cfc9fdabca9", "comment": "Malware payload", "value": "3123c3aff4e0cae7ad060a3691c06079", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610747, "uuid": "8624462b-8b8a-4906-a0ed-2f65a694564c", "comment": "Malware payload", "value": "eb265ebe4e52ad374ed1067c696a0893017e17e6584761b645a308aaa9462df8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610747, "uuid": "09d05098-c245-4ced-88b8-d8a6f90afbaf", "comment": "Malware payload", "value": "f8b170216a206896c54e1dfc462322ec9366ea6f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610747, "uuid": "750c5166-a4bf-4056-864e-46bf1083d572", "comment": "Malware payload", "value": "5391aff28ed3a5d40173f953c509d9ff01d5ffc7941d953a2268419b65c36f42e0759283facc402ee0fe55b954b1438c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610747, "uuid": "2face40b-9f40-4ff9-ae05-37611e36cfa5", "value": "T16D95A931B1317A87C3161465265FBE8A430CBD47B2CA5F8C905DFBF82CA68E79306D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610747, "uuid": "0fe82203-44c5-4287-bfeb-062b2dfc94bf", "value": "1536:bXsJ4pueregeIege4ege3egeTegeZegeKege4egerege9egebegevegefegeZeg4:A+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610747, "uuid": "2d4a5738-57f5-4db1-acda-7729e4e0ecab", "value": 2049124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610747, "uuid": "d31015f5-9632-4c4b-a464-3b084d3ba981", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610747, "uuid": "19c4f66c-2d65-46f2-96e7-d902a2ff7e80", "value": "Facturas Pendientes.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd94ee76-947a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645601650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601650, "uuid": "000a0f34-d95c-476f-89e7-05b51f30decd", "comment": "Malware payload (AgentTesla)", "value": "e7cac1e56ca1d5116764f1cc25b29296", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601650, "uuid": "6503a579-5155-41bc-b8e1-65c2a4a91e0f", "comment": "Malware payload (AgentTesla)", "value": "eb3fb64327e52eb876b248962c934fa74d452eb19b0990827bdaffd03e8cfa24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601650, "uuid": "cfee0661-6336-46f2-a59f-d8cb257d667f", "comment": "Malware payload (AgentTesla)", "value": "afb3f97f5767e24b60390eb9b9aec1a25fdc890c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601650, "uuid": "2375b520-5235-41a7-93eb-935a20c8ad7f", "comment": "Malware payload (AgentTesla)", "value": "db8fc90e971e3630a4cafda8398e8ac55e4de174af74500c8c8b5311a6cec9bb86137dbee27b29f9adc8f3c65c6f9203", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601650, "uuid": "11c67f77-6d09-4e1d-9073-d55b72769f02", "value": "T19705CF4839A75F3DF1B18BB20DC4ECB4BA99FB331C08A37D78516296C6A1B508943677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601650, "uuid": "45f5927d-0c6c-42f9-a0fd-d116f3ac2645", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601650, "uuid": "e5ff53e8-9cc1-4a21-b688-08a2af6a5e59", "value": "24576:KK777777777777lSwRFcHyWi8mc4PZhObGP6CKbJ:f777777777777lncKObGP6CM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601650, "uuid": "b83a60f6-1a44-467d-bbac-1320a6a3e2e1", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601650, "uuid": "3ac04441-e304-4a82-aec4-bfdbd1ccb4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601650, "uuid": "3340663c-c3df-4a57-b281-f59635878b2b", "value": "PO-652022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1556e7-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645624436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624436, "uuid": "f81b775e-37ad-46e3-9ff0-42951f9af15a", "comment": "Malware payload (Heodo)", "value": "616ec603be8762ca0098b280316dba02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624436, "uuid": "2e61fb90-66ae-41ad-a28c-2fb8274b2015", "comment": "Malware payload (Heodo)", "value": "ebbcfd63162fceef39fb467992da9440cecb4c9ba08568527e0e633297acb309", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624436, "uuid": "ef2095a9-7cb0-404d-afe8-d485716b8c9b", "comment": "Malware payload (Heodo)", "value": "7ffe4c18fb343c50e7fc994b9cd27dd7088f254d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624436, "uuid": "77c15b35-ad16-4855-ae12-2a140ca34bff", "comment": "Malware payload (Heodo)", "value": "2035e646b6b13a2f5cb02a9387ba971667fe3b90b365738e6601f70378c403f3eb1d40178bb0975211fb0aacd0b9143e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624436, "uuid": "2126b7cf-c045-496b-8a9b-6718e1e6ffaf", "value": "T1F035BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624436, "uuid": "e11d23ee-d1c9-4db7-848e-a1c2766e5147", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624436, "uuid": "14009d6a-881d-4f57-97d3-bcfad2b407dc", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/OTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/OTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624436, "uuid": "2cc1bbca-3d83-457d-b575-659388870eca", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624436, "uuid": "2e01172d-c4f3-4a26-8024-14f0a5d77146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624436, "uuid": "c2e092f2-2903-4d6c-bcdf-55076f5419e0", "value": "616ec603be8762ca0098b280316dba02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45c789a-94c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645634571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634571, "uuid": "6edac1bd-f2b9-4c7b-9fb8-0bc0ff0aecd2", "comment": "Malware payload (Heodo)", "value": "b11351f5734a68b8a006b2415655a441", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634571, "uuid": "aed3992b-46e2-4c89-952e-0ddbb6f81f3d", "comment": "Malware payload (Heodo)", "value": "ebc4ca91632a39a3936a22bb1abc218d467552b7256bcbe35450ec0d5c2a1381", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634571, "uuid": "b54fe928-d2e7-44d9-80b7-5cffa6b4cc16", "comment": "Malware payload (Heodo)", "value": "22ad9e121109451d9c558f3fabceb5d00bb5270d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645634571, "uuid": "91965c4d-0522-479a-8690-6036edd25f0a", "comment": "Malware payload (Heodo)", "value": "5a7dbf7f51b9dfe77c1a6278ef5f950533e807c7f0a6e1df6aebbc362aa93ef995ed2145a3158993297d27a90b654130", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634571, "uuid": "9a9390fa-1406-41c0-be57-6b2a9ce21007", "value": "T19A35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634571, "uuid": "a028b844-7262-4ac8-a605-2f9cbec3813a", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634571, "uuid": "c27ebb4d-9970-4dcd-896e-8026de53f086", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/PTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/PTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645634571, "uuid": "431ae9da-4492-404c-81f4-e9070081b942", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645634571, "uuid": "994093f1-7af4-47c0-bddd-471c1dc88640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645634571, "uuid": "18e4890f-6964-41aa-9233-7fb1fc5cf762", "value": "b11351f5734a68b8a006b2415655a441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9fe858-9491-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645611503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611503, "uuid": "051ac7cc-65e7-43e6-86b1-db1071d67c0a", "comment": "Malware payload (AgentTesla)", "value": "4e90388a5161e3481a6f0604cebf0c93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611503, "uuid": "e96c1c90-48e2-40e5-8d72-529e6401937f", "comment": "Malware payload (AgentTesla)", "value": "ec1e49cc72de673d504b5962acc2148a9bf70799198bc02d44bbc2464f179ff7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611503, "uuid": "f2762a27-3a74-4140-b619-00064f54cf71", "comment": "Malware payload (AgentTesla)", "value": "291351b1e7b068571fb280414d0bcd1d09aa9a2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645611503, "uuid": "570a81bc-5023-40fc-989d-3b4dfea83c1a", "comment": "Malware payload (AgentTesla)", "value": "aafeffb73295f458f6d622867156f2c9aaee965c1405d217397cdd7b43430319ff682fe25936f8c75a55cc301f056407", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611503, "uuid": "4e9f8eee-2f30-4d37-90fb-18be5646d0f1", "value": "T1F61593983191F2EEC8A7C875DA581CF5EA903C6AD30B910790273E9DB93D857DF160B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611503, "uuid": "eaa762ee-a05e-47f2-a11a-0f5871dd80b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611503, "uuid": "d865f925-6c0d-43a8-8220-df15b355c02f", "value": "12288:rMMxxtYnrkR55wJUilisVgnrqNSc++ZY5UcWFl0CZakMkKmCdFE/ummEWNzH+ngm:rDxtrRYJUiPGrq/++8el0hkIZB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645611503, "uuid": "581a3b91-14e6-42a1-b58f-6aa8774cfc6a", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645611503, "uuid": "24d00feb-fa02-40ee-b553-f35fc0ef1c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645611503, "uuid": "03eb2205-11f7-4760-ac53-885493809419", "value": "PI 55407 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becdd541-94fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645658238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658238, "uuid": "49bb4ce9-5975-4fd2-8a47-3c5bfeaf73fd", "comment": "Malware payload (Heodo)", "value": "38a433a5e19f251fda265f3857ce306b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658238, "uuid": "8f70674f-2fc1-458f-a4aa-114b7840e730", "comment": "Malware payload (Heodo)", "value": "ec2261c79bb7584274dfbd392d7c72fae137321f03c94142dc1a098023de9e56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658238, "uuid": "fc4f22fb-412d-4c82-b0eb-bab25bfe4993", "comment": "Malware payload (Heodo)", "value": "edd2fef456fa5ce65e2d48fa7ab935df293a6c7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645658238, "uuid": "c20d93d0-94fb-4bb7-b088-28bdcc685c0d", "comment": "Malware payload (Heodo)", "value": "27bcd5f4455d8ef6e131e643afcce3bfe147bcc7306783e5f69c70cf2b8e365ed1214e70c062fdcc0af2ff9f3aa27f98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658238, "uuid": "67547d81-564a-4f6f-818f-ea8b334ab300", "value": "T1E4E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658238, "uuid": "1b82aea1-10b1-4a80-ada1-656efe284975", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658238, "uuid": "add012ac-ae20-43a9-b0d7-ed8bb30b0fd0", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0whR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfwPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645658238, "uuid": "e295aa0f-c6ee-4fa0-9942-ec125b5d2c18", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645658238, "uuid": "7c57877c-5c04-486f-ac24-2519330e0df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645658238, "uuid": "11bdc2bb-57ee-477b-8f61-89bed68629b6", "value": "38a433a5e19f251fda265f3857ce306b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302e96cf-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619344, "uuid": "460bd662-fbfb-4725-a5fb-af5379236d8a", "comment": "Malware payload", "value": "2a9f7810f74b27574b84cf6de8d07cef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619344, "uuid": "6aeb2443-ac00-4830-bbe6-463ff9e0b47a", "comment": "Malware payload", "value": "eccbfb00cfe9e3b006628b000dd453f8f63eb7ebdf96173e7637cfc131719cce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619344, "uuid": "78fdac25-b4f3-41ae-a5db-ddbf009558fe", "comment": "Malware payload", "value": "f0b9da9b0226363b454ecdbf3fe464a518c98c96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619344, "uuid": "a1ca0663-4282-4f31-b7ec-f40dbb97d66e", "comment": "Malware payload", "value": "9180e18c892dbbb06f7cccdad527eb1dfb98a1662fbdc6de46679a70a9a380996d74e6599957a44970a3e74c2a2701e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619344, "uuid": "0a7cafed-3447-4a2f-86e0-335234de0538", "value": "T1E05633C1A5C09B363C6DDBDD4B2C55B68D1AD9FA6186EC4A9C713B40AEC6EF04244FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619344, "uuid": "579689b3-f01b-4c9b-8135-ffd9ee76b507", "value": "98304:D+hoUAA6mt/cOkw09D1VxIFCeG3lEGxjRP/ody7mZoqUfJY2P6oPZw4IVX2:ihlAA7t/chZVqCeG1EGF/ody7+nmv6EX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619344, "uuid": "d5fe36ab-8246-4a3e-8942-6a9b1a63a1e1", "value": 6027906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619344, "uuid": "a6e62ef5-3abb-4145-97d1-281b52e8882d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619344, "uuid": "e6442660-db35-4452-98ec-8e68cdacdb74", "value": "2a9f7810f74b27574b84cf6de8d07cef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3819ccf2-94ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628806, "uuid": "38160e2f-997d-4d05-be60-8faf081d82fc", "comment": "Malware payload (Heodo)", "value": "3e9486ffdf35726a8e6ab9a61a7c2f82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628806, "uuid": "b6fad7b2-10a8-49d4-856c-218a007b5e65", "comment": "Malware payload (Heodo)", "value": "ee40930057f52a766dad295da0edf56e77085134429df4c723ca76300b2dc23f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628806, "uuid": "98ed52dc-6bcf-4cb2-b02c-e145e4654ecc", "comment": "Malware payload (Heodo)", "value": "97c7bf6bd5d4af4d03944ffa2815142f2257a00d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628806, "uuid": "c5fb847b-e66a-49a1-8012-c5a59f3abcb1", "comment": "Malware payload (Heodo)", "value": "93f0f562289f7901182ab572774693bc47c0122c21cc3a3dae95db775128d235b929a50a147d473c52c5a0eaea5aed0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628806, "uuid": "b2208c77-6b5f-485e-98e1-8deb014ebc5b", "value": "T1BD35BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628806, "uuid": "15757671-eb37-444c-94e8-c75c021d9eff", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628806, "uuid": "11cde8d9-208b-4723-b6fe-429bb8c746f4", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/sTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/sTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628806, "uuid": "9fed846a-646a-4935-bc3f-33a8e7e99b7f", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628806, "uuid": "c219e75c-87f1-4a43-96fd-b490355f15f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628806, "uuid": "44337f07-d9bc-4c65-9503-f3a08222b16b", "value": "3e9486ffdf35726a8e6ab9a61a7c2f82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d945e722-94f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645652699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645652699, "uuid": "07f74557-492d-4765-903b-70826de3595b", "comment": "Malware payload", "value": "c81c8cbbcea7c6abab278ce983c6b767", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645652699, "uuid": "06804702-8971-4ee6-b17d-00652f245b0f", "comment": "Malware payload", "value": "ee948a40df97cdaebc23bbda5da5093c75c2e805859e51b7d8b158665c348c08", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645652699, "uuid": "23512e54-a68f-46d9-93e7-00fd52fc67f3", "comment": "Malware payload", "value": "b2bd04be4ba8a21889abb31ad9a6eb3cf3ec98aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645652699, "uuid": "78b84b70-e15d-470e-b64d-3633314c4591", "comment": "Malware payload", "value": "8b1ef7de1ed6b4a184252b06552b18a9e7eaab2b315cc7abac01170679d3764dc362e25a368e1baf96480b1463e018e1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645652699, "uuid": "f7cf1c57-3c5f-47fb-ad8d-d203b6bcf108", "value": "T12324F1BD370E523F8005D2AE979D839D22C7FE072F6284A07941D6CF561EBDF58AA205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645652699, "uuid": "3ada6eff-5c41-4fe6-9fb7-943a83847ccb", "value": "6144:6gf5HNyUyi9WMjQU618S7XKLaVFQkUjvAiqQuBCCQHB:BpEUTWe0EiAbATa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645652699, "uuid": "83a4754d-c96a-492c-a63d-1d643622558a", "value": 209991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645652699, "uuid": "a2dcfbae-67ca-4170-b1ce-1e636c61f57a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645652699, "uuid": "6e281d30-c17a-4a43-9ad5-ac545399aa39", "value": "GdaP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580b79c0-947a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645601372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601372, "uuid": "e378d5be-c9cc-4e0f-a8f1-016792a545c3", "comment": "Malware payload (AgentTesla)", "value": "b5d3059607314debf9f6c9a547b7003b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601372, "uuid": "3ca058cc-2c37-4c22-a6f3-6ee609d85ca2", "comment": "Malware payload (AgentTesla)", "value": "eece54b40f29a526f0248e83982729fb8a181ac76836f1460261849729543107", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601372, "uuid": "3ba5d677-5460-4675-88bf-b76abc81dc9e", "comment": "Malware payload (AgentTesla)", "value": "c965a485828cf91f2e9af880cde9b7bc8ab5a129", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601372, "uuid": "c37eff57-c84f-4e63-9e6b-f17b8d2d4e6f", "comment": "Malware payload (AgentTesla)", "value": "7b8f4e84a756afd5b9e1fefd6ed3b656f1e056e33c1ba438c88192b674d95e315f5aaab1c31bac415ff0430041956f62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601372, "uuid": "1de7a33f-00f2-4154-a9a7-a9747c9629ce", "value": "T10B355B9D365072EFC857C972CAA81C64EA6074BB930BD203A05716EDDE0DA9BCF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601372, "uuid": "dd566f23-32da-428b-8d66-25693143c879", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601372, "uuid": "c76d7d34-8f62-498c-99bf-1dcf6b92a677", "value": "12288:oIQM0+wggEnnRL9n/b/uABE02jY1hjardqt2MHtBjWweWTQSDspmVVc1ZNXZamTb:VoERZbuj0diruHthWweWMSOZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601372, "uuid": "9e70857e-6726-443d-bc22-06173fafb36b", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601372, "uuid": "eb784e35-2fd8-451f-a33b-eb6c44769c61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601372, "uuid": "f281e8d9-4e8d-49a1-87d9-bdc006631ef8", "value": "RFQ FOR INQUIRY No-6674 -290920.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a434a47-9472-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645597832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597832, "uuid": "a6f65fde-e9ba-4d39-8228-5f4bc0eeac1a", "comment": "Malware payload (Heodo)", "value": "c6631eeba3a165331e93931b09f1354a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597832, "uuid": "fa66a55f-35f1-4014-9fa2-db87c8a4f16b", "comment": "Malware payload (Heodo)", "value": "eeebe7241c2434202bb9a5d640a7ffa333cf5ce5ddbdb2ce9cc0d2f08f822575", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597832, "uuid": "cdbd730d-de16-47c4-82cd-da60ad2a60e0", "comment": "Malware payload (Heodo)", "value": "48bc48d228d9848abf4fb512b11bc50f25f92c07", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645597832, "uuid": "5cdfae82-5b97-4750-b529-3b3a55d3a133", "comment": "Malware payload (Heodo)", "value": "f00881d974c1baa7ab3b5c65c3a6814abc1e8c7ad5e6d57018314ddb44619584593edfa4df4605583042074dfb401d62", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597832, "uuid": "9f86d03c-854e-4c2f-bbb0-d92d7ecf765e", "value": "T1A735AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597832, "uuid": "6a0f44b3-97b0-4d25-9599-d1ff8da141c9", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597832, "uuid": "bf828797-ba06-41f6-ac58-c7124a8e3a02", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNGTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNGT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645597832, "uuid": "5b38de53-e426-46df-98ed-4da4aa35d219", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645597832, "uuid": "ec350247-bab1-47ba-bb82-c2336281e05b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645597832, "uuid": "cfd66ccf-af2a-42a1-9687-757589549abc", "value": "emotet_exe_e4_eeebe7241c2434202bb9a5d640a7ffa333cf5ce5ddbdb2ce9cc0d2f08f822575_2022-02-23__063027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21bc39c-94be-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645630809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630809, "uuid": "20086e40-87f4-42c4-9a18-e9a40819f371", "comment": "Malware payload (Loki)", "value": "6681df452474459da942acc761205809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630809, "uuid": "8839e017-dbf3-43ab-81a7-20da9fef49b7", "comment": "Malware payload (Loki)", "value": "f023f49e170637c71572bee5580f32e93d00570c243d06f0c06a08fec6cc249a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630809, "uuid": "1a6b16a2-cde2-4cc1-83ea-7ab38ce7570a", "comment": "Malware payload (Loki)", "value": "2bc8fd21067214980668b61a992b8c3f223c8b47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630809, "uuid": "95cd5ecc-cb53-48b7-86f7-1d7f76997691", "comment": "Malware payload (Loki)", "value": "d7b6f0a107e625f2b32c42de0d38ecfbe0132145f84817ea06e92ef0a85996961322fc561ecb46be83bedce41ced3986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630809, "uuid": "83a7d417-f749-4fd9-baf3-ecf0b10cfca5", "value": "T16454ADE16A80C975C4423E318835CEE055FFAC51CA606A47F6B47F8E2EB23D0656636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630809, "uuid": "391798f7-32e2-461c-84a2-e031df0a8bdd", "value": "ac28fe22f41d923696527394756551aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630809, "uuid": "4784e36e-8443-4ab1-b588-1b6c5ff8a604", "value": "3072:jqHIPqmUtkf0BX8T20q5BEv04PL869MB5zVggjcGkNIVqIOM/h3isxkgaBChf/or:wtkfyyWEv0sL8P7ITsqxeigao/owrwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630809, "uuid": "8eea59ba-1593-4c57-b0a2-2c55dd7c59d8", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630809, "uuid": "3410cb9a-b76b-47fd-ad9c-b81983231f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630809, "uuid": "69f045eb-76f0-44d4-94fb-7acdbc063443", "value": "6681df452474459da942acc761205809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7568850a-946b-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1645594979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594979, "uuid": "6b0156ff-fe6e-441a-9fad-6d6daf069c0c", "comment": "Malware payload (CoinMiner)", "value": "835807721489b1e85cbf35b3e9409d55", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594979, "uuid": "e49ef801-64ea-4793-98ab-0767671ec94e", "comment": "Malware payload (CoinMiner)", "value": "f07ca33efcd02883b2a7fe9f129a7f35fe0d688f2c0649e4587d6fe82d7cccde", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594979, "uuid": "c9e0e48b-5475-4946-b27c-cf338c3da3e0", "comment": "Malware payload (CoinMiner)", "value": "1af69ad7011a148e34edb10e18787f7d8c2b5e28", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594979, "uuid": "ec4e0509-0c6a-4702-84f0-2416a770a5c2", "comment": "Malware payload (CoinMiner)", "value": "8388abf5c8d62a1ef1648e46d68de4a1a2092ac58aff6949d7058dbfe38845bae8ba8d174a86d27ad89fa1b212c31913", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594979, "uuid": "83792011-7854-46c0-955e-bf5a4d0a8753", "value": "T1D1363359438B2015EE41D2796C26344A86BEF6108E5F16AD37F449EB0E2513DC2BEFEC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594979, "uuid": "1d17d517-5edc-4c9a-9b49-ada15fdf6b18", "value": "0f542f0a72d5f3a37475de00bbe84939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594979, "uuid": "50db8ddf-3e68-44df-9264-9f2339535e15", "value": "98304:NoqVTo1bZWfY8pMH8e8+Akvtv1o0j2nSlY6yJQ9I9XyqogL9WO:NoqiefYyu8f+AUae2n20JQa9X7x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645594979, "uuid": "29c87396-2223-40dd-8f77-a83b214b966f", "value": 5005184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645594979, "uuid": "d40240f0-71c4-4b8b-b13c-06fb1d828856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594979, "uuid": "a8694041-096b-4805-9429-eaf1092df657", "value": "Mlw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f80337a-9482-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645604821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604821, "uuid": "a371419d-4e67-4930-a19e-799eb20a2dfb", "comment": "Malware payload (Formbook)", "value": "b3963600fe125e29c71d491cdd9a1b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604821, "uuid": "19fd8e44-3607-4782-952e-e9afa7a2200d", "comment": "Malware payload (Formbook)", "value": "f27d8facc1c21303147f505b5fe05d8c759a4701f3ea3600183bf335b184ee3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604821, "uuid": "4652835f-b3b2-4c3b-94b3-e0edc63de848", "comment": "Malware payload (Formbook)", "value": "0c6e078284337ea78a9f4a3be5d4252b20552f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645604821, "uuid": "1ab391b6-2f32-4959-aeac-5cadfc126a37", "comment": "Malware payload (Formbook)", "value": "65f5c2d33bc7e927cbda6b4430cb8cdaa535008993d463caa4fee7f705b4ac805ea869d955bd5be213682e90896bea7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604821, "uuid": "5f617e0e-b2e0-4c86-a845-2d17e4b30dae", "value": "T12B54122870D0549AD1F59A7034F35AB4CEBEB7291BB64EA38B210F6F79319825C4F603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604821, "uuid": "f24923bc-5119-4a7a-8adf-4db354b710c1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604821, "uuid": "87a356ad-120a-455c-b424-68b6b7b14dfe", "value": "6144:TxD6NnQGs7WaUsQCOQfaWveLNQQwbaCyWO5bU8NtYrdz:E0WgOQf2QVbaCyWybDNCrdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645604821, "uuid": "921e6593-8030-4ba9-80ee-924f162daf19", "value": 292844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645604821, "uuid": "9d9b708e-a1fb-4060-809e-6c9add95c577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645604821, "uuid": "40ba95ac-9135-4291-8d39-eaa653ed83fa", "value": "Swift Copy 433543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d2c909-943c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645574798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "9bf4ccdc-934f-48ca-be3d-68f9be9aacd7", "comment": "Malware payload (Heodo)", "value": "e09e2d4cab7723e833a141d5ac9bf941", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "6191b311-b853-4ba8-a866-9cc7515d4e2a", "comment": "Malware payload (Heodo)", "value": "f356293e49023e3dff1410fedd7023cfa7b3dbab19a67c1e4c92eb9656561e2d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "a59eea8d-d533-46d1-8684-da5d0c9d4d2d", "comment": "Malware payload (Heodo)", "value": "23daeea0de70553a59110411a5779e2912c852d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574798, "uuid": "ffbb490a-9b46-42b8-88cf-3339cd5b03c1", "comment": "Malware payload (Heodo)", "value": "63012b390b88d228da31ef35afa1cc3a923801c68d4dc116558cdda9c8ae52b71ee0fe333094fcf697e6622010e06f0b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "bbbab429-b42b-4737-9e09-45aed057103a", "value": "T113B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "5fd92acb-3c23-4dc5-913d-cb9031b70b7e", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "b0e0940c-948c-4703-a1ba-c91246725bc4", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wnIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWIzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574798, "uuid": "aa182d72-ba49-4504-9fa3-853d655d65c6", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574798, "uuid": "1155a73c-4c3e-4b09-84c4-2fc6242013e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574798, "uuid": "1e6178bb-d6a4-49a7-aaa0-ba4c3ad96847", "value": "emotet_exe_e5_f356293e49023e3dff1410fedd7023cfa7b3dbab19a67c1e4c92eb9656561e2d_2022-02-23__000633.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798a0360-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645610448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610448, "uuid": "95b0667d-dfa1-41d9-b1b5-e09b87b9495a", "comment": "Malware payload (SnakeKeylogger)", "value": "8600541f4deb0e9271aa016430a9f882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610448, "uuid": "c9a5d2f4-5e9c-4bfe-af3a-7f847b221ed3", "comment": "Malware payload (SnakeKeylogger)", "value": "f3b7c3bb85af0efb84fbb077c0b320902ab5ccb4af7aeeb8e78958343a3940ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610448, "uuid": "85ef9ebc-c7e5-4ab6-8536-fc5f99dd263f", "comment": "Malware payload (SnakeKeylogger)", "value": "005b4c9adfd1389d145c375fc53c33c30c618ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610448, "uuid": "57ec09a9-4655-497b-9388-2825eefa57c7", "comment": "Malware payload (SnakeKeylogger)", "value": "258ac0874af2b23963ff4a2554d10df502750430a34035a5939f31ad5864d0dd4105e03c9bfd9ad01c6b880c43592735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610448, "uuid": "04ca8eb9-4147-488d-a641-72743927c33b", "value": "T12F84D01893E16E83C85D4B3D99A3C32197B4FD815207D3579BD09CBB3CAB3E10A497A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610448, "uuid": "7545267e-02de-448b-b8e8-59f4871daee2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610448, "uuid": "d2fa27f0-9f23-4508-b9e2-0eab1e7f4c10", "value": "6144:2mcYrx33tvJ/xaWAd9ZLSMTOf8mUdjJF4LS5pSlpHh2pzrZOLmZRRRvSVu:1Fxzcfqf83djJF4+SlCHlRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610448, "uuid": "a360404f-74aa-40a2-bea7-443cec3d1304", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610448, "uuid": "d953c38e-b8f9-475c-9573-48deb3b8470b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610448, "uuid": "1abb555a-3c88-4f5b-8373-1c6e1c7c048f", "value": "List of items and quantities.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3961e2c-94b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645626410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626410, "uuid": "f02e69b6-5527-40b2-91f3-52e402ede772", "comment": "Malware payload (Loki)", "value": "0b5cf2910ede9aa0ef6063c0381a2912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626410, "uuid": "6002efa1-9985-4ead-ba2d-5167553b8076", "comment": "Malware payload (Loki)", "value": "f403386f84b822b26940b212a22960d9af08e355049f36d7ea6cc7d25199e703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626410, "uuid": "32d6bc50-2fbc-4d7c-adc7-30f3a3cda725", "comment": "Malware payload (Loki)", "value": "36b19a07b0dcf24526071b7ccf8c7aa148a0ae1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645626410, "uuid": "c5bf9329-758c-4c26-8c4f-5b23efecc8aa", "comment": "Malware payload (Loki)", "value": "a17b049e1c44d64d66c302c968433c2dcda773a7ac6086a07e6f08410788720d26e9c676f64f8c88c02cf013612cce80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626410, "uuid": "5d955862-0fa1-4342-b1d5-d7639abf6be8", "value": "T1FDF4C044396B8F3DF1B18F724DC5ECB4BA59FB232C08B37D78556256C661B908C822B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626410, "uuid": "5b38a5dd-cc37-4863-907a-7de1cee7bb10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626410, "uuid": "3442c18d-cc77-4ad8-b42d-1dc929ed1230", "value": "12288:1b1whcK777777777777WNefutvhj4S5pxpLwzWUrCfHaY9HTVDfPzIxlrMAMuZY:1BK777777777777Cefutv1t5hLwqUWf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645626410, "uuid": "c99688a6-c7c7-4a80-8f61-41216c6e5e7d", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645626410, "uuid": "3e9da0d8-71ac-4bdc-af8e-c2a59d61f063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645626410, "uuid": "18dfde2c-93d7-40c1-9a24-652a25252bf9", "value": "PO DL036821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397642af-94b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645624514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624514, "uuid": "2346e25f-de50-446d-a6e8-f130f47180b6", "comment": "Malware payload (Heodo)", "value": "ac5b73691b6a6d89e4c14149b4c118c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624514, "uuid": "161595eb-a02a-4fd0-a0f6-d0c7885e8d99", "comment": "Malware payload (Heodo)", "value": "f44c4ad27b5e76a3f0148c9cfdbf37aa8ada96d4b6b7b9ce162cb43219485724", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624514, "uuid": "d7371bbb-e3c3-4a33-ab44-08840f6cec8a", "comment": "Malware payload (Heodo)", "value": "cb0e2240f5668044f183c883d96327238f1050cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645624514, "uuid": "a779227a-bdbc-46ea-8f34-e19a9f8f5dd0", "comment": "Malware payload (Heodo)", "value": "47ce352d5ea22ada91f775b132ae508fe04c0553eeeafcde71b23024018108a724a37efedef70e6b37ed9d92b33bd862", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624514, "uuid": "6497c49f-360b-4a0b-89d6-d8d8715652c9", "value": "T11435AE2136C4C0B6C2AE11B64516E71A62F6BD614B37CAC36BD0EF5E6D385E3CA35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624514, "uuid": "6b0e8422-114e-4947-9d64-34878b3aa764", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624514, "uuid": "3bb3191d-d4c6-4e59-8eb1-b5e60d4fe455", "value": "12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNgTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNgT/uNEsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645624514, "uuid": "19c34d1d-f41b-46eb-8e9d-deb980bbc358", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645624514, "uuid": "6b8bcf8d-59e0-4774-af58-2a5250e74cf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645624514, "uuid": "ac3ec3fa-060d-48b6-a9a1-338eedf7220d", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ac103f-946a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645594498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594498, "uuid": "a5d26c57-d0d4-4e75-8b5f-d7c4de7f2de2", "comment": "Malware payload (Heodo)", "value": "fda79dc63bc67c8fd34e6bbb259397f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594498, "uuid": "516be219-e9ba-4f81-8d19-5f5ee2036d7d", "comment": "Malware payload (Heodo)", "value": "f49cc44af04d062a424f858aebd21330c2087dd2cb452b5c97405cad77c0f37c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594498, "uuid": "bc02b837-6dc4-41eb-be50-903ac99ece00", "comment": "Malware payload (Heodo)", "value": "e88c48c755e1a9121edd7b2d95064c7199d688ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645594498, "uuid": "acedb55c-219d-4425-83d3-de1f8cead992", "comment": "Malware payload (Heodo)", "value": "37bbaf96b986ebad48944cad52584d79b1d1e15b51030af107db6fbf4414a97693a5b4122982343fa232bb18d6a9b27c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594498, "uuid": "2041b296-c0dc-45e1-b23e-8973d84c640e", "value": "T1EAB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594498, "uuid": "fd508475-780b-4e76-b245-291736883f9f", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594498, "uuid": "a2939346-34bd-49a9-a9d9-f4234be9f785", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wNIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWKzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645594498, "uuid": "f55d412e-7f8f-4289-b09f-4f4235f37867", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645594498, "uuid": "7b052142-f69c-4f96-9a94-fa9ebe39144e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645594498, "uuid": "a0401bb0-cd9d-4597-a89e-aea19ad49113", "value": "fda79dc63bc67c8fd34e6bbb259397f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d5dc53-948f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645610467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610467, "uuid": "9d08f01d-c5fb-4c2e-a64b-96539c94c530", "comment": "Malware payload (SnakeKeylogger)", "value": "5b358ac74b63c662d055fae2f93041bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610467, "uuid": "151a9010-b892-4732-b886-9d4dd51e4a62", "comment": "Malware payload (SnakeKeylogger)", "value": "f4ea9337150c967eb764ee263e24645c93aa7798eaa211317f92c123fd0602dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610467, "uuid": "dfc53d3e-8925-4cbe-82d4-883f0afc20c8", "comment": "Malware payload (SnakeKeylogger)", "value": "2f40f763e9d1d55de70ca103e3106e1bf771ba94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610467, "uuid": "6f59741e-5f8e-4238-ada9-c4d13f8571d7", "comment": "Malware payload (SnakeKeylogger)", "value": "d2be14e2fadf47b2572b3e532346d9f2099a83022dd051da87ae142837c11f8d71cbffb9f6b1078cee9aef9714380da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610467, "uuid": "f7b47aa5-d15a-477d-9ea1-3b9c6dbd54f1", "value": "T1880562983191F2EEC8A7C875D9681CF5EE903C6AD30B910790133D99BA7D897DF160B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610467, "uuid": "dc9597d2-54a0-4f46-b899-bafb4f29f0a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610467, "uuid": "8c987ce6-9a95-4eae-ac22-a8b0036ab50d", "value": "12288:y3kzR/o5NqJ6zy6kx9Woc/CTjFICnzJHixbHMyDB3XHQGM6qWdgcEmhHdHIKxus1:y3AR/fWy6+WwBnzNC//O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610467, "uuid": "3da8a42e-45e8-4f4a-bae0-1e7fde9c4271", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610467, "uuid": "177ea0ee-be4e-4aa1-8372-810f0114d836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610467, "uuid": "4f770f23-b716-416e-a975-0e79d2a7fd95", "value": "IMG1234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d20e2c-94a4-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1645619300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619300, "uuid": "8b56c82e-00f0-48e9-8c8f-4687965319b7", "comment": "Malware payload (CoinMiner)", "value": "6f926a48ae116a3404a0f83ee7c73aba", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619300, "uuid": "ff15ff97-c1bb-4d9d-b09c-1156a2a12849", "comment": "Malware payload (CoinMiner)", "value": "f5539885c9965c6b44b7bf4ea9bac0a92d83c914624091845e0c56b1af99ccb6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619300, "uuid": "44c9848e-aeae-4f5e-87ed-b7025a51d8c2", "comment": "Malware payload (CoinMiner)", "value": "f7ba225c92892f2d587b52519fbb84e61746bad0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619300, "uuid": "3b5a9ee3-269d-49e9-9311-de96c8a0cbc4", "comment": "Malware payload (CoinMiner)", "value": "645593548fdbd7f46e610a3cab2429cb07dd031fa9f19115ac94106867881283e43f2917c966244be28483f6b9d1ad44", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619300, "uuid": "b08c6796-ebff-4976-90fb-e2c57bdf59f0", "value": "T11FE55C1AE19320ECC63BC0749B6BA173F531B86955307EBF1554DB742EA2F60261EF28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619300, "uuid": "ab8810fa-aec5-493a-b698-c1b420ae9fc8", "value": "98304:DeA+e95GdVLbMr+zf/4kViIYVidkLWDHinLtOP4eJ6FOTi:Z5eDpEOPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619300, "uuid": "f08d7816-02c2-4253-9779-a8cec260277c", "value": 3146717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619300, "uuid": "de865740-53e9-4d72-9348-c22da22c042d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619300, "uuid": "892035df-0692-492f-9fe4-b895ef6ee9d6", "value": "6f926a48ae116a3404a0f83ee7c73aba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b663f8aa-9479-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645601101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601101, "uuid": "91da639c-95de-4b4b-b0cf-7bf866f97dfb", "comment": "Malware payload (Heodo)", "value": "a881aba3166c01fa4f85d2f905745494", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601101, "uuid": "b68ff81c-8b45-4afe-8b29-509c81f2d459", "comment": "Malware payload (Heodo)", "value": "f66707cf162b31ebe38b9049cf0040d11c7d0950314bba28370eea7239e9c5d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601101, "uuid": "235f770f-ee33-4cdc-9474-3af025ab6490", "comment": "Malware payload (Heodo)", "value": "40c0198a536960a49a93411440d4ba55e5495abd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601101, "uuid": "eb7e6394-4f84-412d-9862-ce72bee65b6a", "comment": "Malware payload (Heodo)", "value": "b749dfd58619e456bdec7d469c84b0a3390f10d79bab88d3e1750e9c8d6e1b2f060806977c3897e15038c5e5f12b1690", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601101, "uuid": "f8cfff7a-3eff-43eb-991a-a66560986fa4", "value": "T15735BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601101, "uuid": "4311b634-f371-47ae-bd1e-50e94161a5cd", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601101, "uuid": "5e237a96-1454-4445-b987-0ea071a5ece8", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/nTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/nTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601101, "uuid": "5cfcfba5-ab19-4442-8476-a5c3d8a366d8", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601101, "uuid": "855a7861-765f-409e-b56b-5b4709975cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601101, "uuid": "770a071a-75af-46b1-b54d-5d1fa686bc18", "value": "emotet_exe_e5_f66707cf162b31ebe38b9049cf0040d11c7d0950314bba28370eea7239e9c5d8_2022-02-23__072456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c64ea4c-94a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645617808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617808, "uuid": "cb78c817-9dd4-4a7b-bbd8-33d4d933be52", "comment": "Malware payload (Formbook)", "value": "964873405cd08188addb3258d9da28bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617808, "uuid": "3f1d01aa-ab45-4eea-a195-f6af1a4d58c5", "comment": "Malware payload (Formbook)", "value": "f84b362a10ce6a355e3d48e602f672416acddab0194b1dc0ffaa01213bf28d2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617808, "uuid": "9ad1582e-4f03-4987-82b6-2ab76e27cb69", "comment": "Malware payload (Formbook)", "value": "8d27ee25b4ecec41a89a84dfc01965d4b0cd38d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645617808, "uuid": "a0f10691-50d6-474e-abd0-db130ebf7243", "comment": "Malware payload (Formbook)", "value": "8688ac134888f9c5ab8d841230bf90f8e693081bf29626b24365e50c67e5d7d0fb66eedfd13184662420db542672667a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617808, "uuid": "d421edbe-fccc-4070-b8d4-b287e6a4ae63", "value": "T197B44BC1D6883CF5F81917724D36AD222157BE7CA9B4542E695EB42A5BF328330F2C1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617808, "uuid": "f9a5c51b-caf6-4dc5-b71e-546a874b35a1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617808, "uuid": "908945d0-6e9d-46af-b6ca-9268155bf9e0", "value": "6144:kxDy4sYGXWwpKgn3hFuqQCdRJ1fHvL9HNnBmVl3WnjRr:IGXWwpKuFui3JxDvOWnjRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645617808, "uuid": "6c4710bb-dc66-49b0-9938-4a1447dd33b7", "value": 533975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645617808, "uuid": "094131d4-f9cf-4d80-96ce-6246580d13a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645617808, "uuid": "97a3278f-068d-402b-a8c9-2fcda6afda36", "value": "Re Teklif Sipari\u015flerini Onayla - E1105,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b558660-949b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645615444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615444, "uuid": "b6941455-a1a6-497d-9a0a-e68163233bc2", "comment": "Malware payload (Heodo)", "value": "74ba038249e1fc29cacd2cb59211791e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615444, "uuid": "e399c7f2-eea0-4154-ad73-006bf9c7cc6a", "comment": "Malware payload (Heodo)", "value": "f871c25ea87313e50f54bebbccee3c41c6c6d15f30395bce145bedfb312a7ae2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615444, "uuid": "4a7487a0-2df3-48a1-ab67-df3495b0d0d5", "comment": "Malware payload (Heodo)", "value": "50b724cb96b75ce40f0f57a342396208828a9070", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645615444, "uuid": "d6862be6-ad99-4459-be72-27f34b4520cd", "comment": "Malware payload (Heodo)", "value": "1e69ea6b150dfd2c112beef4a930bd0feb10da207f4bced16ea0dd8616263a1899306ac27d0e74bffaba3755c0fd3028", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615444, "uuid": "64a2465e-e742-4a99-9a21-4916498fbe25", "value": "T13635BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615444, "uuid": "62fabc44-d995-479d-9528-ff25a8ae634c", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615444, "uuid": "42b4ed3c-c444-4256-8fb2-d6059f2b3f16", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/xTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/xTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645615444, "uuid": "215c6d89-5e92-41a0-b5e0-bc14e89ac46a", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645615444, "uuid": "ec0987fe-d204-4258-b133-663e7b63ff3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645615444, "uuid": "1ddd350b-3e42-4ada-a8d3-c0df9e17a317", "value": "X9qMBFFYT.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25785870-9490-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645610736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610736, "uuid": "9dbbe052-047f-42c8-a9d8-b9f81ee23c9e", "comment": "Malware payload", "value": "7baa64ea69f5fa343ca13283c1ca2a6c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610736, "uuid": "120594c8-38c6-48c9-8b0f-58aeedc99047", "comment": "Malware payload", "value": "f8a0ad02e44f55a0cd39a8732f454bf0ce448b96dbe530c3e23cbdf964b12669", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610736, "uuid": "0619317d-10bd-4222-af88-2d21fa6a04e3", "comment": "Malware payload", "value": "514140cd2bbea6f667bcb064e7b909ef09a28d77", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645610736, "uuid": "456e9e9f-8257-4098-b1a0-7076791c9138", "comment": "Malware payload", "value": "9a489a2e11237977193f79acb58f9f1cd84d63e517b930ad8af5b90706d33c233f1b8d6f969800fc48d58d38f5022b3a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610736, "uuid": "1e6ea7ba-018c-4293-8c72-6df1b49ee931", "value": "T1F863D02033B5FC62E28186363DD9DBE72671BC545D19C71730CA730FB8F8A5089A6A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610736, "uuid": "13ef3d4b-a0a5-4196-ba2a-dad6d805988d", "value": "768:NMMSOuUomsNgmBhSERkj6ASv5OLEaVtnhCKuqrECsU5wP50HEUNxklqTZkgGFyTG:KMSOYmAgzykOeRV9RrZoDwkUv2Ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645610736, "uuid": "dee26391-9fc7-456e-b2ce-9829b975ab32", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645610736, "uuid": "b6133fa8-88c6-406c-a1f7-52fd560b3363", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645610736, "uuid": "60e49e2f-787c-4980-9691-c1603484b855", "value": "Scanned Invoice 8765-8765-9032-8124.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804c0415-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645619049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619049, "uuid": "26295365-e3bd-42f9-bb85-30281328bf4b", "comment": "Malware payload", "value": "bde15fa669a0342e008127d9c6dbeb4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619049, "uuid": "bdb47532-b300-42d3-91c4-55d7bce7dee7", "comment": "Malware payload", "value": "f8a2d2432727bfbe88b2f75a3ac0bfd532797810c95c9cc594fb066c3df71263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619049, "uuid": "249ae40f-6b41-4e56-ae29-b8f277e132c0", "comment": "Malware payload", "value": "453222400b3d4c68ab0ca223e63b4d725a93ed77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619049, "uuid": "371e4216-3fc0-4200-b983-db9c3363496f", "comment": "Malware payload", "value": "bb8dbbf79143d8bde0cd832dbd33b2b049fd3e623e39675b94262b5a85a1b77d437dadd0b437c0501129eb7cb6aff14f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619049, "uuid": "f1f13f08-e59a-4de3-93ff-4f90445a9fab", "value": "T1CCF4020857B84B6AE57E67F89834403917B57C9E21B4EF4E9EF2A0CF1932B409421F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619049, "uuid": "aebda1d2-f873-441b-98f8-3989e079a6f6", "value": "12288:wMZ6QkLjTOlN3h86jSjpEmY9RTkX3n29yxS0MgQGxXNjdVebgN7C9:LkHT4xQjpEmYIX3n2k9TQAjjeEu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619049, "uuid": "b28fcbf2-f121-4cc0-a1f5-c6c64140fed4", "value": 771454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619049, "uuid": "584c9c5f-fc69-48d4-aae4-22271a5ab87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619049, "uuid": "253413e3-a9c6-4bd6-afd2-1f1c1a2133b1", "value": "bde15fa669a0342e008127d9c6dbeb4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80cbb71-947d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645602929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602929, "uuid": "9a12805a-44f3-4651-a683-a92429e8fd58", "comment": "Malware payload (AgentTesla)", "value": "920a159cb7251cb1b6eac84c6a8bc26b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602929, "uuid": "8110081d-ed04-4835-a8a6-414ae3e014cd", "comment": "Malware payload (AgentTesla)", "value": "f92bda75b968b87ab2a387db54ec8fe58f79b99de10464a00dc740443e89c7df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602929, "uuid": "e8b40762-22d5-459b-b891-66804cada2c6", "comment": "Malware payload (AgentTesla)", "value": "6a95876b20569250e2b32605a66a67727d240616", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645602929, "uuid": "bed74a89-566f-4a80-947f-38162e5ed0f5", "comment": "Malware payload (AgentTesla)", "value": "00efdfc60ed832e729c5337eb0292392328d934cfbfc8786994af0ac803b4dbe33f6b5e7ec8328322ca2e0249ece2ac6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602929, "uuid": "6c4f899d-8434-48fe-a88b-85cda10d8ed2", "value": "T1E96422BE71E5AC6FD1EA42F0641B6372D7BEE7180961906B57F9864C780A68331023DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602929, "uuid": "2cf55800-5c52-41b5-9d7b-ab5f8e7db2a8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602929, "uuid": "24fa94b3-265c-4c78-81ef-c0c375657258", "value": "6144:TxDxlUdsElKnsYsCtoogv3qXABApvnAhkDz5Tsv5BR3sF1iuIeb:lUdsElKs0t2qXCApvnAaz5TsP2c8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645602929, "uuid": "94e4bf4a-6e98-48e4-a244-39bb233683e4", "value": 320765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645602929, "uuid": "4b0b5a00-cfdb-4fbe-a7ad-14dca9283b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645602929, "uuid": "93e6492a-e421-480f-a0cf-3e3a692cc6f1", "value": "payment advice...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c87f7d0-94bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645630049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630049, "uuid": "7248b43b-4993-4a95-a851-31d1b33532d7", "comment": "Malware payload (Formbook)", "value": "172c463ae0ce51e60592c6b9edd9f236", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630049, "uuid": "8400e133-c30c-485d-abe8-a1ff5abc9b11", "comment": "Malware payload (Formbook)", "value": "f930832840f408a7dfdc1596867514ab4cbf385013f03254be667dcb3f11d356", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630049, "uuid": "87e7fdb4-a6f8-4f20-857b-ab56ff059b43", "comment": "Malware payload (Formbook)", "value": "e887f46dce6bf80e94782ad508da90f71f557a31", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645630049, "uuid": "c4cf6d70-c76b-4cf3-a12b-63ccbfd7b233", "comment": "Malware payload (Formbook)", "value": "3ae6af0574819d5e5735c515caab7a453c3ebf50bc311add9349d7690120087cacfa2ada3151c43ef462d4203b6f1dbf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630049, "uuid": "e642da74-fa24-4385-8b00-1abd94bf759d", "value": "T15114123837547576F1817B7E9D3CB29E162DFDC6DA732A8A18C5B1450DBAC72A0832B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630049, "uuid": "d419324e-ced9-48ac-bec3-43f23a103f41", "value": "3072:G1prAAWXG3moYjjLDkBe++vwgTGFHGxXTawHfaLzxhabLdnmu6:sS1jHkH+vwkTjxHfaLXKdmu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645630049, "uuid": "27a0bf61-3f18-4723-b961-353db839c8b3", "value": 191160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645630049, "uuid": "822f87fd-9dbf-4458-b40f-354ad11d052e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645630049, "uuid": "ec216e84-9707-49c4-bf4b-a506e6416065", "value": "RNP00267335EAB8.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7d204b-94b8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645628062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628062, "uuid": "9c1073df-4c6c-4139-833f-2b17a512c5d5", "comment": "Malware payload (Heodo)", "value": "689f0b4887f9be51e0e8ff0852ca7d6d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628062, "uuid": "f53b0d1f-2a31-439b-bf09-80366f981e7a", "comment": "Malware payload (Heodo)", "value": "f941bdf4fdb5690d8ffec50d9f867bcf6c548c1c74fe9087f44a3b23012bee23", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628062, "uuid": "d340fa07-776c-4f38-9e7c-f268cd64e93e", "comment": "Malware payload (Heodo)", "value": "ecb75fa68a6b1aa49de5a038674ddd20bf1ac46f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645628062, "uuid": "b64b727f-fa16-45b5-af75-292986eb6cf5", "comment": "Malware payload (Heodo)", "value": "beb744cdeca35ea2dd181e130ac743e3d36f5261d5aa7c89cd0d69f9b435bb4621ac970969266296542718226c4d5e4e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628062, "uuid": "640a14cc-532d-411c-b2cc-f97b12e078d3", "value": "T1C293022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628062, "uuid": "fb895550-f114-4302-b3b9-6d6421461249", "value": "1536:zQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:aDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645628062, "uuid": "ca0c17a5-861c-4553-8129-6e128f2ac92d", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645628062, "uuid": "440757b1-93cb-44ac-b6b4-1091c585d412", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645628062, "uuid": "5ce56082-93ef-4d0b-a67d-ab00603b02a5", "value": "PO 02232022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8999d0-9489-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645607881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607881, "uuid": "2faa1052-36f0-403a-9c01-baeb5f2c16c5", "comment": "Malware payload (AgentTesla)", "value": "8859b4c7c2de14734d293d91c1788740", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607881, "uuid": "1758b0c2-76e4-4ad7-8456-6fa91a837540", "comment": "Malware payload (AgentTesla)", "value": "f950ad248c2d51f7380b025e4541b8c119bb9244e6537b0c7157d9fdbff4223f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607881, "uuid": "0d654b5c-a173-4efd-bd4f-7dfe2b96b82a", "comment": "Malware payload (AgentTesla)", "value": "f484145e8af8eacf6836f734747e8bf96a61aa64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645607881, "uuid": "563ff49a-4f52-4ccb-b8e6-03f8aee2849f", "comment": "Malware payload (AgentTesla)", "value": "44de5431b9e3a95f4c91d536eac2e0b0654bc719272cf3fe5dffc945ff120414d15996838d2b97e8774ee03809d1ec0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607881, "uuid": "a780df6a-8d46-4063-b1d5-9cc647fd844d", "value": "T1017423DF22D09CB6CA8D4A3091B32AB5E3FB9B073363171B57D01D196D621835B7A283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607881, "uuid": "5410a850-25ee-4d37-9531-e7a87fd3e0f2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607881, "uuid": "13bee318-4038-447f-ba3c-3e35743a863f", "value": "6144:TxDmzIjuOwmukV6n5FV8LmXbyMjNgu8Lm1jdCiffw3e3lxTEjhoCNPhxKjRU:qthNbamGANgu8LanwGIVnPhxKjRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645607881, "uuid": "ac121bd9-aaeb-45c9-b27f-7faf6ab94195", "value": 348560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645607881, "uuid": "235501cd-c1d0-47a1-81bf-b9c22d86c353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645607881, "uuid": "34aed574-57d0-4500-ad0d-cccd70e40d0f", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe0d822-947b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645601707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601707, "uuid": "66a86c77-6388-44ff-80dd-8f33f2ca1458", "comment": "Malware payload (AgentTesla)", "value": "565677dd4d4526185a85a08aca8f8250", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601707, "uuid": "5f50a92e-ac53-4038-9883-6549bcc19297", "comment": "Malware payload (AgentTesla)", "value": "fab057e449135e0e01df2fec5179835247a71d82cbd04cbca8ae2087d2f6a339", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601707, "uuid": "51fedd87-0406-4538-be3e-85668f6cf432", "comment": "Malware payload (AgentTesla)", "value": "f26d905ae14c534b7ae24edc561a8c19c70cd9eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601707, "uuid": "080e98da-a501-4eaa-bc4f-6618e0b037d3", "comment": "Malware payload (AgentTesla)", "value": "7808a2c933b0855341e92659d084bd150599dcc7df175f33ce88b7c4b5a22d5c2d34b15292824307b7e7e59dcbbeb7ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601707, "uuid": "d78bcc7e-bb2d-4d63-9e2d-84300fd90246", "value": "T12715BE9C365075DFC967CC32DAA81C60EA6178BB830BC203A05725AD9E1DA9BDF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601707, "uuid": "11b38c4a-232d-4f1c-8045-9fd14ed34fc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601707, "uuid": "78fdb952-32d2-4b88-8f76-8899ea3c6082", "value": "24576:GdvykK777777777777ytnTsDbgbLu3FL7LqIJ95UGtmnQxpUJ7:Gdv4777777777777yBTUTJXqILRtZpUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601707, "uuid": "e6c311b3-7230-4bd9-9d6c-3944d545f2a7", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601707, "uuid": "d0e9865e-93c5-4813-8489-f50a151a90d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601707, "uuid": "000f007e-734c-4ba5-9ccc-09c349190fa0", "value": "DHL Express shipment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b68c825-94ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645623336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623336, "uuid": "c0cd45d5-9748-4cea-bd4a-19a40538b0de", "comment": "Malware payload (Formbook)", "value": "9474b755d9988d98f052571a17a44e0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623336, "uuid": "21652003-3965-4568-8971-87afa26e47a2", "comment": "Malware payload (Formbook)", "value": "fb0d40714d7c53e0cb1385130a73ad610d623fe430469c2aac140610b4d50aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623336, "uuid": "bcc088ce-b75f-45b4-99af-66b64741e444", "comment": "Malware payload (Formbook)", "value": "faa0415507d9717ee9ee16c0791a4afc8c71b7d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645623336, "uuid": "a212380e-2b2c-4e05-9720-22733153c2e7", "comment": "Malware payload (Formbook)", "value": "244d15015d99707528ecd780c612b9b48ac655128f7d99d577428d4588cd19df188c3ab2aea9d99206c5f3cb4fc42e93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623336, "uuid": "17058305-b48f-45d9-873b-86a244d25572", "value": "T1215423E672C44897DA9686B00D37DBB69B67F712623102C727670FEE381858B4F70399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623336, "uuid": "dd4923e1-b9ed-4490-89cc-b77d8e49968e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623336, "uuid": "ee4a9b3c-6140-497a-9b30-62b34de8b83b", "value": "6144:TxDPDV82MDZ7RrU1EAq3NZ/9NYY6hmKq/i8/BSf2S/:b82U7RrU1EZzYA/i8/QOS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645623336, "uuid": "1b3b21b3-012b-4cae-a28c-a67661f8e578", "value": 293161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645623336, "uuid": "f6dedc54-7512-4d3f-9cad-a988e88761b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645623336, "uuid": "814591e1-5244-4d03-a6d6-63a13ee8f843", "value": "Purchase Order(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4348fe0-947a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645601527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601527, "uuid": "40da388c-8c07-442e-b6b9-aa4920eb99ef", "comment": "Malware payload (Formbook)", "value": "05f91845566d3742dc8fb9443ede69f0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601527, "uuid": "3929db3d-6ee5-475d-82ba-343dd4425353", "comment": "Malware payload (Formbook)", "value": "fb624084468d7c727ce92a9257781be69dac3cb13ba42bce978b56a7466aafc3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601527, "uuid": "39977c87-c44a-4036-91ef-105eda2bb469", "comment": "Malware payload (Formbook)", "value": "1d8a64bab1040ca7fd0a36fa40a4869038d54c7f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645601527, "uuid": "35d798f4-eab5-4061-8544-6bfbdb2ee1a0", "comment": "Malware payload (Formbook)", "value": "7228514f0040dbf3d6f51ca31d93b694c4d0b4fc4d6335121dc97c3cf7c9d67c71fdccf902335f79e4cbbc39027b2b7b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601527, "uuid": "2ded5c04-4949-4c70-ac00-8266f7fd88b3", "value": "T1881412F1FD049019FBB2FF3B869AC7AB9CF7AC93181C661621D739158D7A42088B14B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601527, "uuid": "030fa567-75ca-4710-a612-a0a6a2ed58f3", "value": "3072:iT89YSdvHKic6iXEaGuKZCBtKNfeiwbZNstQ2FEAm9rvOago60K47ejY9A09hPH2:o8Cciic/GtH+2G2FEAirz/K4RW09h/yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645601527, "uuid": "063cb889-0614-4591-999f-7402f89c2400", "value": 191128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645601527, "uuid": "2700320c-d78d-45ac-8cee-26e4341244ac", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645601527, "uuid": "4f6944f9-372a-45ef-8ac6-ddf2a943880f", "value": "Envio de documento_DHL 22_02_2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814bcf67-94f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645655558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655558, "uuid": "00122d19-4abc-4c3b-b982-80e092380a44", "comment": "Malware payload (Heodo)", "value": "978ccff5cc75f526c1572ebb0d59d857", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655558, "uuid": "cc28d258-66f7-4a29-a2c9-cd2a057b69f4", "comment": "Malware payload (Heodo)", "value": "fc6d4a1c6eb71dfc72fd7b214e267b9f3eb8f30e8c69438a87310f9833e50b81", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655558, "uuid": "d6103b34-34be-4854-9724-b43eaba63ed0", "comment": "Malware payload (Heodo)", "value": "1a506f90a75c4670c83fdd9b4e371fa7a261607e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645655558, "uuid": "2d56f225-b898-44fc-8af8-4f02fd393b59", "comment": "Malware payload (Heodo)", "value": "723c30ad9bed61848f8ebac90a5cd8555d5e1386b8b69fb4bc6199c62b33642c34dc37a9ab10db3d36772663558e4df4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655558, "uuid": "cc85dcc0-4415-4524-91bb-2bb5231925bb", "value": "T17CE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655558, "uuid": "2915da37-6e26-427b-a080-d45fbe4d866e", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655558, "uuid": "18d9e7f2-696b-487b-bf0e-bea442e1f5ce", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKTe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKTLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645655558, "uuid": "f58f88a9-761c-41b7-a711-4830e3d47123", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645655558, "uuid": "c2ad897a-580d-4a93-989f-2ae809a8b0d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645655558, "uuid": "b90c6b37-994d-4155-9811-bbd5c2cf06f4", "value": "emotet_exe_e4_fc6d4a1c6eb71dfc72fd7b214e267b9f3eb8f30e8c69438a87310f9833e50b81_2022-02-23__223234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2f4507-94a5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645619743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619743, "uuid": "4f40b6d2-a869-4a26-9c92-44f6a180adb4", "comment": "Malware payload (Heodo)", "value": "6e0719d248642eba357fdc5d17916028", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619743, "uuid": "14cf4fcf-36c4-463e-9b79-163c8fc6cba8", "comment": "Malware payload (Heodo)", "value": "fca3cf2cf51c9882afff090b89d26e07497d6ab5edeaab8225134a1e15002ad0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619743, "uuid": "155edcca-f924-4d87-b5f2-e15b96fb41de", "comment": "Malware payload (Heodo)", "value": "8506c3da37816291e743ca1b1506ebbcb5fc349f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645619743, "uuid": "dc4b01ad-e766-4ef3-856c-6c0f5664c2bf", "comment": "Malware payload (Heodo)", "value": "bfeabeea8cbb806885938eda2abbc739f698c722f417fdd120c86f4597ba3f2dda869a02203cd9372fbeb44bde69f441", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619743, "uuid": "ca90f520-7fab-4584-bb10-34d1fd200334", "value": "T16935BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619743, "uuid": "7574eb14-2a29-4f1b-a2aa-2c9da01c9bc6", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619743, "uuid": "0f9966ca-abc8-4bec-a13b-b79aece3a978", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/KTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/KTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645619743, "uuid": "f9f34535-e7b4-491b-8daa-ad27bd41a516", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645619743, "uuid": "f2345255-c935-48c4-926c-643a1c3680bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645619743, "uuid": "81004186-cbad-404f-a3c9-30dce9d048db", "value": "6e0719d248642eba357fdc5d17916028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae07b4b4-94cd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645637165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637165, "uuid": "f76d1bfc-8f81-45a0-bd1b-a01d395fba1e", "comment": "Malware payload (Heodo)", "value": "464618b1bb56d13bd7d4c703ec9d3c1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637165, "uuid": "ce95ccdd-2acc-458c-b4be-b82fbf754481", "comment": "Malware payload (Heodo)", "value": "fca9ff05af162339f60a4ecf09b677869a4e7a53aafac856444a9673b98f9dbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637165, "uuid": "f2f13a57-16d5-49e2-946b-47924ee0a4ad", "comment": "Malware payload (Heodo)", "value": "11c90abb05e543f1f217f2cfe4da60b2dfb83436", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645637165, "uuid": "500d772c-be1a-4147-938e-e5837186f76d", "comment": "Malware payload (Heodo)", "value": "9f4dd3c11dc9d0b199e4381a902be08f8e48e6ee68d177b97b1de91a5df6366a7a618dcb98b276c0849adcdd238b4eaa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637165, "uuid": "1dae5973-574f-47c3-bda1-170f6aa23d42", "value": "T15035BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637165, "uuid": "223a94bb-2e12-42b3-a91c-16ea67c743b6", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637165, "uuid": "184f7d3b-0b8f-4242-b108-c8c0b9233846", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/xTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/xTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645637165, "uuid": "23e2d31f-fed8-4296-982e-f7e24b664749", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645637165, "uuid": "61eef978-3e02-4a41-81eb-0a5d04128729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645637165, "uuid": "a7ddf141-9bdc-4dd8-bcc7-9bda5dd462ab", "value": "464618b1bb56d13bd7d4c703ec9d3c1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04c9cfa-94bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1645629974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629974, "uuid": "ff04fd5d-6a7b-49bc-8795-add11fa32d12", "comment": "Malware payload (Socelars)", "value": "e333a1ad16f5aa8be4ecf2de9620afe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629974, "uuid": "bfafe32e-4ae8-48a0-8a38-dac82caaf133", "comment": "Malware payload (Socelars)", "value": "fcb9eed708e4004a1ff541b30efd7841156e3c139cf407fe21533b1002d74127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629974, "uuid": "d6ab9a2f-e7b0-46e9-8ea7-4017f1db01ec", "comment": "Malware payload (Socelars)", "value": "174091e35d7f96270357b067b86e2cc6ad664ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645629974, "uuid": "b0cf710f-be86-49be-9fe3-a95e2b5dd81a", "comment": "Malware payload (Socelars)", "value": "fa3ed6989dc9ef32624d764e98edf12668e9778124de7974d52e900c24441d7fc69be176c670b7f0d40e38bf4f48b2a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629974, "uuid": "a0b54386-d75a-400a-b79b-46faca46364b", "value": "T115658E11F642A036ECE3007286FF4AFE8D287E21431894D7E3C47D695E715E27A36A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629974, "uuid": "fbdfe7d4-4a15-48ae-bcea-6a1b905326c7", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629974, "uuid": "a12769e2-3121-40e0-a2b1-9f1620f5adec", "value": "24576:gmpzgGd5UyylnSF99NfqLi+gJmssUZ6wEi5nLYuFqgyvNM:LplDlmBvIp5nLYuFtyvNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645629974, "uuid": "924338a2-2963-4a77-939c-15ddb75dc81b", "value": 1491456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645629974, "uuid": "dcbaf070-9033-4420-9558-f426c18b448c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645629974, "uuid": "d9d2fff1-9fae-4225-8468-12891e9a155a", "value": "e333a1ad16f5aa8be4ecf2de9620afe9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bc5af1-94b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645625818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625818, "uuid": "b2105d70-e098-4413-91e9-15a55507f248", "comment": "Malware payload (Smoke Loader)", "value": "831081db0026e04d7189e8239fe30b8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625818, "uuid": "cab65c5d-7086-498e-af1b-0488411ca094", "comment": "Malware payload (Smoke Loader)", "value": "fcf12026f370daa296e7820ce0b64cd8a63bd63ebbc7fef08ff0dbf24fe024f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625818, "uuid": "971d9833-ff4d-4139-8fb7-1bd7ebaebf51", "comment": "Malware payload (Smoke Loader)", "value": "e662a47b8cb3e4d3fbd92d922f9bb9daa71a19e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645625818, "uuid": "77717270-3c79-4b2a-be8c-2bf300c44733", "comment": "Malware payload (Smoke Loader)", "value": "c5b9c95039e40a79093685f77654b944b7dbfc9744d94eda861ea88e40518005ddccec483b3f4ef1b30985fc856ff1b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625818, "uuid": "89d38ca5-8c55-4aff-9109-f44192e55afb", "value": "T162F42311FD79C493CAFA143018BA63F7DF6239A60663C7530760FB8E3552A50B939A68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625818, "uuid": "36b33724-ae92-47ea-92d1-3f68374e54a0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625818, "uuid": "6b2df447-c6ce-4581-8dc1-bfa185fdf0f4", "value": "12288:iblEFplTpLHvo09Impr3mH3laistR0J5AtePPW92/rutMyljWM1QEFO:iblEFplhh9IKr2H3labC5AtSW9Q2pQoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645625818, "uuid": "011b6aa3-9f22-4aee-95b0-04d0ce294a71", "value": 729648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645625818, "uuid": "1709ed69-385d-44c1-958e-529583117f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645625818, "uuid": "33f672f1-2c98-462e-90cb-75eb40648516", "value": "831081db0026e04d7189e8239fe30b8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa8dc97-9457-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645586540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586540, "uuid": "ae409169-2d95-4f2a-ac83-572ffe923c3f", "comment": "Malware payload (Mirai)", "value": "208d0f126e32bcf099af6f00dcb45935", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586540, "uuid": "9e9fc6c7-764c-4262-a277-0a42b02582ee", "comment": "Malware payload (Mirai)", "value": "fdb28637cde46569242a85d7d77ad0997c8eb1888eb0f7c7f6cb5e9e82e35810", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586540, "uuid": "0f6c9770-8104-430f-b2c4-96ced5acffb8", "comment": "Malware payload (Mirai)", "value": "80f722cc701a2999a209249a4f7ac7c4bd503288", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645586540, "uuid": "429b49bb-299c-48c7-b79c-15a5f5e2681e", "comment": "Malware payload (Mirai)", "value": "db6ceb0b679ede7be1b559c7a138a3f017c089672205a172c7095f7b59ae81b5ef37ecdcd171158f948fead8a770b324", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586540, "uuid": "1e5edfff-842b-497e-b000-1cea8e199066", "value": "T1F342A8A2CD597F24E20891B061224F35A763E519EA979FBB112A8518D003ECCF7563F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586540, "uuid": "b78ec282-8e1c-44eb-b819-55445621f9eb", "value": "192:69OSi13NbhjnIjXMZsyTxqYRdsHuwvIDU/5MrqBHea7PPa71cQDeDJPkQgFehGuB:Si13NTsyVhQ/SqBLIVehGro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645586540, "uuid": "da9aaa0a-ef44-4946-abdf-ea5794e2fbab", "value": 12352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645586540, "uuid": "d1dab404-a6b0-4b65-8b64-4af5db7c582b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645586540, "uuid": "15a733ca-16b3-41cc-8b9c-b9e4ef3a9946", "value": "208d0f126e32bcf099af6f00dcb45935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228a6d6a-94c6-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1645633924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633924, "uuid": "37ae4cda-d227-46f6-9adf-6630d1a51f71", "comment": "Malware payload (GuLoader)", "value": "adadc1c53050347fc7ddd9a0558bad8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633924, "uuid": "dbde29ad-20fc-4cc1-8ff0-b9caa94ecb6c", "comment": "Malware payload (GuLoader)", "value": "fde4a513bcaa3fb7429b67363cc8e25b19c8b0490dc11675ac4bf1e8e19090ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633924, "uuid": "f69dc0eb-b018-4810-a0c5-24d8a6b6382a", "comment": "Malware payload (GuLoader)", "value": "f8213cc0618c9c14514b7cfdf6ae63893a44f8c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645633924, "uuid": "11ea7ab1-8130-4a08-a8a8-5f1cd3ec343a", "comment": "Malware payload (GuLoader)", "value": "3e253db41952500499d438eec00a985178870ad5eef5fb0af8a2db36ae7fbe04b47e597c61556853c7a632795a537c86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633924, "uuid": "55d55635-c920-4dca-8832-c4ea52321cfa", "value": "T115B412C37665C467DDB6073248676F251BBAEF312AE09D0327583F876DB2281DA0E346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633924, "uuid": "3c69ca11-a86b-4a84-a23b-21dca38d4a99", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633924, "uuid": "a976a087-a8ef-4c43-9d39-02d0f39f7150", "value": "12288:ubNWige/HVNgriVMOEO3vm0u1B/7bOq0aeRyvQB2CH:ub4svVmn8vmxFbOqhOyIBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645633924, "uuid": "481ce133-0da5-4984-95bc-1ff65a49dffb", "value": 496152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645633924, "uuid": "5102caeb-c5ca-4d53-9084-db974332fcf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645633924, "uuid": "c667a9e9-72dd-4fd0-9dbb-f8e12f13ce16", "value": "Transfer-23-2022 13-38-33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ba81d1-94f2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645653022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653022, "uuid": "2721c4d7-fb10-4c67-96ae-bb0f401b6f71", "comment": "Malware payload", "value": "77c34b26b2566eed21f632278f14f207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653022, "uuid": "998138ee-7014-4852-958f-b55da95d096f", "comment": "Malware payload", "value": "ff27659280dcea218aca5e534c38c7d31290ad96225387802514dfb74ed9cbf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653022, "uuid": "10356b56-c6c1-438a-99ad-3bb5372d1db5", "comment": "Malware payload", "value": "74f886c34e55752ec8f04e74ca001888e9e58fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645653022, "uuid": "1984dfa1-667f-47ea-a708-7df0dde234a7", "comment": "Malware payload", "value": "4162ce15f877a1b39559d5a62b8b9cefc690d610d08137aace15cb79cf9dc84216b21bb076231a064c2869ea8643cdeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653022, "uuid": "554dd30e-f617-4e42-bcb6-83a41e297cbc", "value": "T1DD047D67F1C0C873D1631A78DE55D2F8B42ABE202D78545F7AE48B8D853B6E038292D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653022, "uuid": "1c312742-6991-42ad-8748-ef8d1638e5df", "value": "532816589b7c9c3bed0fbcc3d1503ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653022, "uuid": "1ec065a7-0e45-4d1a-a980-8a741732ac6b", "value": "3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8K:o68i3odBiTl2+TCU/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645653022, "uuid": "539d6d62-0cfa-47a8-bf48-733bdffd6802", "value": 185507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645653022, "uuid": "e9009d22-3c31-48a2-994d-03fd65b85015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645653022, "uuid": "998c3288-8370-4e32-a0ba-db8197e51d06", "value": "adv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39237721-94a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645618930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618930, "uuid": "f2f5f2ae-6f92-4359-8ae9-06046667bab6", "comment": "Malware payload", "value": "97f8ff8dedfa23d71031d6a43e3fd7de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618930, "uuid": "57ccd4b2-198f-460f-801f-f642728b0641", "comment": "Malware payload", "value": "ff450b4da194b16f155863e0cb11de69119bfe2cfce1ec184a6409e3e2cae58c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618930, "uuid": "686f4e69-3588-4704-abf2-d73ccc831204", "comment": "Malware payload", "value": "025c921ccc84c44cd57e5de840a1008cd66b703d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645618930, "uuid": "9007f74c-dd3c-4348-964f-d9b997b0c6dc", "comment": "Malware payload", "value": "d4c339d885469a467e44cc0a0f71d70dc3a2799135911eeb62ddb310da2f41c9f233722a9061c648dac6e8bfc4570ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618930, "uuid": "ce3047ad-882b-4429-aa9c-cf7f2a943b44", "value": "T1FAE312E7EED7C240E6F090B1017AC3843B93D222DC1DBB95AE575D528CB05809997FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618930, "uuid": "e9cdbc72-3d9e-449c-a9c2-bb0245e17b5c", "value": "3072:oprNUtOEZOvmjV0A24j6pSeL4cw8XlIdwfcP5s2hpTPV1g:ptOiOvWy4Gx4GlIwfg5sGpTta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645618930, "uuid": "3f5494bf-bfd7-4820-91e9-fc80fbd285da", "value": 144537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645618930, "uuid": "2a971f51-dd36-42f2-b431-ba97d9b2d2c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645618930, "uuid": "2722c027-11c1-4321-b0db-598189a34c33", "value": "97f8ff8dedfa23d71031d6a43e3fd7de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }