{ "Event": { "published": true, "date": "2022-03-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-03", "timestamp": 1646352182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "527db31e-0340-4c1c-90a1-be9cce4334d0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dedc67-9af4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646313412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313412, "uuid": "2c86262a-8b0f-41ae-98f4-70f61ea5a0a3", "comment": "Malware payload (RedLineStealer)", "value": "006259f0f86cea4f114e8c4a593d198b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313412, "uuid": "36384499-8a76-4013-a60b-0ffec0faa806", "comment": "Malware payload (RedLineStealer)", "value": "0016d7e725a7387d3a3992bc27c13a9fe30fffe737808580619ec1e7b7237125", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313412, "uuid": "e94cd208-b16b-44f5-8626-7030b9846986", "comment": "Malware payload (RedLineStealer)", "value": "e76a40fc414978fd89fc21b9ab036007cb7ce622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313412, "uuid": "483ab012-b441-42dc-a2e7-fbb143210407", "comment": "Malware payload (RedLineStealer)", "value": "1b259a856b091d79aecd7f0886d784d045e5659116c86d8c2a67fea6c2210894ec10c1aa9b05ed8a18eaf43d7689a95c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313412, "uuid": "4cb75192-366a-4098-beb4-0d07fcb7674a", "value": "T1BB3633840B729B5DD34FCB7D0AA51F4A777EE17C2881522B907B5A22194E3BE3C513B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313412, "uuid": "59b5ac93-a40a-4725-ba13-eb76dd4b9bf5", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313412, "uuid": "0349fadd-197d-4bde-a56a-4d06cfcb427f", "value": "98304:D2PGc/jelruFK423RbA/A+48tAf8uRhcL0d5AxO7laDOw:D2bj8HDbAY+PGvR0xAAOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646313412, "uuid": "295edacb-420b-485f-80b5-72a1424f0fba", "value": 4875776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646313412, "uuid": "cef0b75c-1c7e-4bee-9597-424d921f0534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313412, "uuid": "4fc8543b-582a-4d50-a2db-581253ede941", "value": "006259f0f86cea4f114e8c4a593d198b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f14e03-9b41-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646346483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346483, "uuid": "ece4b058-3fe3-44af-9d02-2873c0c90965", "comment": "Malware payload (Heodo)", "value": "0d926c0a0aa20280ac679cc57f585ea8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346483, "uuid": "5eed56ad-0e50-40c7-9bb1-b3f9135dc3b0", "comment": "Malware payload (Heodo)", "value": "01960a5912a252411c6e5f136bca1f7b1905db026efdfc31e3a573017dd597a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346483, "uuid": "b5271c42-d9f9-4f52-9950-798938f8a561", "comment": "Malware payload (Heodo)", "value": "4a95fa544219d3edabccd6130a9a4174a5ea7bb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346483, "uuid": "cb9946c7-c7af-41f8-8cf0-e4f2c220e01c", "comment": "Malware payload (Heodo)", "value": "613de99413017e9317dbd4f3e6866dabb81b37ce93ecd6ba117e0f9028be008a8184eb8a89ea7d268ecbd0b5aba0249e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346483, "uuid": "a63a5b1e-d35a-473d-8960-02b5b8385dca", "value": "T14ED47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346483, "uuid": "e4c2ee2a-8aff-43f2-abf1-03ad9f29ebf6", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346483, "uuid": "d4363fa3-71dd-416b-9685-c0a7e77b52fc", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRL+CjzhmD/bwb1r8Hc:Bg4IqjYT+20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646346483, "uuid": "900c61cf-4f50-4ea0-b0f3-1c05e68c8167", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646346483, "uuid": "6a605dfe-59bc-4bf5-8f26-0fefac42b0f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346483, "uuid": "3eb40c70-53d5-4be8-829d-ca2c1cc24bd8", "value": "0d926c0a0aa20280ac679cc57f585ea8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26c16de-9af9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646315804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646315804, "uuid": "0b342608-35e1-4d7b-96a0-99261165e567", "comment": "Malware payload", "value": "f8b281926187192ae9a60bd4c487b0bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646315804, "uuid": "1e536caa-096a-4a20-855b-90e2f85c3111", "comment": "Malware payload", "value": "019893a566467ead6c839c51be10da34bd17c83c252c7e7e9178ecc9a7a85e69", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646315804, "uuid": "1c1e435c-2fd4-42db-9517-ef96cef1423d", "comment": "Malware payload", "value": "fa8436fa910666d98b4f8658ef9be03a6f8adf18", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646315804, "uuid": "d8727860-ea66-4929-b785-451753e3dd84", "comment": "Malware payload", "value": "3e085b89c3eb54ae8d238abbd9ff263e43c7cc424fc9b58a3c6e672a7c5edeb8c018c45716660eb05d2e5d9762003058", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646315804, "uuid": "5f56a0c8-cf37-4b38-b035-90ae5137b0d6", "value": "T1AD14D71FF5931E51EACBC23482BDE32143E60C20FBC285E97A445BAD1CA63C667947E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646315804, "uuid": "a40c41ec-7b4f-4f46-94e8-5a5a1325e048", "value": "1536:6FPawVytZzY+0KvfFL2VnXgJugFUNCkQg9+0MnUroaEEC8QEE:6sDTz9nF4nXkugQB9+laoaEECtEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646315804, "uuid": "65c0b7a5-24c7-4bc4-9692-ac4eac8f5669", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646315804, "uuid": "c98477e6-ab82-4fca-9582-768f01221179", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646315804, "uuid": "b57b6d2c-820b-4276-b541-4301a8f56a00", "value": "019893a566467ead6c839c51be10da34bd17c83c252c7e7e9178ecc9a7a85e69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1944ee-9af2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646312896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312896, "uuid": "e3ef6bed-d4e3-4eb1-b337-4445c65a9314", "comment": "Malware payload (RedLineStealer)", "value": "050d9b187f54c51f9b6b6731431bfa20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312896, "uuid": "6787c43d-4463-4689-80aa-9748fbe25bb9", "comment": "Malware payload (RedLineStealer)", "value": "01cd20f70dc0541333bcfce45ad492b130cc984e6d4c2b29f0c9f990e7e63edb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312896, "uuid": "e4652f06-e5df-49f1-ab70-891a98b6071b", "comment": "Malware payload (RedLineStealer)", "value": "ddb22df5d711ab41566401d2ae601427fe23382c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312896, "uuid": "481e06f5-e39e-408a-80c1-f9d453e82ff3", "comment": "Malware payload (RedLineStealer)", "value": "6b38beab9dac44d2d8a38e8a4fb4adb66343a4f1ae0e66f6a1e7051f8a93baca39157317118aa966191cee754a8e02e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312896, "uuid": "ca89c59b-5040-43d1-82e1-cc6a761dcd41", "value": "T1023633E039EB10F6E06E3DF506BEC11367648C3277BCA126B3498AF14E2585A7D644B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312896, "uuid": "7a4a5ac8-d8a6-4cfc-8523-bf046d3c7eb5", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312896, "uuid": "733d7c77-5ca0-4c75-8b02-875cb43e0221", "value": "98304:14XM2jQNCkDrQIwV5m1NxzhUUNYPNY5mW3RB8gB0xPvVNq20BK:qXM2zOdwV5m1z2Y5mWBB80ovq20o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646312896, "uuid": "88250fbc-3fb2-4746-b230-64de930b5972", "value": 4873728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646312896, "uuid": "a77ddcda-e6aa-400a-a120-7c4fe0f4dd9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312896, "uuid": "656d12cf-b49a-4d44-9cac-3535aa4e1c22", "value": "050d9b187f54c51f9b6b6731431bfa20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c365fc9a-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298196, "uuid": "9cfdefb4-05e6-4578-a9a3-f11e3b52eabf", "comment": "Malware payload (RedLineStealer)", "value": "15b4c16a159fea78484ce13f7baec5e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298196, "uuid": "a27bebfd-8f21-463e-a39e-d5d41fc21842", "comment": "Malware payload (RedLineStealer)", "value": "01d9bf77b9ab1831bd2dcde2581c6aed3b44bccdd4210ba3144f1b7118f7847a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298196, "uuid": "b87b689e-12f4-468c-90c0-c07ca96410d8", "comment": "Malware payload (RedLineStealer)", "value": "03c90f49538bfb43e48255b75c5033ce04faf4de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298196, "uuid": "0880b724-6575-48c5-94b8-1222e6f6738b", "comment": "Malware payload (RedLineStealer)", "value": "8c226ddfde00461ad45287fb71ed041e29c3426b0b53b78deb94166c52eea1d44982ba141dbcb8ac9f3aa374cc933a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298196, "uuid": "ea4bccb4-49c0-41ee-806d-71aa6a08474b", "value": "T1336523AE290BE4DBE3ADACF7665E26835560C43981D8770F31E1F576852023605CF9BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298196, "uuid": "2b0c33c9-5393-4cdf-ac75-775258471244", "value": "61f94f254ce315400734c4e748339fbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298196, "uuid": "d4b29488-6d4f-4043-89d6-c77b9641ecd7", "value": "24576:tYuH3rOI3np6Y3ao5j8d67RoYgGK1NHpF2QV4lsh8xHKa/0T2L9pdrVqEj:iuXRTKBd67RQGU4rshmKARTVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298196, "uuid": "2c6012e0-977c-42b6-a5f2-321e8a043859", "value": 1534048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298196, "uuid": "e93e5607-0199-4d90-96cc-7a2f194c0cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298196, "uuid": "b62fbc38-e834-490d-8bf7-ab3bafedbc5d", "value": "15b4c16a159fea78484ce13f7baec5e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3e2ec7-9ab4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646285895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285895, "uuid": "c57ed784-3c15-4c06-a6ce-bac624b524b2", "comment": "Malware payload", "value": "94e59602c4b07e3518a31d496556da6b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285895, "uuid": "440b3015-9937-4b05-b122-3fee5838ab9a", "comment": "Malware payload", "value": "0249f25f1b82b6f42f626780bb6f5633b832725309b698c2b83b0c1585ad89af", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285895, "uuid": "5a5d91e3-03e0-48d5-b125-2e4cea330ca1", "comment": "Malware payload", "value": "bd509e133fefaaeb87c1cbe6b804833b98a91ccd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285895, "uuid": "5efebb2c-ad28-41b5-a913-701c6b9605c0", "comment": "Malware payload", "value": "0561011477d609191e0449489fd219bf42ffba54067700f99110e3d004e9ce13d8f67979f8e3b63f89093b07bd45eaa7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285895, "uuid": "446f1949-2585-4f2c-8ec3-3430f1b318d4", "value": "T1EC1701A7F369EF9BC4F797328979223215560D609B8397D36C04723C36B3AE08A45BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285895, "uuid": "cfe2d0f6-b4e9-4c01-bb5e-7d23eedcdd54", "value": "393216:I3Ek1Lt7mKtptiIgJcGsrl6/zo434f48rtqerY4SgTj2JJ1:hk1LtaKtmIrcboh34NgTj2JJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646285895, "uuid": "c7b649a4-e87e-48eb-921e-339e177a7b41", "value": 20247839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646285895, "uuid": "b92fdf2e-2219-4c4d-a9e3-80f14d845b32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285895, "uuid": "f5bed59e-616c-45a9-937e-12438d8d0452", "value": "Color Emoji Message_v2.1.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea7ca37-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320978, "uuid": "afbce44d-af02-4802-a22c-e99a48f2eb5f", "comment": "Malware payload (Heodo)", "value": "2448a18d8105a931d3db566d0090d3dc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320978, "uuid": "fae92a1d-4b53-4ce4-b1fb-3d43d7a95768", "comment": "Malware payload (Heodo)", "value": "0413c4bcbb918e15b297acd63b07c8e89bca6c059d00afeeb83d66816e9e3206", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320978, "uuid": "0574bb78-e2c0-42a2-9f9d-4359f3246cd3", "comment": "Malware payload (Heodo)", "value": "4d6e6c3785ae7ce647cff9648cb6b44ffb0567f3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320978, "uuid": "4bfa6b82-e2ed-4f3d-9584-4bae5809abe3", "comment": "Malware payload (Heodo)", "value": "abab79d970fffe02931cd0355711506bce5828125029518081320161af2ecc9e82afea3a3c1fd9e333d1c092b4940931", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320978, "uuid": "d6e9f4d1-dd33-4dbd-be80-2cab11efb8d0", "value": "T19723E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320978, "uuid": "7e1f0c20-cdab-4b97-80b0-b4417d70977f", "value": "768:WqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:9rVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320978, "uuid": "b561cefc-53b5-4124-9785-1dd3ef63fd63", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320978, "uuid": "5552c365-eddd-4dd4-ab58-9df8293c70ec", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320978, "uuid": "8cb374fe-6572-4b9c-b9ce-83fb3da3d398", "value": "Insight Medical Publishing_5.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3df9e7-9add-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646303578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303578, "uuid": "b8b6ac60-8f92-4e8b-8b59-ef4761e81a67", "comment": "Malware payload (AsyncRAT)", "value": "8be2796c69d85aadf258ce9497179c5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303578, "uuid": "26434e0b-1e64-4925-8627-85d6cd901b69", "comment": "Malware payload (AsyncRAT)", "value": "04225fc455d82d5149c57085c40b64b2148210a48a64518c55920f7baa079d43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303578, "uuid": "7cee65ba-4b3d-497f-ac65-25e7b65b05aa", "comment": "Malware payload (AsyncRAT)", "value": "275d85a9bc2fab0f238310bfbe96f72edba472bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303578, "uuid": "ebe8d31f-77dc-4690-8cf8-b2f502960ebd", "comment": "Malware payload (AsyncRAT)", "value": "5c2ae3d101b7c5b6458fcc6a36dcfdf95d89bb29f49afe58af73c3d2bb210ef4f03c514db325a62526c16ebe8f572135", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303578, "uuid": "15082989-e556-4988-a29c-c02921c6c656", "value": "T14B74DF5D97D7CA96DEA45ABAC8B337F05F108C66E0BB829B45413C0429733E9BE80DD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303578, "uuid": "0a6e132f-6c40-4c31-81d7-2c5961730fb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303578, "uuid": "d9c793d4-92c2-476f-b634-191da5c813a4", "value": "6144:ZbLXYJscJRItMeBmEqaEGUxKST2VLGwASlSAyyE2S8umcCGjZRBgsIKEwBP/DGDp:mJyhBmEBIou2VLK2mbH5tPrGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646303578, "uuid": "9cd6a71f-5443-47a0-aba5-7b66a822c084", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646303578, "uuid": "830a8238-160c-44ad-ac17-130f6f18faf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303578, "uuid": "db5585a1-0f14-4159-a86b-f25d9411ba0a", "value": "8be2796c69d85aadf258ce9497179c5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72174228-9b38-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646342727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342727, "uuid": "c107573b-215c-47ca-8457-261e112ad747", "comment": "Malware payload (Heodo)", "value": "fe98524becf614b5fd1251114f7f4655", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342727, "uuid": "7b9a7b31-d58b-4a60-82a4-f6171a992671", "comment": "Malware payload (Heodo)", "value": "049dfa9d1b5168ade14c60eb80eb538a820fbcd49c9dce987d19b0936ffc8185", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342727, "uuid": "d9bf7fe8-a650-4e5c-a95b-3dee21ee4935", "comment": "Malware payload (Heodo)", "value": "ceae726fccc3e5b11faa0bf29f4b3093abcbb66d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342727, "uuid": "57ce16d4-6b4e-4aef-98a4-4d5e670327ad", "comment": "Malware payload (Heodo)", "value": "4f5be1a229f022a27f4cbf39780ff700af329c4d713bd58780a7e107ed10a0bd0a35b40553252d47b4257b26c4e36e9c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342727, "uuid": "fc4a7425-460d-458f-8d16-37a0a1dd2850", "value": "T1DD13D02DC0A21A99D727253CE6148BB4134C1D4B56A0FA9F1D54A39C3B6A1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342727, "uuid": "60b111c7-5bf6-41f0-b3e6-d56cdd5e3dcb", "value": "768:SknyGomihd8DOevZCwtCyKfcrND59V+L9Rw4eWrXcTqZ0Vfs3GTE:qGom8eDmylND59V4jwmXc2CVfs37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646342727, "uuid": "34b8cde7-4ac9-4029-ad61-8a2dc3e4fb7c", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646342727, "uuid": "3041fb02-ead0-447e-8e06-e4899ce06b38", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342727, "uuid": "166ff184-741a-4c20-91fa-a040cb6b7fc5", "value": "DOCUMENTO_8569.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dae5a5-9a8d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646269132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269132, "uuid": "2fa9da0f-1eec-4dc7-ad4a-26156c51e995", "comment": "Malware payload", "value": "ec6429ab60165a2c7433b7aa51d1aaea", "object_relation": "md5", "Tag": [ { "name": "ChangeUP", "colour": "#FFBE23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269132, "uuid": "d63f35d2-debc-4904-ab6c-86a35280d8c6", "comment": "Malware payload", "value": "04f566cfaf2bfb1162fd51e509cd1fa5ea33927d6432b87dcbdfd1a786a3b05c", "object_relation": "sha256", "Tag": [ { "name": "ChangeUP", "colour": "#FFBE23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269132, "uuid": "4d4c93fa-67d7-416c-8525-b384ea059b58", "comment": "Malware payload", "value": "cf77e66283238797e0bc25deb97e314c6a0f1a5c", "object_relation": "sha1", "Tag": [ { "name": "ChangeUP", "colour": "#FFBE23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269132, "uuid": "df250d08-99d5-445c-a8c6-58a1768304aa", "comment": "Malware payload", "value": "1052b2f73529486d0dabc1ffc9a13140036123fe24bb451ced600c6a95e7916cc437c087cd011147dd6f86f195972cba", "object_relation": "sha3-384", "Tag": [ { "name": "ChangeUP", "colour": "#FFBE23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269132, "uuid": "7032dad0-866e-4980-bd99-3583ed4c8fb7", "value": "T1DD541D68E3E321C0D8669D787183B3DB883A3065BA331496D7162795CD29F80D72D9BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269132, "uuid": "dcb5ef85-ff55-4318-8534-1c63bf6af610", "value": "4930c2b564cda8c55ff91cefb29e66e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269132, "uuid": "15c763b4-d6f2-4491-961e-00f1c327f4a3", "value": "3072:r4pcPIDHQXftsa01SOq1RY4uJr/I5fEKcpGJsXS9iuDh:ocPIDd+JleGJ9959", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646269132, "uuid": "cca6de8f-3826-4dc6-a157-08113570878b", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646269132, "uuid": "8cb08b19-d5b2-4338-83de-c47ae6e59b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269132, "uuid": "e9489d97-1c1a-442a-9ea6-561b6713b342", "value": "Kbgiz54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d192c5a3-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646320983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320983, "uuid": "acae555f-4451-4c33-b76a-eda51f3b2111", "comment": "Malware payload", "value": "5f0b3f7fffe10703a7d3db4704cdb771", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320983, "uuid": "3be30cfa-b58b-43f5-a9df-51970d7cade1", "comment": "Malware payload", "value": "055c27d6976963bb70f2638916975a46bf445a4ebc8bf6094791e1854aa34334", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320983, "uuid": "1bc86939-fe2b-4f9d-aae0-857c1af6a6fd", "comment": "Malware payload", "value": "aa7a6e590a327ed568a4e78600912a00f8d4697e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320983, "uuid": "297c7b0b-794b-4fd5-a854-41332b047a33", "comment": "Malware payload", "value": "e92003d3851528431154bc3abeba3f37ac9773b8b9bef28e42b949860ee686819400049d6b08741ea2043a0ff275d652", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320983, "uuid": "8bab6cd6-1e00-446d-9bfb-746d3579aefa", "value": "T141527E1895BAB078C323497ED41645EBF65C00468156B9AB38743B8D5AC22FB13CFAFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320983, "uuid": "64adbd51-d6f5-4395-88ca-10714d01eb2e", "value": "384:a8upOnsFYH4PZa+jm3UlM9zampSYQa4Yi:mp4YPZaqm3xzFQwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320983, "uuid": "ea11da47-214c-4668-a724-8b5ad4cc5087", "value": 14041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320983, "uuid": "f3bf91c7-304f-469f-9d51-4c5a55899d98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320983, "uuid": "1b9a1620-8c79-42af-96ad-6d627f194a12", "value": "Lease Rate Increases.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f12ca8f-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646300470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300470, "uuid": "650e0ff9-f19f-4327-868a-763addb327ed", "comment": "Malware payload (DCRat)", "value": "7d8e9f911abd4a98855ba0ac37ae9396", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300470, "uuid": "ec7c616a-7bf3-46c5-a7cb-a4b648c6e3e5", "comment": "Malware payload (DCRat)", "value": "05963059249f086c08d8487b82e08f4e6ba91ec4391484cf2bf54258aa2e6a64", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300470, "uuid": "ca461e48-0687-4149-a6f9-5226af4175fb", "comment": "Malware payload (DCRat)", "value": "984697307d4c5f9ff36286a0ad743d26bc685973", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300470, "uuid": "60d89d1c-7957-4ae4-9720-ad70908b6a38", "comment": "Malware payload (DCRat)", "value": "cad2ac44e8bf24910e9a3be1cef57cec9e444fbce33a0f4bfb07da89b3365f3345009e4359fd1ff74da3c2fa6333acba", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300470, "uuid": "33d8ec10-f982-4085-aa3d-b0aa26ce97bf", "value": "T127F423516A47E208D2621AF37F3EFB170322375674C8CBB1FE91752BB8A04D8766146E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300470, "uuid": "f304bde1-564f-4a6a-8a64-b66a8024d93f", "value": "afec26099e3f11d466913b19e228f448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300470, "uuid": "5a13e2c1-57ee-483f-a883-d7fddc59a916", "value": "12288:ta4LrXpPMxl/685yWqOn4g9p1dE651HrNNgqGK/lGRgOUqmq9kR6lhKXJ/DZgcxm:1I/6hOX5WqGK/cRgOnmq9g6Gacx6mSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300470, "uuid": "5382729e-40e5-404d-88a8-cb8db963f4a2", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300470, "uuid": "e279fdfe-315a-4d1d-95f4-1fb985a1c759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300470, "uuid": "0d8d4beb-7a11-4ef4-9ffa-788d68fc9362", "value": "7d8e9f911abd4a98855ba0ac37ae9396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b1408e-9b1a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646329707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329707, "uuid": "983caac9-ded1-40c2-a586-48e7e1ce66fb", "comment": "Malware payload", "value": "d6d1f3857ae4b378de0462d428c7f49f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329707, "uuid": "fffd9f98-994d-47f8-9f53-2da4af31e63c", "comment": "Malware payload", "value": "066d3bc733a57deb9de60ba81dca86bceba31aed4cc0aa2586e472be1b6e3a96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329707, "uuid": "65db3969-c7e4-4449-a05e-d74c1cf2e117", "comment": "Malware payload", "value": "4c73378b0ff9ed135a0dbec23bd8e4d346a3cccb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329707, "uuid": "a069c09c-05ca-483b-9d88-aeab40b19a3a", "comment": "Malware payload", "value": "8a6c0640799d59bc76139a6d295c0c4bd882edf6c707e02d473589d7f6ec52978927d06de00cd8b2bd688d75c9846eed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329707, "uuid": "c1c2e48f-1ef4-4fe7-8188-2152c3a67ab1", "value": "T1D803F122FB966D43CF897D7DDF708A0067EC43C00A9EA1C065ACDF95E53AA1266586C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329707, "uuid": "46b6af46-b9db-4d32-866c-d917cb57b6f6", "value": "768:EzvaihdtGcLsQL+hpsHr7k/AwoGB8fG2sV+5QZAybFoFk8NUSsP79RN10esWLlX3:E7aihXGOA6r7k/3Tx2sHZAybiPNUfBR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329707, "uuid": "78c7e7b8-99ba-459d-815c-85602941a8ea", "value": 40580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329707, "uuid": "8c0c894f-836f-4633-a668-878574030a9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329707, "uuid": "9fbdd0df-c601-411e-9eff-e0e1136c7278", "value": "tty2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b0228d-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298364, "uuid": "5f184c66-1310-4fe7-bd24-2f44d4abb10d", "comment": "Malware payload (RedLineStealer)", "value": "66b6f009f3f4ce8f96569c32f2096193", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298364, "uuid": "81d906e3-2f5f-46e4-930f-da13779dcf16", "comment": "Malware payload (RedLineStealer)", "value": "06cde650baa0c78fe43d0088f1948c7654a0330f6f59822332ccf5d90fafb120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298364, "uuid": "a4729645-96b1-4e50-b8b6-98b8be3c4d40", "comment": "Malware payload (RedLineStealer)", "value": "dd3172e90ac1966efbe958dc793904822a15baa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298364, "uuid": "bc42e4f3-df9b-4032-a5b1-557f6b7a0d2a", "comment": "Malware payload (RedLineStealer)", "value": "71c79450c1775c366dfc2c8aa6dc501da7b18fb8407ee13237df2109ced6327af4248eec3e3aa5cb98537e64c10eadaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298364, "uuid": "49e94407-be5b-4873-9ae3-ecb081976c26", "value": "T121C4239733D17E46C28E09399D9BBC377D378AB6C4D001B317B945ABAF0448D9B9813A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298364, "uuid": "69395231-7d18-4a6e-9f95-8b0789366747", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298364, "uuid": "71c33e57-07b4-4025-8fc0-284d07049380", "value": "12288:E3gNXuxPNLb4SDXuwi0QS03ULaHNqrxlKIQNoRL6nageFhBZrn:E0utNLb4SDXuYkEaHNYK3cL6agerBpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298364, "uuid": "6f351163-601d-4f86-af4a-171d0357b43b", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298364, "uuid": "e2875ee3-b7f4-4d0f-8652-43159b411cb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298364, "uuid": "23ddf5dd-3e46-48d2-a034-14fe4f20b782", "value": "66b6f009f3f4ce8f96569c32f2096193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0f0a61-9b00-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646318695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318695, "uuid": "4d0c19c6-c325-44a0-afb7-8be45a7f4683", "comment": "Malware payload", "value": "c3021e309f7a9440890f511682cbcb89", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318695, "uuid": "872d5855-5a5a-47a4-b253-03b190e95e22", "comment": "Malware payload", "value": "07120e2a381420c90943182bbb78da10c900745fd3e07822059a99f22e2f5a85", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318695, "uuid": "a0cbfb74-80b5-4e58-a219-8399acf789d0", "comment": "Malware payload", "value": "4e1d9e67f5576c0292141cf451986f29685ee146", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318695, "uuid": "9b10876d-4b0b-450b-9ba0-6d1d2578f61d", "comment": "Malware payload", "value": "6b0ffcbebaf0ab027fa5d41e742662c08d53b4ec4db2085dc13d381fe902ad585fc44634f7afc2bb87ad619b69b640f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318695, "uuid": "16d0445b-93e7-43ed-98ef-f03fda55bc0f", "value": "T13154D03C9BAD8F57E7AA0C7AD4E222604B38E44A2B47F35B105454F49EC57EB4E01B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318695, "uuid": "f21993bc-e8ba-40f2-9171-fd97aba9cf5e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318695, "uuid": "61d972af-012f-48ac-a6e9-2d1ba7131358", "value": "6144:Wmew8hbC15Pn7pdufQoQsu8yG5gxWRV4v4MnQQ:WVqvDoQsu7GeUMnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646318695, "uuid": "a06f2a42-09fc-4ebc-b767-6fce09dcfd67", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646318695, "uuid": "c4fb046c-6a40-4fed-9699-e3d41374cf57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318695, "uuid": "89dc32c6-aa0e-4dd0-a775-9b4f986119ad", "value": "Ovaausrdagqjmvqsegobdy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35680200-9b01-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646319003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319003, "uuid": "7b768f31-edb4-4ef2-9bf8-8ac245ca8836", "comment": "Malware payload (Quakbot)", "value": "a2c1f27adb35d8a67248ff2e2b636fd2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319003, "uuid": "fa6dc6e9-fa8e-4344-b01b-cee81104b791", "comment": "Malware payload (Quakbot)", "value": "0838cd11d6f504203ea98f78cac8f066eb2096a2af16d27fb9903484e7e6a689", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319003, "uuid": "bd653f59-568e-4e71-8b30-6377debcf22b", "comment": "Malware payload (Quakbot)", "value": "c7a18b534aada84a7f26adebd0e5363fd7b0d3ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319003, "uuid": "90c56079-a2cc-45dc-97d0-127918c091af", "comment": "Malware payload (Quakbot)", "value": "ff5c329bd335651e39d9c5c3f6d5b5a7bd122ad8d883b380efda33ef33bff477182412f4e133e11b015806412f1fd772", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319003, "uuid": "9e4a8e75-3289-4ecb-826d-baf0bcc77a92", "value": "T1A0B4BFB875146CE1E6BF163BC995ADE803762632DE87D8CE506477C709733A1FE1280A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319003, "uuid": "988c801b-ce65-49e9-99ee-cf66cffba2af", "value": "0383b6e78c7f005efbff386cee23786c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319003, "uuid": "4e5a851a-6950-41a4-abc2-d01fabac1a50", "value": "12288:vnKiMBsfsXtxbohL+/JkjFbK5BFHGiIDwqJ6dYiH:vA6fevoVaJmFbeBF5IDt6dY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646319003, "uuid": "bc6e36fc-cf7d-4a2c-8efa-f034ece7dd2d", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646319003, "uuid": "b322d7b9-396f-4b26-ba57-aaff7aa8fe3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319003, "uuid": "c15b9537-9aca-4929-bf50-57f68aef3633", "value": "0838cd11d6f504203ea98f78cac8f066eb2096a2af16d27fb9903484e7e6a689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798ff47f-9a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646268866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "734ec033-2d81-4d8e-9c04-890ca5d1e3e1", "comment": "Malware payload (Heodo)", "value": "a64b7f36624665ac45390cabbf36fe67", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "e6140322-e7a8-48c2-b484-146568101060", "comment": "Malware payload (Heodo)", "value": "08627294cb7aca310ab70ff760d1bffe600add4e19193c55575e5c34da32093c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "16e3544a-3afe-4ab9-ac5b-04db6c4c6181", "comment": "Malware payload (Heodo)", "value": "692db64c3d31da0f6217d541ef86e8750216d33a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "73534903-84a5-4f98-8790-65b4a3ba7104", "comment": "Malware payload (Heodo)", "value": "997c72a685f3c01b6d2c3090ed5788aed6de7a7157b01302c22a8e654119a87a557f06c2df7fbe02d7af76d9e2b58991", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "92bae6c3-b96e-4d48-8a03-5d938784a635", "value": "T198D41B017498F0B3E38918B04A858AFB724B5DB296117073F2ED378CA7725F15CE766A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "480dd501-7733-4a4f-9729-ea0096266980", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "7b428a2d-ccc7-4401-a6ae-f6d9a6927e8c", "value": "12288:pao0Se86lloPxHHVVIjqxEqRVoQmiIII999tLLLdAkkJoFLZZWbClgluPcRBATfs:AqxETMJ777u3OmONFqNJtN1v96TOAnm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646268866, "uuid": "1384f73a-eb13-4d06-a499-6de0a0fe4b56", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646268866, "uuid": "38d3d771-78ba-4967-90aa-707bdb2c73bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "09f55676-09a9-4ba5-9da0-0095c012f102", "value": "emotet_exe_e4_08627294cb7aca310ab70ff760d1bffe600add4e19193c55575e5c34da32093c_2022-03-03__005422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dc69c3-9a9f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646277203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277203, "uuid": "7dc355bd-2240-4719-af9d-f8ef553f7a6c", "comment": "Malware payload (Heodo)", "value": "af55822c6d8a51c086e65fc2308d859e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277203, "uuid": "06d59a8b-eb71-4a30-b401-a2a1b9059b18", "comment": "Malware payload (Heodo)", "value": "08824961b9701613239db191805fe7ca054c993a08b786e10c4e1d874da7ab76", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277203, "uuid": "e12dd791-b1a6-4e7d-b12a-158f674190d1", "comment": "Malware payload (Heodo)", "value": "acc431c8e8d042d611898b11dd63b889979989e5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277203, "uuid": "0b09a9f5-6ea9-42c4-b381-dc9225331bea", "comment": "Malware payload (Heodo)", "value": "a2667cd1ce9bfd4bf3d1ace81d91dea6554e584f9bd6f0b1a1ed44b52d8c5a226466436d9f3da0d2ac167a25f48dee53", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277203, "uuid": "b3398ddc-1a44-409e-9d23-6294d6c20be2", "value": "T19B23D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277203, "uuid": "d9593b5e-1fa6-44b6-8c14-2e94c6399915", "value": "768:6eoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:poPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646277203, "uuid": "d4328d71-f1cd-4a9c-b417-b1cec2679216", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646277203, "uuid": "f3f13153-1f9e-4598-bea5-652381f84fdd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277203, "uuid": "f04ad4f2-14f2-4465-a82f-bf21aabc5def", "value": "Arc_E511XOFB.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83355f34-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646301095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301095, "uuid": "f8b512d2-228d-4a03-814b-df65aac43b47", "comment": "Malware payload (AgentTesla)", "value": "57110d3a3b72babf7f8edc31de63a689", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301095, "uuid": "cbebe633-8591-4394-87d7-42d570543a87", "comment": "Malware payload (AgentTesla)", "value": "08f1016862a490c98a5ec42955d6403d407f181fbb64bb105f9777ee32c2965a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301095, "uuid": "3dbd44f4-a62f-4d21-b95b-48e77edf70fe", "comment": "Malware payload (AgentTesla)", "value": "dbd0f3dbf2608710061c16320c1592dd1fb06661", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301095, "uuid": "1567447b-b74a-4a80-abcd-5c4939fbb41b", "comment": "Malware payload (AgentTesla)", "value": "c5733d7f7e50ba4e84b95ea919f9091111018cca1957d4f19b3a22cf677e4c6157eac8ba0417e83b8b1831568027eba3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301095, "uuid": "a90ef2bf-b787-47b2-8251-79243ee9a11a", "value": "T12815CFAD325075DFC857C8729A982C64EA6074BB530BD243A06315EDEE0D99BCF191F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301095, "uuid": "ea35286e-47c9-42b2-ad95-723e5d2feed5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301095, "uuid": "2af2a947-1028-48e6-acee-94dc344d731f", "value": "24576:eSdKCyTNmcPw122kIjaIEyCCwyFFSYLGpL:ktq22Z2tM2YuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301095, "uuid": "f2811a59-2a59-435f-a737-b2fad8610898", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301095, "uuid": "9fea81cc-716e-4650-831e-5a4700dcc2e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301095, "uuid": "1466f5c9-9a99-47e1-9e09-228b27efc0ae", "value": "57110d3a3b72babf7f8edc31de63a689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff48ab73-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "9963550f-cadd-49d6-906e-aa44320e15c8", "comment": "Malware payload (Heodo)", "value": "55787b8b4c8b382c5c7935af8a12ea1d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "ada7376e-ea94-4554-9e62-c4dab681ccd7", "comment": "Malware payload (Heodo)", "value": "093fb457637a3346e80604d9943dbbbc80ce014170a509ccaa87655ea06c98f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "b30d3f9c-1f38-48d9-b1d8-d1d99af8b492", "comment": "Malware payload (Heodo)", "value": "ea72291546d1b441ea162ad9685d5beab2abc43f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "d7944e40-0ab5-429f-8688-52bca7c54b08", "comment": "Malware payload (Heodo)", "value": "1788b935f87cb077d1870faf25b699b605f75340c42360f131e672fe800a3788dbea790f6bce9fc0c593786eacd88359", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "a720bfc1-cef4-4b4c-9574-2e526d74c7b5", "value": "T15B353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "175de5f9-9c66-4f54-a13f-255147151a87", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "c200a642-d1e6-4742-aa0a-898390ce511f", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZs1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZaytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298726, "uuid": "3345067e-3441-4a20-b370-fb99325e78dd", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298726, "uuid": "da67ec51-0ee5-4888-8a3d-88466ef6ce9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "aa6fc446-0254-472f-98f0-ee5351813f44", "value": "emotet_exe_e5_093fb457637a3346e80604d9943dbbbc80ce014170a509ccaa87655ea06c98f0_2022-03-03__091159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffea5b41-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "86e2716e-b3fe-45db-9528-153f8d0d072a", "comment": "Malware payload (Heodo)", "value": "61a7e07069e98b3a66aacb9024bd277a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "aebab3f2-7a76-4c73-8a08-84c192bcd159", "comment": "Malware payload (Heodo)", "value": "0981bb2d6ef1e73f11a75eb28753c0477d49a2eb7787363bdb8ce44f9a55c868", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "fc8fae4a-1344-46cb-b81c-4b5dc732f1b8", "comment": "Malware payload (Heodo)", "value": "7835efb4e34957f91366721d9fec27a6ac14f535", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "0187406e-5429-46b0-81d6-a33d22156e69", "comment": "Malware payload (Heodo)", "value": "3833efde5875be9dea884c3791cde9f22eb16dd975c613a0d3734c20ecc3c35f65b3c5c7f9ad32b24206f1724869ed41", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "bb73e232-7d47-4291-9a84-d3505c099b08", "value": "T1F8353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "06c78138-54c0-48db-a4a0-15746c3297c9", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "dfa05e48-e9c2-4d3d-b75e-91e49794f3af", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZB1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZVytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298727, "uuid": "e2635cab-1b2f-4850-8a07-71368dd11370", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298727, "uuid": "c02190a5-f672-4443-a50a-4151efa0cec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "85619aa4-31c4-45fa-9e29-a3211697b6c3", "value": "emotet_exe_e5_0981bb2d6ef1e73f11a75eb28753c0477d49a2eb7787363bdb8ce44f9a55c868_2022-03-03__091159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce5aeb6-9b02-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646319713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319713, "uuid": "b3eac248-8f5a-444f-8914-7903e24f19a0", "comment": "Malware payload (AgentTesla)", "value": "884c9f2a7c6578a3576c4f6e8570fb9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319713, "uuid": "787735ba-8081-44e2-8ef3-095ac962cf24", "comment": "Malware payload (AgentTesla)", "value": "09843385da30b7713ea8dbcb15c722f6007bf902cdd33c56adbbb559d89b9fc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319713, "uuid": "189f7e58-8965-46f9-a7d7-e3f0c598faff", "comment": "Malware payload (AgentTesla)", "value": "e3e88ed81a213a26c9214c812f139de2959d633f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319713, "uuid": "e772ebd9-9773-49e3-b50a-60467d9de2a8", "comment": "Malware payload (AgentTesla)", "value": "896fcb47b18e1603195e61004c5d0c9852f5c2dc31957df4c61832a242d1dba728075145fa26f2615d847b0245bb2a35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319713, "uuid": "46fc39c5-b62b-4338-880e-fd71258b287b", "value": "T1C2051203B5E4C122CFD9B438E9CC901611750E0E1B82F2935AF6FE6433E7AB79D1A5A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319713, "uuid": "dfd31ba6-5518-44c8-a0d6-c1e1e6404b36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319713, "uuid": "bec4cc88-be1c-41d8-b600-4794e65eaa85", "value": "12288:SG3Sc9Bn80xo1242DxzqOi98Jbdnbi/mBUzv6oxKgx6iBSUyZHFWBGnhik3pcvde:JLfQ+VzBi9qW/mm4o6iBSUyZxh1rtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646319713, "uuid": "0943f869-cea7-4fed-9389-7f256f1f6830", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646319713, "uuid": "91497f20-544d-42d8-b7c3-b0c007700902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319713, "uuid": "49516e8d-38b6-4832-bd9a-62afe640bd1d", "value": "BL-SHIPPING INVOICE DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047e2b75-9aed-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646310331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310331, "uuid": "938394e8-4c3c-4384-acd9-f062c5291a4e", "comment": "Malware payload (RedLineStealer)", "value": "7e864d3b40fe9a2ad6e854c99c912e63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310331, "uuid": "28de94c8-bce7-4d98-9f02-08865c52ec45", "comment": "Malware payload (RedLineStealer)", "value": "09de52cc061012c23dcf69804293a6502a8d6aaaf4af8d4451a21615c129ab92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310331, "uuid": "cd131f65-0a75-4afe-afca-27d35806363e", "comment": "Malware payload (RedLineStealer)", "value": "de93b0c4a939287720a11303fc0a95bae0fb1fc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310331, "uuid": "07aa7e8b-0a82-4267-b366-98160949a8fb", "comment": "Malware payload (RedLineStealer)", "value": "aa9c5f11de5d70ae78a48584d966a20c79923b22a62ca84a11c92795b53e5f30f0a33c93aed84c782d58fcc15893db95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310331, "uuid": "2b3161e7-c344-44a2-b433-57cbba7e558e", "value": "T1D42633D2C7EF231CC01F4B3C268B987CE2314C557AC162C7659EA663215EFA5E468B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310331, "uuid": "0ac96758-c2dc-45fd-9525-403b1828e431", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310331, "uuid": "28084a44-8530-4e40-b4f5-10bb6d9cfbff", "value": "98304:A4WB1pRO/varCCVqEMmcobjnhDTMWXbZIbF0FcolN4I90c:A5vO69VqE5NbjnFg0bZIbF0Gold9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646310331, "uuid": "592a0147-0c8b-4559-9122-bbf6c72a572b", "value": 4847768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646310331, "uuid": "9dd8e1fb-be64-4aa7-a187-b7847e19b1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310331, "uuid": "17276e90-3db4-4c3f-bc3e-9123bba02148", "value": "7e864d3b40fe9a2ad6e854c99c912e63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51dd9343-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265793, "uuid": "2a78dc1e-3cbf-4fa5-a341-1cbfd05e0ffa", "comment": "Malware payload (Heodo)", "value": "703f41dd082a24f7849014b91c620148", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265793, "uuid": "77359d40-d58d-4688-a859-afae1adf76da", "comment": "Malware payload (Heodo)", "value": "0a1699c5231a0d3a41aaf25a7bc82a0f7eb2dbc3593093cf88fd7002d8b6223b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265793, "uuid": "e82775ed-afa3-4514-9e14-c9547cd7cc7c", "comment": "Malware payload (Heodo)", "value": "4ce5da180e1d8b20d147feb64bc62ea7fd65a677", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265793, "uuid": "c4ee2254-5a54-42cc-a295-3fddb6c3e0ae", "comment": "Malware payload (Heodo)", "value": "e3dc2a99bf2ebac7e3e700ded7398c417905da8bd121e8cdbec70990b5f21017be6a37239dd9ea4bcf44817905b1ca26", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265793, "uuid": "dcdd6df2-7a97-4771-b53e-50419f0f0de5", "value": "T1F3D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265793, "uuid": "97abcc12-fef8-4082-83fe-6cc47bd997b1", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265793, "uuid": "4623c327-c355-452a-be01-92fa03e402ad", "value": "12288:ZxpNJJJ2NHPoczJMOtIhxf3foRXIa5EPwvA:Zx2gczJMFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265793, "uuid": "b4a2f24e-1293-4b2e-bca8-39a6e51c7b90", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265793, "uuid": "7a70129f-6f86-4fcf-ad91-3d3a6375eced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265793, "uuid": "abae0524-bd9b-40c7-8de4-a10357736710", "value": "emotet_exe_e5_0a1699c5231a0d3a41aaf25a7bc82a0f7eb2dbc3593093cf88fd7002d8b6223b_2022-03-03__000304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616656b9-9ae4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646306621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306621, "uuid": "55605207-b101-4b5f-b295-0f572886fbba", "comment": "Malware payload (Mirai)", "value": "d022cc6ffd5f7ba96196deac2ac49a57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306621, "uuid": "2d83920f-7fad-4de8-923b-3fbd2bd37907", "comment": "Malware payload (Mirai)", "value": "0a56a9915bae3acbf03fb9122133d5493628065638f21727eaf27811d6d4ce64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306621, "uuid": "47a56b66-496b-4132-a156-bfde201bc8c3", "comment": "Malware payload (Mirai)", "value": "79f7781f082bc965523b8f57ba02ab43969fa43b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306621, "uuid": "38834b5e-61e8-463b-983e-c18282a88c29", "comment": "Malware payload (Mirai)", "value": "1e9fc5f89b38ac20dda9114bcd49ec3bb18eac39ffcc5a73267912758c999029db62a17a1d837717cb621edce3773548", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306621, "uuid": "57b41ab9-25f0-4903-a28f-0d289ba72b78", "value": "T1E2534AC8A5C3E5F5EC001D79307BABA1A973F53F2035EE9BE79A25639903603E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306621, "uuid": "0aa52543-55df-413d-ac9c-548e3c6aa644", "value": "1536:V5Vn4pXoqVExGxRP3MFnKiwjGKO18HKaPWutmUnD9oAG93:7R4pxuxGxB3MFnKrGHCHKCg+VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646306621, "uuid": "9d07db8e-405f-4d88-a4bb-ba0b9b2fc276", "value": 63696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646306621, "uuid": "f0cdd709-76ce-44c9-a6a1-8bcc8f481806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306621, "uuid": "41b2e0d0-3910-4ac9-be68-2c02b93a542b", "value": "d022cc6ffd5f7ba96196deac2ac49a57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b3ca90-9a86-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646266492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266492, "uuid": "c98279a2-8262-4ecf-8d28-0a9a6dee38cf", "comment": "Malware payload (RemcosRAT)", "value": "1ef39392b89e81c26212944f69cb33bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266492, "uuid": "03d37bba-98ac-48bf-9cc4-96cdb00640eb", "comment": "Malware payload (RemcosRAT)", "value": "0a5c80d43ede4f8a426c1459ea359b8e23d16b656c831db794ff385e5ff235da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266492, "uuid": "e4bd6d35-39ee-4dde-ac13-e5ae57745411", "comment": "Malware payload (RemcosRAT)", "value": "af5b9e1da55dc68c21dc241a1d1aded5fcd450c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266492, "uuid": "f0ddfe84-6c2b-4ebd-aada-89d890733f4b", "comment": "Malware payload (RemcosRAT)", "value": "6b543bc887de35197df88e38451201bad218c2e781fd2c0d10ac09c19a5913d4eeef04683a9091eb217fa04870224985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266492, "uuid": "141cc9a9-584e-4ff7-abe4-08d55a598db6", "value": "T10AA4BF11BAD2C072D97251340D29EB35DEBCBD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266492, "uuid": "8e8a71b0-eb20-47e2-88b3-fef6e90f7024", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266492, "uuid": "a30acd21-b818-4efa-bcd1-195413d4de4a", "value": "6144:hOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUHyg:hOFtiNBuFgawDB4NOmuwsfZPwyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646266492, "uuid": "33b400fc-5382-4b1a-9676-3ed3f0b9d925", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646266492, "uuid": "c44304bc-a089-4b56-b457-2159e1e205ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266492, "uuid": "eb4acea7-8c94-4e57-b4e5-884d7197d2f8", "value": "1ef39392b89e81c26212944f69cb33bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04aa3179-9ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646293581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293581, "uuid": "63bdd749-2c7d-40a4-9236-308488d3b6ff", "comment": "Malware payload (AgentTesla)", "value": "334986b05531e25830d1043a58875d23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293581, "uuid": "75f1834c-d97a-4296-8d64-9c83fb77bff7", "comment": "Malware payload (AgentTesla)", "value": "0aa3d66fc2fa638bb44e1e81229753afef997fa353dc48f951f0830f5f81c03f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293581, "uuid": "d239593c-a231-4718-b6e1-da3a68ee94d5", "comment": "Malware payload (AgentTesla)", "value": "237284c7dcde6d14b044473a621b37f5b87b62a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293581, "uuid": "ad909959-4cca-4530-aab3-db8d61839d0d", "comment": "Malware payload (AgentTesla)", "value": "104ae9cc0cba1ef42dfd609f851160d77596222eeff8d001ccd59588567f7a6e315fe9ddbfe9d7f67ec5fde752a3438d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293581, "uuid": "de5b7d1c-a6ee-48e6-9df8-53546aa63cae", "value": "T1E703D5167892961DC5D47BF86DB1A19366367CE10124C08FECF9BF2AA933223DCC51AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293581, "uuid": "d56bf1a9-cad3-4211-a112-10887735dd95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293581, "uuid": "acf07272-6654-4473-9e39-ac91d5053180", "value": "384:k41JzTAb3enzUexYAQ6ulaiJMwCKTH2S3dd0hUADka9Y:k41Jzsbb87ml7MwCKt3deVD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646293581, "uuid": "44173a8b-662f-4dd8-8e55-02a23cfb4028", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646293581, "uuid": "b8d1c906-14d0-4a40-b852-688373c22bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293581, "uuid": "3d4f3293-a579-42b3-950e-f431f3b29d2d", "value": "Outstanding Remittance Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88efda6c-9b12-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646326445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326445, "uuid": "beb76d2b-cfeb-4fa1-8849-494d8bd359b5", "comment": "Malware payload (Mirai)", "value": "f1f12242179d3b18f2d761f90ce06950", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326445, "uuid": "eb78e88e-00ed-42dc-939a-61544f80cf48", "comment": "Malware payload (Mirai)", "value": "0b0838056165d8a9e9f3b07deb0a5ae9ceb9e3b7a4afe4e1d872f97bb7d2800a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326445, "uuid": "46a8e30a-9732-4564-9570-ea30cd6f17b2", "comment": "Malware payload (Mirai)", "value": "67632a333c6b41e942fbb3bb1ce3c2ad89f9af3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326445, "uuid": "5e953daa-0dad-45e7-aa00-046f3dfcbd92", "comment": "Malware payload (Mirai)", "value": "b1438b6f5a1f4fd25fdda2637d79e063f29b275d403d6e8c47acbe4d0dd133f1e63735c602bfa76253ee724240085a8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326445, "uuid": "156bf757-c4b3-46b4-945d-6dbf754839a6", "value": "T199C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326445, "uuid": "f1b8a945-0df4-4c51-b19e-5063fde6d159", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeoEdWfRZrmW+IFj:Ted0W0MZQHud6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646326445, "uuid": "3191c905-d22b-4b80-bec3-766763167702", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646326445, "uuid": "91100b6f-571f-4af0-badb-d64c384d8f7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326445, "uuid": "38f28459-0078-47f4-98e6-217b3897a9d6", "value": "f1f12242179d3b18f2d761f90ce06950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c34f975-9b0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646323014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323014, "uuid": "5b2360d7-487b-4d7a-aa11-48b519293e98", "comment": "Malware payload (Formbook)", "value": "3b2111a706ed682f73bbf07d89114923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323014, "uuid": "dd74e8c9-1504-4b7b-afd3-72a0e40ac0f1", "comment": "Malware payload (Formbook)", "value": "0b0d239f53f4bec9dc3abf65bc3a7c57ee9c3d351533d4e6a597c082ce38a3d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323014, "uuid": "532404ae-c251-4bd9-980e-ad446902f959", "comment": "Malware payload (Formbook)", "value": "d9ef74fbd6456972444e93deb5867e79a362b45f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323014, "uuid": "95246b7e-d174-46c8-a98e-6fd408face6b", "comment": "Malware payload (Formbook)", "value": "6d7fabede7ced71c8e092a401b3e5610bfb07a46eedbaa8972d1e4f4777b8063836031997b3fb0aaaaaf99b7657f31c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323014, "uuid": "7b838f64-8b6a-4e3e-9a27-decb2ca230c8", "value": "T16164124B67F1DA37DA1144329CB6BB7CCFEAC6C20099C50A6B9E2F352433B94521A3D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323014, "uuid": "b5141d0b-9ecf-422a-ae92-2d5a0e3b5e83", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323014, "uuid": "05bd3b51-1041-438a-bd14-30a8815aee8f", "value": "6144:rGi1Q3YWS14tDlwBhXLgK0pvwReVgzbK3j5swDuFdcHHXa:23YWS14tDav064ViKjew0dOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646323014, "uuid": "a0856160-81da-418c-8437-f48d4534106b", "value": 309584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646323014, "uuid": "2ca25e87-f1d1-4fa0-bc83-65535dd53124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323014, "uuid": "2d0dd9d5-2f08-4ecc-9244-8c12f0b02571", "value": "85397635-622102032022-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf341794-9a88-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646267265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267265, "uuid": "a3b38a69-f31b-4ecf-ba7c-371444c6904a", "comment": "Malware payload (Heodo)", "value": "5cf0b4ad97320cd3227b9088d9dd5321", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267265, "uuid": "7ff9bd2c-739e-413d-9ef6-113b11b7ad0b", "comment": "Malware payload (Heodo)", "value": "0b46287b3a340b53d9f7170dae1dd055d1c1be0f56d8e86760f8182c42c4cd74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267265, "uuid": "84bb5ea6-8be5-4700-a0ae-5f6b366d5058", "comment": "Malware payload (Heodo)", "value": "b2a459e9564602388311be49a75d76acdafd7e73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267265, "uuid": "ccca57ee-9b99-40a9-ab5d-03bcc24c52e4", "comment": "Malware payload (Heodo)", "value": "4045992d15ccba6f56f8ffabb014816a7d78c2819acd908aa89ea7abc19672528aab11416ee7c3a589382c7e37fc2f6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267265, "uuid": "3cb00afa-e35f-4aa6-bf14-6ef8f9fa13e5", "value": "T172D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267265, "uuid": "24de6bf8-72df-4c68-835b-ba13808eb529", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267265, "uuid": "3ab827e9-f666-4651-9228-f17126a74788", "value": "12288:ZxpNJJJ2NHPoczJ2OtIhxf3foRXIa5EPwvA:Zx2gczJ2Ff3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646267265, "uuid": "0dbdff78-4d74-417c-9ffe-b2a10ab43894", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646267265, "uuid": "4ea22107-8241-45a8-9fb3-3c607ef0d2e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267265, "uuid": "41f24ac4-52bf-4829-91f9-cb23e46bbdb8", "value": "5cf0b4ad97320cd3227b9088d9dd5321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f19d5a4-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646294457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294457, "uuid": "daee63ee-a2be-458f-9684-79e2bce0d54e", "comment": "Malware payload (Formbook)", "value": "ef2d78e315147364740157ec37efde61", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294457, "uuid": "b2a14da8-f770-4ded-9c92-5f540aacf170", "comment": "Malware payload (Formbook)", "value": "0c2dd21713918311c35399d560572d5c28348fd35e7c6a2f1ac2dfb3454a08ed", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294457, "uuid": "28d742bc-381e-4b8a-a6f8-f80417cbe9d8", "comment": "Malware payload (Formbook)", "value": "5b955e9aefe20e326b3d2f0d868d6216690b2c34", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294457, "uuid": "8872accb-3943-428e-a60a-1fc3fbd86948", "comment": "Malware payload (Formbook)", "value": "5731bc4f984aaa2a4d5cff55221fd25699ddad9ca0e5a05a1e714b2ebf884590dd7b86f17f38848463944c8bdaab499b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294457, "uuid": "b6d4b95e-a737-4972-ade8-0a108b2fa03f", "value": "T1C81401956612B440CD14B4F95EF896EB92F9DDD6C802A2E1DB44F46CCEB0BE1CD3A207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294457, "uuid": "6a942e7d-2567-4a8a-bb40-a1e09f1340fe", "value": "3072:ds8PCmscAbGoSAJe5sAY80FRB9qe7OWAlOZca2CFOwjJjNiz5Bsd:5CNrKoSAJDXAdAvFXiz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294457, "uuid": "bb3f7917-c042-45ab-95f5-336dfc161dce", "value": 190952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294457, "uuid": "9cc05e90-119d-4c96-a804-68453c8a26da", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294457, "uuid": "aa1ba05c-332f-449e-b144-405d38ef5908", "value": "po885737.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c13fd5-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646296475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296475, "uuid": "fb5e6c14-767d-4c24-9120-f41fc393e948", "comment": "Malware payload (RedLineStealer)", "value": "3f26f2d58bbbbe05fc72856a7037c424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296475, "uuid": "ba5129dd-4e60-4789-b798-164210d7587a", "comment": "Malware payload (RedLineStealer)", "value": "0c79f85a96cc8f5f555585d9d011b56b56ad38f8ab5070b6c296efef9c442d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296475, "uuid": "d428c7ed-dbc9-4cda-8781-faaafaf25528", "comment": "Malware payload (RedLineStealer)", "value": "cdee7de68d5ebb8ea04ebd579ec560e8f677ba5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296475, "uuid": "071e51d0-f72c-41bd-9346-6027dbde1f10", "comment": "Malware payload (RedLineStealer)", "value": "b283494c335a192408a936a6aeb338ad4716d6a9b0589fc109a54b5a4b146e7ddb09e68f45eff04b2a0e8002cfdd1018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296475, "uuid": "959b5a31-c29d-4bf4-8630-c756f60e96eb", "value": "T10026338C1A43798CF5D41DB8B6A4F78A9A1BFBB460F23568D89101389384D777B09BCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296475, "uuid": "2013b836-89fb-4c57-9c83-5a08993c77a3", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296475, "uuid": "d042a34c-05d1-4fce-abc9-aef8b245b38e", "value": "98304:yI0NXYdukGgJJuppxwSoHjIHHZ710YzLj8HmUMdi9aqU:yIiYdpGosiSocH57SYzf8dx9ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296475, "uuid": "7221a7d6-b43f-403a-9617-662ca07478fa", "value": 4448768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296475, "uuid": "debe2b80-e7e2-4080-9b7b-f8c433420aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296475, "uuid": "c26bc09f-d5bb-4d50-98cd-7451dd5ed2f9", "value": "3f26f2d58bbbbe05fc72856a7037c424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19273722-9ac4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646292756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292756, "uuid": "bb987257-4f40-4f2c-93ca-03e06a04506c", "comment": "Malware payload (AgentTesla)", "value": "4339309de0ce294f82bde8ad92fdcc9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292756, "uuid": "99450342-defe-47ef-a4d4-386b10db84b2", "comment": "Malware payload (AgentTesla)", "value": "0cbae5bf29633f34813ce129ed740a09bab2fe70219efc1f7ab023aa028b1562", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292756, "uuid": "d67baefb-669e-4b35-94df-a0e5259daa5b", "comment": "Malware payload (AgentTesla)", "value": "248fd099f9bc2b152ccc570f8ce5e77325c8c6b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292756, "uuid": "cb33987f-8102-4cea-a72f-45ad419ab8a7", "comment": "Malware payload (AgentTesla)", "value": "e4e36b61e432db2dc9777e5fcfb79d768c62248e90a40ee0e926dac63e63a65c4a02d4e09995b1b7d6a85c78058fb48c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292756, "uuid": "29c6d145-ea18-447c-8a5a-d2def71e6693", "value": "T19AF42389AC21E359F506E47C8A23B15C4B74846F99817673069FB33B4DAE08CF99D1CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292756, "uuid": "56a8176c-453c-4dc3-b78a-164b922c0117", "value": "12288:ISw8/+GtX9sXbELkhYXKQLrWy+gjRMxRdYpr01FBt5tNyKGy64/Ma73lV:ISw8tU2khOKCz+ir6FB9bb6Ba71V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646292756, "uuid": "6f8ae5df-a320-4ad3-8e82-a41ad7e2cfdb", "value": 761376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646292756, "uuid": "6a9d9322-6399-4324-9718-b9bf2f25d3b9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292756, "uuid": "b6d64ff7-fdb8-488b-8b31-27f61f0c7e04", "value": "PO -108.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21b6a95-9ab7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646287403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287403, "uuid": "7a3879d2-e255-473e-9050-2fad7d6c4b4a", "comment": "Malware payload (Heodo)", "value": "fcf933c66ee5164d503d56c31a3bb4c3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287403, "uuid": "59f13ce5-b3e3-4eb5-8ad6-d976b99c1aed", "comment": "Malware payload (Heodo)", "value": "0ce68837ad2259a76655390cabfa9c19e7b3cc6a5cd6a50a4f2b5e7622466412", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287403, "uuid": "16743b71-efe5-41e9-9745-58f27758e5d1", "comment": "Malware payload (Heodo)", "value": "0842080a07d56f17ca3bfe693329ecac74b8a091", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287403, "uuid": "a2b1db04-4402-4035-b923-32528edc27ce", "comment": "Malware payload (Heodo)", "value": "1fc26cdc5413a4f9900bbac3b32cccda97ebd674d7fbe2b4de896ca2c309a11f9b95e5d0bd1a984b710112006e72012a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287403, "uuid": "a614d804-4db2-42eb-bf66-09ebd66355e3", "value": "T18923D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287403, "uuid": "d570b14a-6d20-4b8c-b04a-d4e424f28ffb", "value": "768:6eoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:poPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287403, "uuid": "0d88a2d2-99f5-4385-bf5e-26113f434a06", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287403, "uuid": "e5a2657f-6f1c-4eb4-b7f6-b343b233861f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287403, "uuid": "623be688-b8bf-4ad3-88f0-2c2ce314bd8b", "value": "Electronic form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf840ba-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "1326a11c-28c9-4714-bda7-812c9a102a39", "comment": "Malware payload (Heodo)", "value": "3d4d4d6e1d3c830275ffecc51d4c8e4e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "43635850-097f-4b31-9b69-0dba4097bfaa", "comment": "Malware payload (Heodo)", "value": "0d3b5bcfdd2877705172d33db4cd430b4942f58d0653ea5022346df1d5472c27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "0a0facf9-fa19-4645-90c9-0d05b3300dd6", "comment": "Malware payload (Heodo)", "value": "9e0eeaa89ca7ffb9fa9250c1c5470f4d7c4a1ae0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "bdd3cd6c-6f79-442d-87ed-72bbe7537c05", "comment": "Malware payload (Heodo)", "value": "1f4e071cd23c1d558194545fef6179d26103949fd814bbcb2c3a92e1bd8a4d93f116d3ef525074cb0b1bad6efd351a79", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "0f586753-1032-4be2-9f14-4627ce189b4e", "value": "T144D41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "4bed6303-200c-4737-8fe8-2764c7e12254", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "429b13ae-6851-4aa2-83f6-caf71e37b621", "value": "12288:DjN/Z2wkRrA9CRDCxElAjHDsndSyHOrNvEP0Oua:dEHR+CRXyfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265651, "uuid": "f58848e8-f800-427b-8cf8-6ec37e277d0a", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265651, "uuid": "bdb58211-793b-4ae7-b1a9-0a6b7e3d002e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "1e5d4c73-f25c-4e85-8860-221cc8696ee1", "value": "emotet_exe_e4_0d3b5bcfdd2877705172d33db4cd430b4942f58d0653ea5022346df1d5472c27_2022-03-03__000044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b1af27-9abd-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646289856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289856, "uuid": "cd4b3c8e-d468-4096-a3ba-7e4ecc3608b7", "comment": "Malware payload (GuLoader)", "value": "16da2b1c3ad40699bdeab6218db98e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289856, "uuid": "2b59d8c1-747a-4120-be76-26556cd9b5e5", "comment": "Malware payload (GuLoader)", "value": "0d6331c8cf26f9acc508301a955dc0ff69034b240b751553eb4f155a3be322aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289856, "uuid": "641c9eab-3868-47f3-a0c3-b85363b77a33", "comment": "Malware payload (GuLoader)", "value": "0f2a8c01f66cd077267ea4ef8cf3a02decb37002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289856, "uuid": "a66412f9-b23c-4878-99b4-7d2c3ee330b5", "comment": "Malware payload (GuLoader)", "value": "d069cad5326e5415743a81c6bded640f42652abf91c92ef68702a4d40770f463ba273b1db4b1ff3d21c1a712405763f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289856, "uuid": "4f7fdb0a-75cd-489b-ad05-f72b59bc1566", "value": "T118A412189741C42BDE898A36ECB292F5B739BD50DD108F0F27607E1D7EB52E3AA1C158", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289856, "uuid": "8bf1835d-5b58-454d-bd41-d309c4d1b068", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289856, "uuid": "7474fef3-092d-43f0-9b6e-6c7538243023", "value": "12288:DbDAMwnmDd33cpDTr0T6d+IsBUyrABA7w1Ag2s6z0LEh:DbDAMwn4dnqP7+lBUbB4w1FLif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289856, "uuid": "5eea404d-948b-4bb0-93c6-f94613fb8f42", "value": 469928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289856, "uuid": "b263c249-2a8a-4dec-8a1e-82aa7c894e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289856, "uuid": "e75274d1-c1d1-4bf8-b2bd-eb3a6cfed43c", "value": "SOLICITUD DE COTIZACI\u00d3N 01-03-2022\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4e934a-9aa8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646280736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280736, "uuid": "a4065074-d269-46f1-bb24-625819d150f6", "comment": "Malware payload (Formbook)", "value": "94f7e1a8953d811f3d5b1a53a609249f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280736, "uuid": "0fff0012-cf80-467a-8571-b005c1f490bd", "comment": "Malware payload (Formbook)", "value": "0dd6c6526e7ccdabf1ee6ceae3d38018d78288e543604f67995300f23eebc4b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280736, "uuid": "d41540d7-c3a8-41d0-9223-3f8c66f4a9af", "comment": "Malware payload (Formbook)", "value": "87b3e4f8a5381d3f503fe67830bf59e441d2ec2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280736, "uuid": "0ac3006f-87dc-43f6-8599-dfc3bd0ada0c", "comment": "Malware payload (Formbook)", "value": "44ac10bf7fa587fb4c8976ef4f2bd11fe52d7108274df13cd67915dc6fac7394b2b3b8f0c9bf70e58bfd4ae56e7d071b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280736, "uuid": "0bf6250f-8a06-476e-8509-34e5b7424dba", "value": "T1896423DB26D405B3D32201304477F7F7E7BA964C8E219B4B8B985EFE6B92653817C082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280736, "uuid": "bd7dae70-f4c9-40cb-b2ef-79a30eeba41c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280736, "uuid": "57c6e66a-d6b2-4db8-ba5b-f40bb98f7dcd", "value": "6144:rGin3taloxq17Bd9i4ApL2/vaxy4XBdebMzirsGErWXxukZiZSQ/:BaL9iC/vaQ4XBEEirsGG0x3OSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646280736, "uuid": "34895ae1-0e3f-4d9b-814a-62a57e1aaec2", "value": 310424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646280736, "uuid": "aa3af2a4-fac1-4d5d-b21f-fad20616ebd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280736, "uuid": "4675fe34-fb4e-40bf-be19-4c3f917d6a55", "value": "94f7e1a8953d811f3d5b1a53a609249f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b25810-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "e02a5ff1-7a14-401d-a140-de498ea6edf5", "comment": "Malware payload (Heodo)", "value": "4fd25af89d2b4316f0cd79c5e05549ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "6e8ae9c6-1bbc-4e8b-9292-8da86ffeaae8", "comment": "Malware payload (Heodo)", "value": "0e00a709db392da30cc5e6a627239a6e222284b0920c7f7a06d6786f2c44993f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "fe7eb5d7-ea8b-4298-8eec-211e9ca4faf3", "comment": "Malware payload (Heodo)", "value": "63a19ea05e78f4578400b721f01ef92a09a30579", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "b553e23c-d40a-4abe-8a50-21ac09b477eb", "comment": "Malware payload (Heodo)", "value": "f187e84e4e91190068ccde85755ae351fb1269ddafbce542211c1d48e41fb75b57dedfde5634eebc7ae35f8a8eebfad7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "d6aa874a-aefb-4786-9aa5-35d034d765c7", "value": "T113D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "b929e859-1c42-4389-8fc3-ffabe981ca73", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "ce8456e0-ab31-41c2-88f4-4916307adafa", "value": "12288:ZxpNJJJ2NHPoczJDOtIhxf3foRXIa5EPwvA:Zx2gczJDFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "084f6ef3-eee6-49ce-b0dc-13086f7b2b84", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "1c24562c-eee7-4753-bced-80ce82de7683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "d5d9eccc-5def-4f5a-a5a4-9de84dc41505", "value": "emotet_exe_e5_0e00a709db392da30cc5e6a627239a6e222284b0920c7f7a06d6786f2c44993f_2022-03-03__000305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec85577-9ab7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646287370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287370, "uuid": "c4055b03-5c73-401a-ba15-733bbada3e09", "comment": "Malware payload (Loki)", "value": "175a30afd391fb8485ca80bdef7aaa60", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287370, "uuid": "a0f7e1d9-23f9-4654-93e4-98a818a98fdf", "comment": "Malware payload (Loki)", "value": "0e9fa6a593072b225397dbff1bf7004aed8e3ea1f004333c25f3bb510d4c699a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287370, "uuid": "828a9d1f-2740-4a13-9875-8d90521a083a", "comment": "Malware payload (Loki)", "value": "21054f3cec0399c08567ffb1e5e625d4f17d8784", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287370, "uuid": "8cc4c383-aa56-459c-95e9-407ad9bc4636", "comment": "Malware payload (Loki)", "value": "bc012c2dd36f1a7c02ef6cc5518f3eba3baa053fa3b39668d394e4d4899b2d896183624678d50dde0dc3513188237315", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287370, "uuid": "8bd4e608-56a1-4973-9d8a-f1f83faa05b6", "value": "T10C1402DE76B8B30EE5A8AEB849682C7304938CD14562E4951444B38C76B3CF1D9BB239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287370, "uuid": "a9c19eb9-da6d-435d-a4fe-63ace068f929", "value": "3072:fXo091Q+vCFRHiBeqS6r/KgMpE+poW3v7rTVJb8gYsEOpMCa7WmFA9f2JRKbJiLt:fjM+oHO/r/KmE9jDGKMCa1Cdbwk1vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287370, "uuid": "d0f8dc7d-c6d6-404e-b6b3-e7959e5c9800", "value": 190632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287370, "uuid": "51e41618-740d-44cb-9533-eda013492381", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287370, "uuid": "3f2a9bb7-2f68-4a3c-a089-fd1f0b099cd4", "value": "Payment-recipt.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e43b99-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1646296594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296594, "uuid": "0ba05222-9eab-41ce-be39-0ebaf970eaea", "comment": "Malware payload (Gozi)", "value": "0061ee159c0bf78d95e3d7f57c7ef59a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296594, "uuid": "9a968670-63aa-4c0a-92db-71ae5317232f", "comment": "Malware payload (Gozi)", "value": "0ecc98fef3cc72ccc01a959163a42f8976d8b5b13536588d8875722b62b22561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296594, "uuid": "384fadbd-8221-4fe1-9716-888be4d8b113", "comment": "Malware payload (Gozi)", "value": "42eabe50510470a42e5fa225bc2008fcfe41d1e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296594, "uuid": "23cc9e73-344a-4275-8595-4dccef7a3fd9", "comment": "Malware payload (Gozi)", "value": "2ccfb0c3c35d19c8e0c83ae9da2049d39ae14b2d4d781ba027e0f3cf5578253817ff45871fe62033b31848fe4aab3966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296594, "uuid": "817ad714-2605-4264-b13c-f4cfe7f9a843", "value": "T1CA24BF163AD0CC72C59B56308425C7B51A7EB8325BB5897B3B982B7E4F303D1A73534A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296594, "uuid": "411cd613-daec-4fac-907d-56b07077c6af", "value": "0623e16f7ad169cff85e84a96d4a7da6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296594, "uuid": "35b08c86-0b84-49d4-8878-08bbfa2fd694", "value": "3072:N5vQlLPGC3CE3Vjs4CquhBlzed0YGJ8jMC5CRYLZ4:NNqLz93WOufFetGWjMliLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296594, "uuid": "84cf872c-d676-4db0-b01d-8f611fbabfba", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296594, "uuid": "27fc628f-a6d6-44a8-85cf-5e4ebb0822b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296594, "uuid": "259ee7e9-92af-491e-9da3-add077843e72", "value": "0061ee159c0bf78d95e3d7f57c7ef59a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edfa662-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646301061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301061, "uuid": "78645923-458d-47c9-9b43-8e03e314c0e8", "comment": "Malware payload (AgentTesla)", "value": "83de927539523cf03b4228cbc2bf7f80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301061, "uuid": "9a141f5d-1135-4ba9-8947-8ae9cba89482", "comment": "Malware payload (AgentTesla)", "value": "0f087e03e4814c2d5cf426c323247a224e3eb78af420b35c94dc407d604ba464", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301061, "uuid": "83e73fc3-721d-49c3-9a43-6dbaf48a6522", "comment": "Malware payload (AgentTesla)", "value": "9669b32e5040a6665c5b47b6d92c14e58c215453", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301061, "uuid": "4d352ee0-f5f8-4422-be0a-58d4f02314d7", "comment": "Malware payload (AgentTesla)", "value": "1321a982e1da0611393952c6f7e1280360c64d8d521c00c175cc84774fab41d2bfe1c4f055077ff5851c9c4d2fee7a43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301061, "uuid": "23f21e98-3b92-4ca7-8707-59331363aebb", "value": "T11C15255B38AA410DB6616D659FBCF171C15EEAF2187A5CF75DF3090A1012AF08B2DB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301061, "uuid": "accafe7f-7ced-4c2e-b131-7ef052259fd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301061, "uuid": "f9df3455-fe57-4dc7-a70f-6921eea11716", "value": "6144:Iy8n3mpYSjCY0zwe9GIpT/tJz6LEZpeQp4MLsOUtftTXrQ:H8n3mKWeZpT/7z6LEZpeBMLs1tftTXrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301061, "uuid": "2b48b7d7-6f49-4d33-869e-9f8a4ed009db", "value": 929992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301061, "uuid": "96435ab1-a9a8-4028-9373-a63282495e93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301061, "uuid": "4802b279-85b9-4d6c-8308-a718a9b9f862", "value": "83de927539523cf03b4228cbc2bf7f80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0481b4d3-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646294010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294010, "uuid": "d7f2d41f-4037-4428-a807-efb3a3498100", "comment": "Malware payload (AveMariaRAT)", "value": "798e9c878705792cbbda8c32afd59497", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294010, "uuid": "a6f90fee-86ca-4ca0-a8d2-cac46c30eeb5", "comment": "Malware payload (AveMariaRAT)", "value": "0f6fdd368bb75117b05070302515de5da0173c1cdd00879dd48b1caa111d2068", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294010, "uuid": "eb2242cb-07fd-47d0-9c7e-1595e9dfce25", "comment": "Malware payload (AveMariaRAT)", "value": "267b9830016dfd834779d9ad9c790783d1a29854", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294010, "uuid": "226ce898-5168-4d02-9deb-3483ce3954b7", "comment": "Malware payload (AveMariaRAT)", "value": "ce7f55ee312288fe91e8663328ee7f4121095b629f89619f843229f339114f83443250930b41069da5883764593420f8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294010, "uuid": "20d38514-533b-486b-bd86-23c2eceb0f2d", "value": "T105B39E13F7E54835F3B201B01ABD7E7ACBEDF9700628C49FA394858A2D31946E925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294010, "uuid": "dddbcf0e-f535-4897-8e60-8e06d472bc54", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294010, "uuid": "097f9cce-501a-4692-a023-87a977c18f35", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294010, "uuid": "b3759401-7885-4f67-ae39-e12a943a4f5d", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294010, "uuid": "2eb83c37-5728-452e-b3b7-54149912cb61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294010, "uuid": "cfc1040a-1d92-4447-bfc8-581f88bdb27a", "value": "798e9c878705792cbbda8c32afd59497.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e179207-9af5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646313890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313890, "uuid": "47f9b7aa-5f1b-4585-9fa8-3eb68fd675af", "comment": "Malware payload (Heodo)", "value": "a701d7ac7e2fdf16b7a7badb9b525785", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313890, "uuid": "4dc02236-932f-4943-adc2-b6829adf7cba", "comment": "Malware payload (Heodo)", "value": "0f79dd6c7bd7490955e93399a3e660272c22f6f7f5e97a24ff33d1d1af714941", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313890, "uuid": "e78b50f2-952f-402d-b175-81cad118f158", "comment": "Malware payload (Heodo)", "value": "a18544bfb5b4d643cd9e608e3fc16286905cba63", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313890, "uuid": "ae12fb99-ff5b-4b5f-b6f8-a3c68070bd05", "comment": "Malware payload (Heodo)", "value": "a768329dfe03119bb9edb146d1150f907ec3fa6ab0f4845d0787609f6a334395f00bb08948b71193751291a6556311e8", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313890, "uuid": "af7582e2-027f-41d6-8d8a-d0e452f9d377", "value": "T1EB04F8053ACAEC1BE52221310E9ECF5690909E201FA4C92F755F3B6C9BBD16F9CE1B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313890, "uuid": "bd0bcee8-e9d0-4691-84ae-23da13329ca4", "value": "3072:E4PrXcuQuvpzm4bkiaMQgAlSbQIMXUcTKCpJ1ssku2R5:ZDRv1m4bnQgISbQIWssk1R5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646313890, "uuid": "fedd99ab-c404-42a9-863b-ea4604fbbf37", "value": 177060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646313890, "uuid": "21194f70-7a0d-4462-9c09-94438467c68e", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313890, "uuid": "9ce238b8-8691-4f17-99ba-ee81c29138c6", "value": "0f79dd6c7bd7490955e93399a3e660272c22f6f7f5e97a24ff33d1d1af714941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e519ab4-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646297946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297946, "uuid": "f82c1496-3f0f-42a3-86b6-a6b2dcf3a8ee", "comment": "Malware payload (RedLineStealer)", "value": "136a3b94aaa35631cbeb5f7835048b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297946, "uuid": "27c65b7f-ad9e-4dc6-93e2-c8fe4e166e07", "comment": "Malware payload (RedLineStealer)", "value": "0ff790dcfc07a7c7c798c025968d534fb175c85ea56126ab8c984e1476d98600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297946, "uuid": "34eeb138-c3bf-437d-a105-98f0769334c4", "comment": "Malware payload (RedLineStealer)", "value": "1669722e28a726f4c8b7ae8d84efbecc20d4c95a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297946, "uuid": "2ff6f2c7-d6af-4874-abde-4041dfabfa73", "comment": "Malware payload (RedLineStealer)", "value": "b75337fb6378a0f828cfa48d70014f13809da67dfc7415807e9f328787d564c0b101c517b464a98cdedded7e51f8b898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297946, "uuid": "74916fbe-4658-4ee9-966b-d38ea5354cc0", "value": "T140B4A53439FB5029F1B3EF75DAD87596DBAEB7633607E44D204103864A03B82ED9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297946, "uuid": "769f6b3c-8ea0-407e-91b3-bdcd0690f23f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297946, "uuid": "c120e1ca-4926-4179-87ca-cf22f5adf1c9", "value": "12288:y9T+AY5LWmCVIPlZLvcCtnzgkoCcXSgnR26TOz8Ca0X:4TznZAZzcO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297946, "uuid": "d91a7511-3d41-4337-9ae0-37a500c79c67", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297946, "uuid": "a29dc2e5-2175-47a6-9b2f-6820bee079bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297946, "uuid": "c362be7b-f204-4f3f-a094-1b92947b1242", "value": "136a3b94aaa35631cbeb5f7835048b6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d94d98e-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298857, "uuid": "570616a6-348e-44fc-a986-9a32b75b4023", "comment": "Malware payload (Heodo)", "value": "51effd3db97a6363ea73d2ab1258038c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298857, "uuid": "b0bcdb23-97b6-4fbe-b2e6-1b150a334077", "comment": "Malware payload (Heodo)", "value": "0ffa56d0d63013e1f2c62d8ef600cd5a69ff07d7ed95c4febfd4b50f57c8f525", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298857, "uuid": "af686375-f10b-4632-a0cf-153a471e73dd", "comment": "Malware payload (Heodo)", "value": "11a7bdad5600416d16693ba06ac2f74a3b38afe3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298857, "uuid": "ff99a005-0f4c-43e6-b6cf-01855472c717", "comment": "Malware payload (Heodo)", "value": "57ac95d586fa401b8db6aacc30fa649570d6a8142d199debda0bed07abcbc90f1561b44b67d4190b3857e9d4d0e2996d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298857, "uuid": "3bed0aa4-99c0-486c-bee8-4cc05a0d9831", "value": "T14213E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298857, "uuid": "c26b180f-40fb-4461-908a-ea8d0296573a", "value": "768:W9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:W9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298857, "uuid": "806809e0-019f-4451-ae43-6dae639d2df1", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298857, "uuid": "0da54653-9807-4de5-b78e-ca9fc78624a5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298857, "uuid": "ad6a7a25-c66c-4ed7-8c90-b1f36e0229aa", "value": "Omics Journal.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf43bf9-9ad3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646299284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299284, "uuid": "3bfd0642-beff-4012-b5ec-50f606d813f6", "comment": "Malware payload (RedLineStealer)", "value": "6ed799fce5863cd5f37203d7b8605860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299284, "uuid": "39ac8538-8eb4-44dc-ba00-6c32b849653a", "comment": "Malware payload (RedLineStealer)", "value": "1047472f591363c130eaf88e078bf0772d1fda785c7d4c38d6bfa528eee1689e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299284, "uuid": "4d730736-d1d0-483e-b2d5-671961ab5a06", "comment": "Malware payload (RedLineStealer)", "value": "64fe4d3a9d88e44f7e771b0abbb19d65cae00580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299284, "uuid": "32cf7af6-19f0-4f0c-a7b0-bce58eb589b2", "comment": "Malware payload (RedLineStealer)", "value": "0735ed3bdf926e8097943e31eb4bc416c777402945384864d7703fd13f569b1abd6b4532c0733f93f2455d3eb790af9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299284, "uuid": "a1c0f00d-2574-4b85-a90e-1f3b7287d22a", "value": "T15D35336D0FD31573C602A8B29E395585AC8ED7AD863BC328DE4CA564CC8F312F55633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299284, "uuid": "ae1328d8-2044-4089-85fe-41b2434b9b8e", "value": "5f93d5d994acd6df67343c5544b50640", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299284, "uuid": "4e7c309f-fc4e-4d21-89ce-6f96bb109f0c", "value": "12288:JXthrDQPM8OrSkK6oMV6AdQ+wgildmXso8k79yxTO0vClyD7Cv8+15jVESxLH1eN:NQ0fSkK6ZS+ONoDSvCls2jDEcVeJSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646299284, "uuid": "4ce2c50c-39c2-4f9a-b9c6-639a754e982d", "value": 1130000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646299284, "uuid": "553fb153-2b15-434d-9f89-f9406b27e843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299284, "uuid": "7a945a67-9cb8-4946-b948-61fdeecc31d6", "value": "6ed799fce5863cd5f37203d7b8605860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f147d38-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646301088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301088, "uuid": "9060d14f-dd0f-47eb-8d6c-99f01d52341a", "comment": "Malware payload (Formbook)", "value": "a0ab01467d2260a4f3c41f9ac939a982", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301088, "uuid": "ea13fc84-3bf1-4404-881d-24a4519896eb", "comment": "Malware payload (Formbook)", "value": "108238536ab90b12dd6a5c654a1ddd27c2994b2d3fc39f87fc5f5e4847c1ec34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301088, "uuid": "216879ec-7c22-409b-b4d9-f8a8bcb5570d", "comment": "Malware payload (Formbook)", "value": "52c69c147ec4acc47d8b200f5f07c511c400fb07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301088, "uuid": "8eca7688-fc4a-48d6-ba77-fdc1b9e864b4", "comment": "Malware payload (Formbook)", "value": "283fcff1389f0002b7f859ae4ad3c1b9bd37f8d3a28b59aaf861bd85b0b85ea7482279c8b100c0cab1022c8a1cb0b38b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301088, "uuid": "4eddc699-a0b0-4263-a3e4-b8f66c5c39a3", "value": "T1FC65DE01D2AD1516E2BE5ABCB7B3F0F05733AD7A187EC2094678A18D05526837A327F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301088, "uuid": "de01ddee-4707-4e25-9fe4-6883ab57e693", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301088, "uuid": "ed8fdb82-6cff-4f7e-86e6-3089dece0e3c", "value": "24576:bnllctKrWl5u8eAVeqSy12E0VmFlA3eLhiu+grdlTLAI8Cx:zckK5FeAVesofV2LIQrvKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301088, "uuid": "b7c9facf-b7e3-40f4-8985-2645151b0f11", "value": 1505280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301088, "uuid": "4244d6a4-cbfa-48ab-bb33-362f69746053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301088, "uuid": "61e38f13-cdef-46da-b69e-474849b0ea82", "value": "a0ab01467d2260a4f3c41f9ac939a982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767d9b99-9a89-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646267573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267573, "uuid": "9b411852-bf08-49db-9b0d-6778f8c2e2f0", "comment": "Malware payload (Heodo)", "value": "a0b2654a559267adf396c607dabb06b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267573, "uuid": "f8b42276-dcb8-4d6d-88aa-4900ac1d2db5", "comment": "Malware payload (Heodo)", "value": "111f896a7c552293fa7fd849c9363a7f238951eb8cec3f523425df58860c8822", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267573, "uuid": "df12c008-c513-4ba5-96bd-7d68fa78bd33", "comment": "Malware payload (Heodo)", "value": "c2c82b8f81e37fcae70199a7edeb7b307420aa01", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267573, "uuid": "362ddc55-ee10-4487-9764-d5234265d9d7", "comment": "Malware payload (Heodo)", "value": "4166ba359fc37fa35ad472cc9e6268b20d828d376afb2ab5d8b76a111a48367a46f7bfbf32fdc4395dea9d5b4db08537", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267573, "uuid": "93993c50-2351-4698-8059-330eb51950bb", "value": "T1F3B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267573, "uuid": "db4568c0-c4f1-4407-86bb-3e5bfa6dd3eb", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267573, "uuid": "c4dfb910-29aa-4150-9bf5-23a9d40e85d9", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyb4h43JopSz/o:jE3TM/JjdkSq3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646267573, "uuid": "601ced93-ba2d-4cc2-baf5-c1d9878fd49a", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646267573, "uuid": "190e3ab4-6139-4829-b00f-538ed1b5d148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267573, "uuid": "09c96976-e3a3-4bb8-bc76-6637b1dccfd6", "value": "emotet_exe_e4_111f896a7c552293fa7fd849c9363a7f238951eb8cec3f523425df58860c8822_2022-03-03__003246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4557a68-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320961, "uuid": "2d600827-176f-4cb3-aff1-730347e7c70f", "comment": "Malware payload (Heodo)", "value": "1cee630ce4c0ace95c87a4ccc6960a6a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320961, "uuid": "d32a69a0-26c0-46e1-b33c-d474e23aaa6b", "comment": "Malware payload (Heodo)", "value": "114fe3944415f63ec56344bbfcfaa2846f0d374ffb15b2f2b7f00f1a9542767c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320961, "uuid": "40f6481c-e5e3-4cc4-9ae7-9642c049757b", "comment": "Malware payload (Heodo)", "value": "b65764928bcbd857c6052c66ee59b3f3a05bc6c6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320961, "uuid": "4433123d-82c7-4b8b-8f00-d2121969f1f0", "comment": "Malware payload (Heodo)", "value": "a24876b88df88dc1493de3f5431cda277b959daade79cbabc72d2c171b6fb4711319cddef85d4263423b20f5019c240a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320961, "uuid": "89f3d36d-1c33-4959-bfb1-03a9b6323e27", "value": "T15A23E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320961, "uuid": "e9967480-5d5b-4fdc-860a-fc0882c59b9a", "value": "768:KqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:ZrVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320961, "uuid": "ddfaa878-aa19-4039-bc7c-18147cc5b798", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320961, "uuid": "8929d347-88cd-4684-875f-805fa5f03ee0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320961, "uuid": "f8a4e3c1-5545-4fbb-a86a-5c645f88c71c", "value": "2022-03-03_1249.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009bc9a4-9ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646293574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293574, "uuid": "5aab0a3b-4a7b-4c03-a291-5fff0616f14e", "comment": "Malware payload (AgentTesla)", "value": "f411d128de0998d7a5819490a9173d07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293574, "uuid": "ebae9b64-e0f7-44aa-8c0b-eda36567cf50", "comment": "Malware payload (AgentTesla)", "value": "11c913f67990b50d55e306e72e079d817d3e07596d799f979ea821d955aa46dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293574, "uuid": "be5fb499-13c8-4702-a945-e6f118ba0f70", "comment": "Malware payload (AgentTesla)", "value": "d1b66e3174167e5b530e0d368be77f09c875ca49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293574, "uuid": "ad5468c0-4157-449d-b7fe-9be1d1f333be", "comment": "Malware payload (AgentTesla)", "value": "f57971a76c7aacea31b8feaadb225ebd9d37da52a76de82f0df83ca5c75880767809156853cba70fe128d2076a782156", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293574, "uuid": "b6d59295-9792-4679-857c-4bbb0f44280c", "value": "T1B752D0E54525D370C84CFFBBCA91EC6CCA09C406ABA1C1871F4E5F0E996D5440E0E97E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293574, "uuid": "9a984a4f-ee0b-456b-991d-23351a3aed42", "value": "192:YVKwwzkBtYuSkCJWOTZjXFqm1fuJQrDxWRdfEDuRicMhN2ji/IGIESJMdSl:dzkryXFjXFqm1fcHRdM6RicMC+Z/Sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646293574, "uuid": "27b7e9a1-84ad-4520-9d8c-08c4f5fd001a", "value": 13354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646293574, "uuid": "3cf6aa1c-5c63-49c5-80ac-c12fb84f2ebe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293574, "uuid": "bad86eab-79b0-4d2e-9e72-1f4adf896bbe", "value": "Outstanding Remittance Payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7730a052-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646301074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301074, "uuid": "fcbb2667-21a8-4512-9cd4-cd33642dc1fb", "comment": "Malware payload (Loki)", "value": "4c456c80e76d11a3fb972e7f5eca2316", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301074, "uuid": "f2d17ccf-cfec-47e6-83ab-626fd3b8752b", "comment": "Malware payload (Loki)", "value": "11e368c15885150d327aaad8c35e6a02c38cfd15a99a1d3348776cb0a4d9593e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301074, "uuid": "103f6b7d-5071-4237-afc1-50bf782264e6", "comment": "Malware payload (Loki)", "value": "6271b4d8a2aa8ca4f5f34da63d6211c643411487", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301074, "uuid": "acc3ccf8-f668-415b-b5b9-ed5fd7162393", "comment": "Malware payload (Loki)", "value": "0fe4da42f62429328b8cfaf05d1f50d5176093762b8a821708dbab2cd82fbd22212e356462bb2ef49c3daf6acfe17eb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301074, "uuid": "960473c5-8e4b-46c0-bf05-d8c1cedbe40e", "value": "T1C48401B2A884CAE7EC180C3190B91E561FA37DA7F261775F1B59B62602B3343055F92F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301074, "uuid": "5045129f-11ea-4fde-a3e7-47e18965b49b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301074, "uuid": "234ae5af-4647-4982-b5f9-40427c7e1fb6", "value": "6144:rGii+2QtqEgeHyxYZltiKZnR9wMpsaWtAVj8Xkm375Y9Rq+xPvnZU3:++Vg+SxAloYR9wcsaWzkG7y9I+ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301074, "uuid": "f53b3a4a-8551-48b4-92a6-d59eb3071e70", "value": 385489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301074, "uuid": "e15b7678-1943-46ca-aec6-b66015d8c44e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301074, "uuid": "381706f3-c595-409f-af45-39a5366fc090", "value": "4c456c80e76d11a3fb972e7f5eca2316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5214d999-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "3155049e-87a5-49c9-8019-36dc82b5bd4b", "comment": "Malware payload (Heodo)", "value": "ba6a590e25a25b30e2e9abee11c0d603", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "a41b58e1-827a-47ff-8789-92971ae878f1", "comment": "Malware payload (Heodo)", "value": "1264afddeda9ecbe18612734fba2f69f544139272243c9b089267c9d1eb73c8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "656fa5f2-3be4-4d87-86d6-bd6778942071", "comment": "Malware payload (Heodo)", "value": "d5ba5397c02482bc15ba4da0f8d5bcc2ab56303b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "4090fcad-507c-48db-91fa-a728c836bf79", "comment": "Malware payload (Heodo)", "value": "ebe488a477f850b1f5b9d743756ca9820eedbd34c4f1c46c4d0128143e682d5e5b3892c09b595c98bd7f5e11640a3f53", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "61c4c25e-6809-4f36-80ed-c5ad39e9edbf", "value": "T1D0D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "c1509dbe-2139-45b0-98e1-a4a169bb51b7", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "13fdcb65-8877-409a-a34e-d9a6f8256595", "value": "12288:ZxpNJJJ2NHPoczJnOtIhxf3foRXIa5EPwvA:Zx2gczJnFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265794, "uuid": "e713ed5a-2bd6-4078-ba7a-059b993c1c71", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265794, "uuid": "38e8ba77-c0af-4556-b91d-b5ea1529cc3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "2b520acc-4474-4cd3-b0d1-7dfb151f02aa", "value": "emotet_exe_e5_1264afddeda9ecbe18612734fba2f69f544139272243c9b089267c9d1eb73c8f_2022-03-03__000304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a34cdc-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300379, "uuid": "d2e2e4ca-50ab-4e9d-ad75-2366e98f04f4", "comment": "Malware payload", "value": "65308084d64617a296f61bfc5b425bcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300379, "uuid": "bc77a947-0d5f-4d54-a761-4579bb0a3929", "comment": "Malware payload", "value": "12ca4693f082107b4979a7d1ee7c880c1318b0813f3ba766dd1a52634a37738f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300379, "uuid": "70835d99-18b8-4411-90ab-1bd156247f41", "comment": "Malware payload", "value": "1b4cbf9e586f1a982b10fe2abd3d15980ccaebff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300379, "uuid": "bd4c6448-fd63-431e-a146-f3a8570737e2", "comment": "Malware payload", "value": "2ae673b03164ac1aff6593cd9b4851166d59f1faa260214dd66b2106849fade4aeb65c1629aeb592e30326723923cfe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300379, "uuid": "ba469b8c-d52b-4c66-9890-9bd417aa35ff", "value": "T1DB26331721AAEB0CC51567F32317BD16EED503FD80E4C19CEA0A1946E96EEB016987FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300379, "uuid": "9fe37f93-9828-446f-81f4-2d2afbf8fcb7", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300379, "uuid": "1b442892-931f-4d29-9e1a-6cf314f6907b", "value": "98304:IAZ0ZkXrYXaot7QPzv5HTiEHpW4o6qwfH+rlOzN0uCv6HC6Fghj:IA8Xaot7QPzxuEg45H+rlENHCqbgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300379, "uuid": "c28d5fcb-b8a3-4db5-b05c-97aa24ffc2c9", "value": 4553216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300379, "uuid": "4ebf3cca-f98a-42c7-ba81-047452d98dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300379, "uuid": "5a71015c-ac13-4708-99a8-3d312c85ad4b", "value": "65308084d64617a296f61bfc5b425bcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c917dd-9a98-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646273844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646273844, "uuid": "e487dd2b-b660-482d-b604-108dc4aefa8e", "comment": "Malware payload", "value": "ecce8845921a91854ab34bff2623151e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IsaacWiper", "colour": "#6E20F5", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646273844, "uuid": "67e98a6e-ccc4-4e21-adfa-ed97f6da8094", "comment": "Malware payload", "value": "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IsaacWiper", "colour": "#6E20F5", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646273844, "uuid": "e83ef390-c489-47a6-ac73-53d318e5dbed", "comment": "Malware payload", "value": "736a4cfad1ed83a6a0b75b0474d5e01a3a36f950", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IsaacWiper", "colour": "#6E20F5", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646273844, "uuid": "1c54a697-13db-44ed-98a1-1b328a54ce10", "comment": "Malware payload", "value": "66a6f5502ea00ace2aed07d68d3817c5c231e33561126d981a0dedb7e7289ff92d052335a10d400176259e50ca1590ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IsaacWiper", "colour": "#6E20F5", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646273844, "uuid": "d3b4f094-1f80-4c9d-bac4-876bef72ff53", "value": "T17B248D00B482C076E4BE15305939DBA55ABDB8200B70DAEBA7D45E7E0F353C2D535ABB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646273844, "uuid": "493dccdd-d587-44a4-879d-37be97915e72", "value": "a4b162717c197e11b76a4d9bc58ea25d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646273844, "uuid": "9a9dee19-7d15-40c1-947e-c7a5b9150c13", "value": "6144:pjU6yx1p7lvER8SPD/xzL0ruSSbAOfyV:Ju1pZvPuDF0ruSSbkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646273844, "uuid": "1714c3be-02e9-4b20-8dad-0be9c2ca3a32", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646273844, "uuid": "08ece65f-eb8d-46a3-95d4-78ccc3180c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646273844, "uuid": "8d12902d-24ab-4647-ae5d-90e3bd266013", "value": "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38997997-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646296245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296245, "uuid": "ee45c305-6c17-489d-9d91-5753521d2b3f", "comment": "Malware payload (RedLineStealer)", "value": "2ab37639a26a901b76d4073a78def51c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296245, "uuid": "3f39ac74-ba8b-494f-abc0-074aead46197", "comment": "Malware payload (RedLineStealer)", "value": "1427915d4e26bb2e9babc5a38ce55c7fe84907d64dd0a3eafa9080bbec7b2836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296245, "uuid": "545c4d5e-3ed3-445e-9c80-cc3f0eb87a1e", "comment": "Malware payload (RedLineStealer)", "value": "505332d9eb6a055dc4cab207ee2b757129dcf7e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296245, "uuid": "4a5d5a3d-06c2-4bec-a99d-5a62b47eb84c", "comment": "Malware payload (RedLineStealer)", "value": "c56ef227232b9429f584928500494f92f35a87959a01ac8debd8eaf700fc03d00d4415b7d66a0cd05c25403fffdaec2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296245, "uuid": "95f2fbdf-f588-40e9-abaf-bfb4f40ee02b", "value": "T12B36337BF8E8BF5BE01B3974325A4F554B04236E31A0D35757BA83E6126DEC8120C9E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296245, "uuid": "a59a6cb9-071c-4e2d-9190-4809e02c0502", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296245, "uuid": "fbfbe233-06ed-4ab8-8fdc-c63707a731de", "value": "98304:Cf0VMoozZv6ReInWeDPN613s3f15KZX493F6TseSlmImi6x1wkuAGcl80:CqMjzZzInWeDPG3cN5+XSkT4mIkGCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296245, "uuid": "6faf25db-408f-498b-9dd1-9749dcad4f08", "value": 5027784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296245, "uuid": "5d3bfcbd-f1e1-40f1-9b1d-58f16202c739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296245, "uuid": "7590b855-afb4-4843-a884-84b15a2949c7", "value": "2ab37639a26a901b76d4073a78def51c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96858f29-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646295114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295114, "uuid": "24a91fcd-636c-4cd6-ae4d-475ba200ccf0", "comment": "Malware payload (RedLineStealer)", "value": "6ef3ced3b7769d96963ad9b6288c2b17", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295114, "uuid": "57422992-78d5-4575-8d06-e5873548cb3b", "comment": "Malware payload (RedLineStealer)", "value": "14539f186288084a0f9d9d0bc05b25deb964f1198bcccb637ddf26c58ea476ff", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295114, "uuid": "dec63193-7e13-4487-9ead-7774b4c7a9e1", "comment": "Malware payload (RedLineStealer)", "value": "fcfc446d4ee47b5115ff3abd1a9cce7da2607027", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295114, "uuid": "d8f192a2-6d7f-4b1a-b969-bdb432ccb496", "comment": "Malware payload (RedLineStealer)", "value": "57a2028aa5cf6a65395b6ca5455737275cc29a962cf9c37b75e0887276652857f6c5b7d7d6d0adae5da94e056c76db87", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295114, "uuid": "2ecaaeae-b0ee-4736-8b25-94ea50371cbf", "value": "T10F512C34DE960337D2B28635E4EE5302F5663402FE2EBF49014702C65097047E1A6F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295114, "uuid": "71b4594c-9b7c-4188-bded-8d405422ef75", "value": "24:8AntnHYVKVWFe/CWk3kEcciJGaEt2rwbRvrW3r9+Y3cjeDwlCue/E4I0aHA+:8wHa4CiOSwRgIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295114, "uuid": "8661ee2c-a918-43f4-93ab-6384349605ea", "value": 2642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295114, "uuid": "cdbf745e-ef32-417d-9104-93ae129dff14", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295114, "uuid": "d58e215e-e301-4d8a-9c6c-fa36a5405549", "value": "Forwebmail.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a99fd18-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298852, "uuid": "f437bc38-0a95-44f4-8dea-ed3ded91584a", "comment": "Malware payload (Heodo)", "value": "6f9a073b714f7cd65bb1d0fbfe6425af", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298852, "uuid": "16ca5e16-a82e-425d-80ce-f588e174a0e5", "comment": "Malware payload (Heodo)", "value": "14e178648a8ef20d4bfe499c616d583a93402c2e9fdc061fce66bda2f6603892", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298852, "uuid": "9dea0dd1-7c36-4761-97d9-2f27c6a07897", "comment": "Malware payload (Heodo)", "value": "ae8acf4d692bb10d9bf0b79835490e3b1d02a8e7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298852, "uuid": "aff8a14e-60ec-47fc-8826-d88054eabf6e", "comment": "Malware payload (Heodo)", "value": "ebda275e4f5090f0727cef8d7e29c38a4ad1230f269744af8e7883c1f4811ee9e328989b3b38a1eaedb1d3fdcf1888a4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298852, "uuid": "25945aab-f212-4f42-876d-832e699f97c0", "value": "T18923E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298852, "uuid": "7f0c5ba4-04ef-4251-aebe-b0a9ef4fbd7a", "value": "768:aqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:JrVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298852, "uuid": "246323bb-1b8c-4eba-b866-e18bfc065920", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298852, "uuid": "8f39421c-82c8-476c-a3a8-47e282d6a649", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298852, "uuid": "1eeb864b-ce1d-47b7-828f-23a84a1ada60", "value": "Insight Medical Publishing.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9e1504-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298183, "uuid": "4a2eb58c-6b92-4b78-b597-816d5bb35e3d", "comment": "Malware payload", "value": "0d1efdf7241b5733e04df2cbe6622616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298183, "uuid": "fae1a80a-6a77-40c2-9196-2d38e4ab6d6f", "comment": "Malware payload", "value": "154c8e11614a15add82bbcd93a7978a6861dc6692971ab04e3f3935373a50536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298183, "uuid": "bded30ab-016a-4e17-bd82-6a602ebd510a", "comment": "Malware payload", "value": "ee8c0b885faefc8e956b8861b89bc1d67f2705e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298183, "uuid": "a686aa7d-9767-4c15-8bbf-46bd8445a914", "comment": "Malware payload", "value": "1b1b30f19f8fcdbdefe8d92b2be445dd7923e41aa4790f8cc2e67c9f30809016e46ade7823000bfdf19b18c9445b95d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298183, "uuid": "85981685-5f2d-4528-bc6d-991c0bafac5c", "value": "T1C3C52303FDD2D472DA700932455E6B84A23D72701F558A9FE3D49A6DA9311E0EF32E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298183, "uuid": "2b80a6fb-46be-4632-952c-90136febc218", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298183, "uuid": "752e965b-d9ec-4f09-8c9a-2a7c3e1730e3", "value": "49152:k84hrQo7Nw8Nt92pxFifqzkNsYZWBz+w5AnfcgBeix:kfQWyesDkTZQz+w5Ai+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298183, "uuid": "c9725e66-0962-496d-8204-1e2683776f22", "value": 2569469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298183, "uuid": "e2eefcd9-05be-4a87-a224-b29f7b251b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298183, "uuid": "c7a38641-5ec6-49b3-afd3-b7f877debf44", "value": "0d1efdf7241b5733e04df2cbe6622616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c3074d-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300394, "uuid": "d25a98de-07de-490c-a5b0-d21d229301ad", "comment": "Malware payload", "value": "6193183f2cc40687fa50230569ac10e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300394, "uuid": "9d8fe5cb-df26-43a7-bd35-a55ca170d96f", "comment": "Malware payload", "value": "15529f0ab9bab6b31b096034ef961c88c69c3ebbb2682c73bf635880e25bd87d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300394, "uuid": "0922fc0d-403b-4a67-9a2a-249a11a7f97f", "comment": "Malware payload", "value": "44d2dc2bc52894fdd86bc2d04f42352fd5d65a13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300394, "uuid": "16b0987a-f9c1-476a-84e8-841eb3ffa801", "comment": "Malware payload", "value": "9658f0bbb5712203202eb058b77b53b4e711c5b490257a466047ac8d05c1d706be27aaa7fae102485b2636730854df09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300394, "uuid": "38b7e469-b4c0-47b3-aa1d-c90ac41d008f", "value": "T1AB33938C765071DFC86BC976D9A81C64EA60B47B471BD343A45326ADAA0DA9FCF010F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300394, "uuid": "d460b8a5-74f0-4c93-b055-dc952100b198", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300394, "uuid": "7d015038-c4a7-4dbc-a03e-371e7eba3158", "value": "768:EKoV7nCx/ID16fDE4yTElfsYEA91tAmwMii8cXjmGvNTUysYqefXpIieL:KbwfwRTERsM1amwMiiHlTtsORIiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300394, "uuid": "8fb8e35c-6e6a-45d0-8bac-ba39d3c459d7", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300394, "uuid": "026f5a65-749a-4101-80f5-345a62729faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300394, "uuid": "2a29e6c8-a2e1-4056-a2f2-27f8f582d50b", "value": "6193183f2cc40687fa50230569ac10e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cefd74c-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298910, "uuid": "85356685-cdb7-4ad7-90b6-a1c8d391880d", "comment": "Malware payload", "value": "554e66621bf492f13f08bda116585cdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298910, "uuid": "70379f57-4ba0-4c35-af05-c25829e34283", "comment": "Malware payload", "value": "15a772d0dcbde0cffde9b58be5007244fd23159daaa67110f53259ffff69b3c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298910, "uuid": "0dddfeee-e2ce-453d-a098-7ed2c85e7868", "comment": "Malware payload", "value": "af0af6054344e3e98c013e6696d2989ba2e05803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298910, "uuid": "8dd8cfd9-bf31-4874-b79b-1d176f9c983c", "comment": "Malware payload", "value": "091bcc23cc6389a462bc1afa3ce33625fab7b2297f3d5f51bd6725f70b46017f7dc83fb05e19c6e8a2e8c500e88fba90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298910, "uuid": "93e46944-fa1f-4293-971b-be8172bb15f3", "value": "T1FEC4BE17E6428076E4632430265D9B7649BD76300A2655BBF3C42E2D9EF02F2AB35F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298910, "uuid": "ae4107ce-2bfd-4c0c-ab67-5a6ea9dcb075", "value": "06c6e92acd3ff57b00b3132976b3f6d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298910, "uuid": "383b30ba-bf21-4c6c-a546-e92a2d9f412a", "value": "12288:F7vT8cGUCZmxIwNjVGCXZqmmJUL+JHkdIUnjoqhw2w4d:Fz4BUCZmxIw1VGCXZ5mJdkdZnBhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298910, "uuid": "d4d330ec-1eef-432f-9677-d7e075d16b26", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298910, "uuid": "130768bd-1bfb-4404-9286-406c025d5ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298910, "uuid": "3ab3e8df-0367-4a40-8de2-b9fd04d9507d", "value": "554e66621bf492f13f08bda116585cdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40feadfd-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646294541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294541, "uuid": "c6d4d6ae-2330-4e2d-b9d2-20a11d502ddf", "comment": "Malware payload (AgentTesla)", "value": "96154a0dcdc1ac30de6b3a3d3b590ffa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294541, "uuid": "e59a9d3c-d260-424a-acbb-005893c01c43", "comment": "Malware payload (AgentTesla)", "value": "15d2939d19c1e47d9a9873f418389d4d71feaad04d042a6f3eab6b71e488801e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294541, "uuid": "92904f80-2673-4b9f-9cde-9e9d8a07b848", "comment": "Malware payload (AgentTesla)", "value": "601af7ae66717463c69cf6c806f79fe8989df788", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294541, "uuid": "7b9f940b-a858-468a-82c6-9027a9e96dae", "comment": "Malware payload (AgentTesla)", "value": "fd8fba16646da64b4b950fc18a5a3cd3fd13cc437388b55a1dbafd8d3e2dd8dfee7d8919983c0cb2288cf87e848195d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294541, "uuid": "28828f3e-74b3-453d-adda-14e6c0bca290", "value": "T1B81412977F2598B1DC926F365E22C0C67FB5FFA02487E0AA317539DCD2B189059A1F04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294541, "uuid": "6f59ff7a-53aa-4074-96b7-28a0333f5569", "value": "3072:GziWlJSJLguMpcP6rbZWG8BTfgJohrgIgfun5dbn+qHtovCblhHD2v+qP1AUnb:MsJkD6P6xOfg+rgu5dxHM+ND2pP2Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294541, "uuid": "2c6905cd-e67b-4f5e-a3d3-9d595912692c", "value": 190776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294541, "uuid": "af33662f-8b00-4259-b21c-17a3fd29cc77", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294541, "uuid": "910ed5e1-da2e-4a8c-8a93-cf61839704f9", "value": "Enquiry 220062 Krause K + K GmbH Armaturenfabrik.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540720a4-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "e217f5b6-9cec-4462-b4ca-4291817eee93", "comment": "Malware payload (Heodo)", "value": "4ad366b2afc8333c784f48dedb57bd19", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "81dbbf9b-5be9-403e-8295-b97e52c6fd0b", "comment": "Malware payload (Heodo)", "value": "15df53017d2bac69b7ffd373cc95161a6ff06dfcb585fbddc84104cbe691c361", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "3b959dbd-5b9c-49f6-b3da-6df7f6996d2d", "comment": "Malware payload (Heodo)", "value": "b091d26784db75beeaea02d2a81a48de7ac9bf37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "83cd5186-008b-4cb1-a03b-874b12e8be86", "comment": "Malware payload (Heodo)", "value": "c0c3834b4d68388e5f35f29bbbb07ea05dd460de2b220961074acae8483ca77e63ef86891c31ae4e8c44db1b303ff777", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "0311f40e-eb72-45bb-989e-0c7a6725592a", "value": "T1DDD41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "21df5293-009a-4163-af7a-8861395e2f2a", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "f45ccc83-2b9c-4c9e-8c2c-2da7062a9854", "value": "12288:ZxpNJJJ2NHPoczJXOtIhxf3foRXIa5EPwvA:Zx2gczJXFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265797, "uuid": "7a317bdc-4cf5-4d31-bf81-d6424de2c1f4", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265797, "uuid": "42f87b80-1c38-4fea-aca5-f64e175f840a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "c2f97464-7405-4291-8525-bc68f22cc6a7", "value": "emotet_exe_e5_15df53017d2bac69b7ffd373cc95161a6ff06dfcb585fbddc84104cbe691c361_2022-03-03__000304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cca75b1-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300252, "uuid": "22d6a94b-ba06-498d-9222-063a92f51a70", "comment": "Malware payload", "value": "8101347c0dc473a1f106678be2669cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300252, "uuid": "208fd559-7ba4-4b07-95e9-7768bb42cd7f", "comment": "Malware payload", "value": "15eac293fb910e2246ebe6785764d55bfca1b75b63e10e3f392db6b5304b817f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300252, "uuid": "6ae30fc2-86ef-44d4-825c-92a11c5bc2f8", "comment": "Malware payload", "value": "77a581fcf2be7b673cb5a46496925440243f4174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300252, "uuid": "8a1bbb12-a56c-4f4d-99e4-1ac8ae91ed04", "comment": "Malware payload", "value": "31d991643539015367e55e6aedaec6e1db36242e16693a297c3be0278209a13b993dc50068f98445bfc8aad3c33a4a82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300252, "uuid": "57be9da7-7bd8-40e7-a594-f590b7e2555a", "value": "T1AD763366F3E4B392C35769B3FE7568E0D2532005776B66B6845AE2363B1C9A3403B037", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300252, "uuid": "544098c6-b6bb-4d43-8509-51b7944bb692", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300252, "uuid": "3c8d556d-1df9-46bc-b0ac-e2d07880d22f", "value": "196608:DkNuQ7M+7OzI6THaSxYFitObJgZW7QSg4Fm4yeBCGPMA:DkNVM+gI6THaJOZGQMPyeBFPMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300252, "uuid": "f710f746-0480-4c15-abec-9295dbc27401", "value": 7229080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300252, "uuid": "6f5cd4ac-8475-4b2f-8445-1499bf3a0c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300252, "uuid": "2691a039-a808-42ee-a051-904869db96cb", "value": "8101347c0dc473a1f106678be2669cbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9324b08-9b2c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646337719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646337719, "uuid": "ad96f210-f659-47f7-a2c1-4cc7ce785208", "comment": "Malware payload (RedLineStealer)", "value": "0cc27690e2886c785a303112d1480b55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646337719, "uuid": "acb29f91-af27-4c3d-9ab3-10362e15e4d2", "comment": "Malware payload (RedLineStealer)", "value": "15f4e965344a38b07713363133e6624f72db10cb297967e91608eec1020e6b1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646337719, "uuid": "fb0ab556-f248-4561-b616-146e69f6d980", "comment": "Malware payload (RedLineStealer)", "value": "f4723a92fb1c26fcd2f1cd9e8ce7b4a9c0e4f49b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646337719, "uuid": "f2e14a7a-0287-4329-b533-5feb4eda3eae", "comment": "Malware payload (RedLineStealer)", "value": "9da6e88a98e91f82102e776782240edb3edacedad6dde26fa9df67ea642c737049a13e6b5797ae207c67486852b05e43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646337719, "uuid": "30b691a2-ab8a-440e-8e80-132e618c695f", "value": "T1C71633A5163CCAE9D7C83432FE1489F87A95BC0206355BA6BB0F619FD4A5FD950823B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646337719, "uuid": "70a04d7a-3d05-4a1c-a4ab-eacf64a193bf", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646337719, "uuid": "4d876262-c208-4dba-9e1f-addc17d368aa", "value": "98304:yOBCpDMQ02DV6VvtPjVfhVOf2MzuXdgOONLp:yOUl3DoVlnVOf2rGOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646337719, "uuid": "5a644bbd-c4b9-44ed-b07a-1b42ff644d29", "value": 4222941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646337719, "uuid": "98a0f06a-1bad-4e6b-a5bc-8a4c814691b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646337719, "uuid": "5cf3d3c1-1067-4288-ac43-e359647644b5", "value": "15F4E965344A38B07713363133E6624F72DB10CB29796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a6b573-9aa1-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646277799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277799, "uuid": "45a68eb7-11d6-40a0-891e-3378db6b43e3", "comment": "Malware payload (Loki)", "value": "fb750f476cd3fa488b8cbe7b393de8cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277799, "uuid": "788b4a7c-959f-4b2d-aa59-8526a9393017", "comment": "Malware payload (Loki)", "value": "1625fe44cd35023ee50fe2387d27b1d1f1a6d858874b60be9404bd84be3733da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277799, "uuid": "93efa8f7-f85e-4f60-bd0a-359b84be2e94", "comment": "Malware payload (Loki)", "value": "1d88772402f4378214e3e749bcf364dc05343d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277799, "uuid": "f03eff01-05b9-49ef-bc47-236c749c4f28", "comment": "Malware payload (Loki)", "value": "1406eb0adebe511a7639195d77d5eaba41d462816f8b5c2398aa220574484928db0882532bf40355efa3672a1bb21cf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277799, "uuid": "f3ddc353-b7ba-40fd-9abf-82168e7c5948", "value": "T135A49D12A9CC9652CD99A3F01EB7DD7AA255BEEC06B9D43F26D83E1B35BBD0B1010305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277799, "uuid": "2626cdd3-6b7e-41ae-896c-ecd38b33103d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277799, "uuid": "c5d12c40-569d-4b66-a349-f8acb0170bdc", "value": "6144:CpGidp2sF+BsB4gx+hxfwIPD7ovTmgg7A9ct48zKARrHgP1:6ptWgghx4co7mgg7A9L8zBcP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646277799, "uuid": "9d0fa94d-82f2-4a61-8916-bba231abcb72", "value": 476540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646277799, "uuid": "bffba5e1-c912-4fee-b7ef-6698188beadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277799, "uuid": "16302e1b-3bcb-4f88-b0a1-cda18f21a91d", "value": "IRQ2107798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5357a9cd-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "eb41693c-3431-4fa6-9418-a7efe49b0ee4", "comment": "Malware payload (Heodo)", "value": "a81b1d46fb7db087882a998816016b51", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "37d3c8f2-4fe7-4a69-a3a2-104b3555a9ba", "comment": "Malware payload (Heodo)", "value": "162e40ed16db5e0993f867b512062dc7837ea6a9a6ed9377dc5a63d31f6c0d64", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "e6e8c1bb-493e-4abf-91ff-1fdb8214d8f9", "comment": "Malware payload (Heodo)", "value": "2a9847bea2d7f6c6b10673acdd5643e7b10ef78f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "a6e60076-6c6d-45c0-b992-005de35b996d", "comment": "Malware payload (Heodo)", "value": "306a9d8d0f9522290e8aba22b45fd6fbd28916a8fd5477b2f871ff532b103a4cfda24e94012ccbd80ff1913dea9dbdef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "ddcf4f1f-68d9-4f56-b24d-a0edcc464fb3", "value": "T1F0D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "e6131412-6b8f-4a62-bb7d-c6d9c5be38d3", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "bf57cb20-f075-4b75-baee-488979696043", "value": "12288:ZxpNJJJ2NHPoczJeOtIhxf3foRXIa5EPwvA:Zx2gczJeFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "88578a73-1339-4ea5-b47a-95c4a0331a7c", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "6474143e-f701-47a6-92c6-56fb0697c401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "98f051d6-793a-497c-8c1b-aa00f2841e95", "value": "emotet_exe_e5_162e40ed16db5e0993f867b512062dc7837ea6a9a6ed9377dc5a63d31f6c0d64_2022-03-03__000306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7f57d9-9aee-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646310831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310831, "uuid": "9f0959ec-998a-4618-8fc8-514cfa6acb4e", "comment": "Malware payload (RedLineStealer)", "value": "213efd3cf9627614fa7681fa0d848c17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310831, "uuid": "ffb815ab-43eb-4e95-afdb-6157a791b03d", "comment": "Malware payload (RedLineStealer)", "value": "165d2f8c03c978131268abeb768e34bb1f6514d033184c695c6e048c70a2ccdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310831, "uuid": "06ef8930-4fef-440f-82a7-bd189eeb1e5e", "comment": "Malware payload (RedLineStealer)", "value": "eec811da28fdb84803494b55a9df0d46794683f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310831, "uuid": "5d223ae0-87aa-4d33-b3d9-a4a001d4843a", "comment": "Malware payload (RedLineStealer)", "value": "7446a06636ec9b465c945ed7f7a62a3f392af975ca3d25d3931b9b7aad53fd4165634c7a74568ee1a41ec83c84de151e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310831, "uuid": "176ac6a4-8c1c-4a35-8176-213f0b391704", "value": "T1FB2622C3C78CB296C85671F23FF54DF5C4F8AAE599087236D80CB98C52B818A64C97D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310831, "uuid": "d8954ea9-19be-4a5d-9711-aedbf8094b29", "value": "c2ca3ad94dd466f174139e9df577b14a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310831, "uuid": "98029683-1012-49d7-86ef-71c5c78d6aab", "value": "98304:+6tG7Oxy0J9bcRF0Y333euWRWXIxmDbfxnxrP:7Hxy0J9bcv0uWpxmDbfxnxrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646310831, "uuid": "b5c49d67-fd2f-4119-bebd-5c19e01fb5f0", "value": 4694816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646310831, "uuid": "2c99d58c-b328-46f9-bfd8-05abe82d904a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310831, "uuid": "4f999dfc-591a-42e9-8f72-5a28aa8da4df", "value": "213efd3cf9627614fa7681fa0d848c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69f16ae-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646294363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294363, "uuid": "e31899db-b452-4630-84eb-126c5228ab96", "comment": "Malware payload", "value": "dcc5217e849c5f940cec2cf398c3f8d7", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294363, "uuid": "c5ec25f6-e545-4e5b-9948-fb20e4a2eb9d", "comment": "Malware payload", "value": "1693df1ea4b2dc1d31c9569599e48cb8e9282e251b3a3318e71a88ef6ea72027", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294363, "uuid": "4701d19f-c0e1-45cd-a8c4-6774653cbf93", "comment": "Malware payload", "value": "e1d7f0934340aae12d4c3b0f074c85108b09bed8", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294363, "uuid": "6e95bbef-85e5-4b72-a459-3df9c8762108", "comment": "Malware payload", "value": "cc74b5dfd17bf5567779480a8b76170c3d2fb6f5fea6923f8750d8dfe543c74d648ab1be16154670372cdf71d62c156a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294363, "uuid": "5340ee0c-ef18-45fc-bf81-3f5fa6e8cb40", "value": "T1A3F3D081B182C456DA5817B91CE6D6C96767FC308EB743873684F32F5EB7AA0CD22217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294363, "uuid": "0ab205d0-52ce-4678-bcf3-c95703d37b79", "value": "3072:SrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAd1/U8ITUxViNSt7TqkcfqGWJjF8F/Te:UxEtjPOtioVjDGUU1qfDlavx+W2QnAUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294363, "uuid": "32cb4d6a-8ca3-40e2-9caa-1e2669acbc52", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294363, "uuid": "55ef6dfb-047a-461a-9c15-205c03baf42b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294363, "uuid": "2e349382-421b-4d73-9fb0-cefeca4303b1", "value": "Pago232022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a537eb-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646298034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298034, "uuid": "4259c26b-1bb0-4f48-8422-b27b4e6de714", "comment": "Malware payload (CoinMiner)", "value": "1d59d36dda6eceb42ba14aa9b701109f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298034, "uuid": "7170a6de-90ba-4fc9-970a-bd1c741857d1", "comment": "Malware payload (CoinMiner)", "value": "18000f728a5becdbf9869f966e0d99208e2d755733e1fab614de7c9527bb3618", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298034, "uuid": "07d1246e-8dd9-40a0-9bff-2d46cd001bc8", "comment": "Malware payload (CoinMiner)", "value": "7382bd78eb8b4776f9551a060a90890c96943813", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298034, "uuid": "9bccfb4c-a70a-4ec8-a507-f7ce49cfe39e", "comment": "Malware payload (CoinMiner)", "value": "24ebbb774883a2f48af9a0003bd4283ef9b78c6b0899113a31b0eccfd73e2385aaa5c7eb74c778a8ad8db4577ded14ee", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298034, "uuid": "b3ff6f39-a824-43da-a900-26bf60cea68b", "value": "T16C36EE82EEEF6EAFC89F7532400D1C574ACE949806704AAEED17AD55FBC028348655F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298034, "uuid": "1e851ac1-f67b-42cb-b3db-c6bcf0b5bdd0", "value": "dd393e4dff81669a5705fc2b9d2d7846", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298034, "uuid": "af2de9b3-2fed-45dd-aca0-7213e58fda45", "value": "98304:JyUVU+ZyhyD2teBygWWeZuYwkQoSDEUEHDwVSO4J1w:Jyc7MoEeBc58k4DE9kVSFJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298034, "uuid": "8080e3dc-0aab-4f68-9dad-12f70ce46ee5", "value": 5276672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298034, "uuid": "d8df8f11-1d29-4b5e-8fa7-a8ac7b838d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298034, "uuid": "9063554d-89e2-47e3-bf8f-4cf8b3938f17", "value": "1d59d36dda6eceb42ba14aa9b701109f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538aa03d-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "0a448ed0-d870-492f-9e32-0733a6b42af4", "comment": "Malware payload (Heodo)", "value": "2d5501b455c90417dbd92dcf739cdf6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "2ecc5eaf-64ef-426e-a05c-5b33a86e98ee", "comment": "Malware payload (Heodo)", "value": "18447c30dc92120d7f29abbde3e9051ceec205a54c39bc6c796ccab1c1c6b2ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "c612fe91-5b85-47ac-9e6f-1c0844b55b9a", "comment": "Malware payload (Heodo)", "value": "dc6034f258b0eae69c10f80a75ab8bd1d13fb69e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "4adb3a95-ca07-4490-a4c9-a83d106e9f89", "comment": "Malware payload (Heodo)", "value": "510e86f0207aeb5f780f5c149950208cf97ac23e7eb67fe83d4d8f3db1df563505cc3c0bdf3f7d60da16af99e78a4f02", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "2463d21c-57c6-4d34-8c47-bcc9754ae8fb", "value": "T13FD41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "fac2c2d9-a920-4d43-b37f-286536f296b9", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "0ee89989-65db-4325-8088-07bf3dd98c1c", "value": "12288:ZxpNJJJ2NHPoczJOOtIhxf3foRXIa5EPwvA:Zx2gczJOFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "1ef4e975-c710-4cf2-8e74-eb55ec121008", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "c2421c9d-25bd-4ab2-909c-c89cada298f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "79046e7e-06eb-4d33-b108-ed1c134ffa49", "value": "emotet_exe_e5_18447c30dc92120d7f29abbde3e9051ceec205a54c39bc6c796ccab1c1c6b2ed_2022-03-03__000306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a2b3e1-9ae4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646306729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306729, "uuid": "b1fb6e31-5852-473a-8f81-11fa7b028b2c", "comment": "Malware payload (RedLineStealer)", "value": "f29763d6e9910d8007b4c0698a183cc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306729, "uuid": "885910b1-87eb-4f64-a858-d866038d1c5d", "comment": "Malware payload (RedLineStealer)", "value": "1892d88f0b5dac1695cb9611c992ad491b1138a08fc421aea481d85fa14fed74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306729, "uuid": "ee8259d8-accb-464e-904f-5ad60413c558", "comment": "Malware payload (RedLineStealer)", "value": "e2e58db7cf3a203a7413561de304c0d90ba3650c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306729, "uuid": "5984483c-0ad7-4e8d-8d7a-23792692fa82", "comment": "Malware payload (RedLineStealer)", "value": "abec646cac7ee10c7b1efcb9bb03445b3e20b9e98d3be3f7fd020a4d3dea44c396ad8b9ecb475711b1eab4a0c203eb85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306729, "uuid": "5bad9010-4519-4e67-a3f3-3ff6989aff38", "value": "T1DB26336D5280BA99DFCE9CB05718CC36CE8397332FEB65414ABF9F4107A920A4769347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306729, "uuid": "755e5e4a-3f80-44d1-8546-704919210853", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306729, "uuid": "0b775e32-b904-4c4c-afed-edccf2e52ef8", "value": "98304:iBCi0dHQ0kJdBOWm9H43dCegMLcq3B2/zyMzA:iBCi0dHQ0moPH46U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646306729, "uuid": "ad34e876-94e2-4501-a7ed-8b52926b075d", "value": 4548096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646306729, "uuid": "3c2e6448-c216-4c59-afe8-0b128f408114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306729, "uuid": "dc507aa7-dcde-4ba1-ac9b-ac0c6b06d86b", "value": "f29763d6e9910d8007b4c0698a183cc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fcfa73-9af3-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646312912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312912, "uuid": "aa5276f4-27f3-4ebf-bd15-2a42315f98c3", "comment": "Malware payload (ArkeiStealer)", "value": "b9d0476ea3c0e48f5b74086841a88d50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312912, "uuid": "5260bf69-e385-41fe-9f2b-e37345ddf796", "comment": "Malware payload (ArkeiStealer)", "value": "1893e03e55108eba24d25a6650802e496e82d19f62918f0db81acebe3d3187c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312912, "uuid": "523ac951-3cc1-4300-a46c-7945e8827eaf", "comment": "Malware payload (ArkeiStealer)", "value": "18b16629a30d6b4bd387a77825e623b4f2e814cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312912, "uuid": "8a5d4990-eed2-451d-9311-cdaf45957ee4", "comment": "Malware payload (ArkeiStealer)", "value": "6b62d26fc93cf817895c9fbd6f1a4ea75a5b81343d5696cb847e070bb12f48172b2df71e2e30bae2eb58db45a4bf2197", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312912, "uuid": "06b3ed92-ad73-4f8c-9153-fe9bc7583357", "value": "T15C75221DB318D885D559A279EE74E3F04779EC384AA5028730E6BE0BBEB771ACD044E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312912, "uuid": "8a8870df-5e4d-43e9-b123-c743559e0d8d", "value": "3adc9b8534e29df76c0027f6ef4fb2ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312912, "uuid": "2478052f-cbe0-4df3-a1ba-bc071df09dc1", "value": "24576:TGLL/xjlXo+EUG6g99VU5YW9cQPEB6/tYi6Rl6R6l+cDlDt3inHn4CDSw4+TR6:TG/pjl4+EB99yWW9cEEexKrdlDtwn4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646312912, "uuid": "95dc2c80-82b7-4ef5-8168-8cbd3b7beceb", "value": 1579136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646312912, "uuid": "ca437d8d-93ae-4d0d-9b53-b739500ec0e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312912, "uuid": "55eb03fc-7482-45dd-a6bb-059b88712357", "value": "b9d0476ea3c0e48f5b74086841a88d50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8b9cbb-9b34-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646341077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341077, "uuid": "4b93bdf2-6ddc-49da-a556-fab9dfd036a8", "comment": "Malware payload (Heodo)", "value": "cbee32d485cb2b98847e3e851ab8d149", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341077, "uuid": "6f9467a9-2b63-4a18-885b-b059a6cd3cfa", "comment": "Malware payload (Heodo)", "value": "18b18ded0a3cecbf4a0a5b37c796ffe2d2d38275963919d04b80ee788a2daae1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341077, "uuid": "38c79c35-dd32-479b-8074-0e1335e9d1e0", "comment": "Malware payload (Heodo)", "value": "80367f6901b085ea61875e361242f022b0bdb07e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341077, "uuid": "ed8486f5-c7c7-48de-a9f7-3eaedf87a7c8", "comment": "Malware payload (Heodo)", "value": "14be9671e06822086d9b6537c46deb4dde007dd1753a301fa3f38684d36af84f3c981910c2cb957b6638623376341c7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341077, "uuid": "0462de5d-1b2f-4fa1-b5e9-fa2b9ae8926c", "value": "T156D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341077, "uuid": "859eb37d-dc5b-49e0-98e9-25bf83cd3e7a", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341077, "uuid": "039fd821-d085-4e72-8e7b-d9acc6c7654f", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLGCjzhmD/bwb1r8Hc:Bg4IqjYTG20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646341077, "uuid": "97baad1b-1e0c-4880-8ea0-3d23f118bb7d", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646341077, "uuid": "8e34f42e-efe4-48e3-81ae-b3e0e1db0904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341077, "uuid": "1ba253db-926d-415c-8a1b-1d6be6f42808", "value": "cbee32d485cb2b98847e3e851ab8d149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c01725f-9aa2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646278131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278131, "uuid": "9ba375c1-5b31-4b1b-b1fe-adfba924ef72", "comment": "Malware payload (RedLineStealer)", "value": "6bfc1b42014e76be8deee330ff944681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278131, "uuid": "20be6c97-6851-4196-af58-30ff37872b74", "comment": "Malware payload (RedLineStealer)", "value": "1924be27896fc861692cf9247734cd87ec7b121a8a7ffdeda8d313f9d8a12981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278131, "uuid": "1b3c720b-d665-4764-9803-417bcac7421a", "comment": "Malware payload (RedLineStealer)", "value": "df22b2d235964e322916818bd00c82799ccfe81b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278131, "uuid": "b8d4e59d-3ff9-44c1-89cf-bc54d095353b", "comment": "Malware payload (RedLineStealer)", "value": "977611f8cb9a7e193dc11afadf10a4364e6f41c8ab9d2d39735364e5fc1a66c3d7c0238c7169a3a32a1fee1a72f68bec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278131, "uuid": "ddaed0a9-9258-42c7-abd6-807447adc348", "value": "T1FB562843F99250E8D1AED1308A679722BE7034988330A7E76F5197F52B73BE43A79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278131, "uuid": "9baf182e-9a50-495e-a84f-ba318b638c84", "value": "dbc655057e0a381fe85e8bb055c4b9c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278131, "uuid": "6aec0e85-203f-4926-9d51-29355c8da2f7", "value": "49152:ntwmLITV3dxo0SQsQIEZiPvIY2HoK4VBRYQ5ayp0YFRGraxR1b5ERWuowtXEJ+G4:tEp3dxSaszY7ijGWPER5J3v/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646278131, "uuid": "2181885b-b283-4565-878c-8eea6b0e7470", "value": 6201344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646278131, "uuid": "55c83cd1-c77d-497c-ba08-684c9d248f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278131, "uuid": "4057e6ba-6d04-45d2-b7be-27647a8304dd", "value": "6bfc1b42014e76be8deee330ff944681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580c454e-9a8d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646269239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269239, "uuid": "0a1cf2d0-dcdc-4e39-90e1-4b945fa6f082", "comment": "Malware payload", "value": "4024afc9a0abf2e3879e378b5a1750e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lmir", "colour": "#0279A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269239, "uuid": "a67d512b-2c7b-4a39-8d21-6c40299b183c", "comment": "Malware payload", "value": "1982a09310996da28713af767245b29fa6e7e08b395f3b1eb8ecf1fdcc0d282b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lmir", "colour": "#0279A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269239, "uuid": "83e37ad8-c717-4589-b5f8-a4358e52685d", "comment": "Malware payload", "value": "1e022a6fe10d14634b9370b889be08fff10660ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lmir", "colour": "#0279A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269239, "uuid": "f45fff7f-e241-4f75-8e93-2fc9ac90712a", "comment": "Malware payload", "value": "8fd6489d380073c9f631d805b2bde8595620e6ed1341a8504b80fb2058ebd935de8ad8f3a7a69335fe70736c75e8e7ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lmir", "colour": "#0279A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269239, "uuid": "03dbd977-52bf-4e76-838a-92cf40172f3c", "value": "T1F3741862F3E28076E0B36B788DB542917937BE556E38958F66DC4A0D4B33BC09D38712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269239, "uuid": "8a3c2c4b-959e-42bb-91b2-b7083c026634", "value": "aae410db5a351d384de2e35faf59497e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269239, "uuid": "34c1ff01-b6b9-4555-8d5d-73a7fc5a6b84", "value": "6144:9ajdMJb6SqIqOq2eJCdlCgyVQr1dI5PpFuZ/vTL9+6NkaC5DbCp:+2JbM2yYl9yqm5PpiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646269239, "uuid": "a23fcbb2-2d04-497d-b052-1f43a941bafb", "value": 365447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646269239, "uuid": "57ed5066-eccc-49aa-b642-4006579c1efb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269239, "uuid": "4fb5203d-93d2-4576-84fc-4b967b483566", "value": "1982legend.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a94f8b6-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646300221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300221, "uuid": "e07fc88c-bc6e-40fa-80a1-d1a6eefb8a8e", "comment": "Malware payload (RedLineStealer)", "value": "8400de7ecab7d9797782b55019dd9088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300221, "uuid": "92ec45a6-109b-4ef3-bdd9-42f26978a1d3", "comment": "Malware payload (RedLineStealer)", "value": "19dc1883b059b969542f6e0530662c0691f995b68a36101f8f1579b6d9b2b4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300221, "uuid": "dc8e95c0-b48c-4431-948a-b119de495496", "comment": "Malware payload (RedLineStealer)", "value": "d3356b385fa62f8d91f5286e17e80c3b9182d21a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300221, "uuid": "06cc65ea-c1db-4986-9442-161f19e1cfde", "comment": "Malware payload (RedLineStealer)", "value": "b8980aad59c67492fea50c56f50587f9acc6e0bfbbd9ceb8be6090e0a23e219b6d15896872da079f21dc16f7ca5c0bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300221, "uuid": "f71c292b-ae07-4e43-b854-fd44979da858", "value": "T1EAB4B53439FB9019F1B3EF75DAD87596DAAEB7733607E90D205003864A13B42ED8163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300221, "uuid": "0539c7c8-3fca-44a8-a1be-a268012249d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300221, "uuid": "fd7eb92f-6a18-46ed-bc26-84e30676e7a6", "value": "6144:pe4mY96iDNcv3+u52VBbwngipe+hDktovSG/UAgsrdgTv:Dmi6iDNcPmbSpphCovSG/bg+dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300221, "uuid": "9d0cda0b-49fc-4e8d-a8c4-b4885b0a1d2b", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300221, "uuid": "722bbc7b-d51a-4730-9ed6-0abf80bc1134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300221, "uuid": "ebb3c092-b646-4470-bfd6-188d4bbde556", "value": "8400de7ecab7d9797782b55019dd9088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f74a4d-9b2e-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646338417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646338417, "uuid": "896632d9-32b8-49c0-8c88-e4926d6b3f67", "comment": "Malware payload (SnakeKeylogger)", "value": "69fa77eab0b081b36ddbe7ceb136c73c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646338417, "uuid": "4fb1d1b5-2d63-42a7-9fb6-35b654b0f1cc", "comment": "Malware payload (SnakeKeylogger)", "value": "1a1c7acc01978692e46ffcf143d9925098325c1d9796aa690a3b7963e5a4444d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646338417, "uuid": "26179c3c-a45b-4c07-bd07-dba4c7ad03bc", "comment": "Malware payload (SnakeKeylogger)", "value": "d62bcce1e003772bde93aba67eaf5a2dfcb09cc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646338417, "uuid": "a368e53e-813a-40b9-bbdd-5167f9e06014", "comment": "Malware payload (SnakeKeylogger)", "value": "8609f5e559f98e77ee689b58f605a5234d0bbc9996efea0bdcb7fe62e633e6359a4730134c18ab4d09c5cb5c1b7ac108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646338417, "uuid": "de6ade9c-44be-4d3c-bf01-1534ca05ae4b", "value": "T10C55DF02FDB91C02D9FDB97C609324316B275A7A187E8172D638D164FF81A871A7E1F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646338417, "uuid": "e8e54272-29f0-4748-a905-797a155e4316", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646338417, "uuid": "74fc7895-173f-4367-a50c-0ecfd4adcbb4", "value": "24576:QWuxipxxfLOaDuQM+hsyGHf1Wmt5vG8HRUAhNT/LAYIIIn:9fF9yZ+hsf1tvVTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646338417, "uuid": "59a90164-a7b8-47a4-9fbd-ead320d66231", "value": 1390448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646338417, "uuid": "592abcde-bdd8-437f-8f40-0a41c5b99de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646338417, "uuid": "f032ae40-59e8-4911-bd0a-dcaa546240c2", "value": "RECTIFICATION IN AMMENDMENT APPLICATION For BLNO. MEDUSS632975 - PNP POLYTEX.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9eea5f-9a8c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646268868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268868, "uuid": "f6a24f1b-e651-4f72-9ba5-619a14602188", "comment": "Malware payload", "value": "6194c2260b6e8583ec4d6447503aee34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neojit", "colour": "#8D7C23", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268868, "uuid": "74b40892-1a2f-4a88-8353-608d91c53608", "comment": "Malware payload", "value": "1a39197ec78f5896eb4957b826a268a3f66bccf93a4f13063a9161851a0ac3d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neojit", "colour": "#8D7C23", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268868, "uuid": "291a0a37-454c-4dfd-b62e-01bd1f3ba9ce", "comment": "Malware payload", "value": "d6c0d0ab9026b1f10be2cfd0008798683b24c78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neojit", "colour": "#8D7C23", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268868, "uuid": "d10bc940-7b60-45b5-a3f2-c4a279772199", "comment": "Malware payload", "value": "fbdd40e25f8b8b2726d16aefdb6818ad3f3390c3c402da8730404af53582bd06afa09ae12aa04efa3b8097de46f8db4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neojit", "colour": "#8D7C23", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268868, "uuid": "bff63563-41df-4f22-ad8d-afa083a33166", "value": "T1AF7401A296D18EF8F0A70C7888DD153439BBBF619E68D1AF60C10D2E9A78D005CF5787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268868, "uuid": "4d53b31f-06ee-4435-b916-030ac01ddd82", "value": "5cc0a79d4c3df91388165ea72b28992d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268868, "uuid": "67261c49-0b29-4fd6-8b88-cc0c5ca01e77", "value": "6144:7vbx8RfwCINz5G831ZVcmxSAjebHRuI+bRN8u6kFIU:7rCm11ZemxFCHR2bRfLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646268868, "uuid": "9e11ffca-effe-40bd-97a4-c9e6b7ca748a", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646268868, "uuid": "0a1b8078-a814-46d9-90af-7a5dce958fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268868, "uuid": "9b8a7e0e-9b0f-4929-b2de-a6117e883321", "value": "neo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527ddb6e-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "95aa65d6-86b7-440c-ad82-9c3da9224e94", "comment": "Malware payload (Heodo)", "value": "28e4f92422dae4434956547b559037e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "122bba43-5a99-4208-90a2-68a6d014406c", "comment": "Malware payload (Heodo)", "value": "1b0415ab8242a7153f11124bf5c57e70a3a1b11763340b004b107dcd0a46c7dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "48a55774-2ae6-435b-a804-d8ded0f9330e", "comment": "Malware payload (Heodo)", "value": "930f0152e3da57899bc1360012c29eab3c373ca4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "6a1ee4c1-aa85-4ca1-b779-a2fcd972f4b6", "comment": "Malware payload (Heodo)", "value": "5a7e1874133c5eb6af49de5e5d2a32d100b242ee4681e2a275fcfb26b422e616846577463a26673bf0872ff3635b768a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "10b034a7-8036-41b4-a94e-7f5c2c6ce0f6", "value": "T14BD41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "54a835f4-df97-432f-8cee-59d4138b2323", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "04739e8d-588c-4587-87f3-e4a20e0a7b6e", "value": "12288:ZxpNJJJ2NHPoczJmOtIhxf3foRXIa5EPwvA:Zx2gczJmFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265794, "uuid": "5410125d-ccbe-43bf-975c-9b7b65f34787", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265794, "uuid": "dc388d4a-c3a6-48fd-91bd-5ffee6d9cb6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "a18faafd-86d1-405e-bb8a-298d831b00f0", "value": "emotet_exe_e5_1b0415ab8242a7153f11124bf5c57e70a3a1b11763340b004b107dcd0a46c7dd_2022-03-03__000305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46b0f6a-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300372, "uuid": "2c170a67-9113-49cf-9429-3731121cd806", "comment": "Malware payload", "value": "6aaab1406de381b302e742ed314a23d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300372, "uuid": "f0943803-4034-48a3-8b7b-3198ccb14a26", "comment": "Malware payload", "value": "1c32193408cf8521acc05b27068d2e523083b8de99938a0100a95c577fde720a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300372, "uuid": "d2a62560-496f-4507-bc65-e8bc43892ef1", "comment": "Malware payload", "value": "0f4183727ef6fc8deaf308fcc4af26feaa730f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300372, "uuid": "fc81f62a-21f4-432c-b71d-f13d94ff4673", "comment": "Malware payload", "value": "00c36aee0ec854d7bd1b3e7f9a6def16354b0370f84c157fab3d544b067aae82c118848d2a7aaf6faed5e198d5d3ba51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300372, "uuid": "2678ce14-9169-449a-8069-7e454a125d92", "value": "T1E595235667C14F13FDA4E7FDEAD6533EA08D81F77042FB2E500822BF8553666AA87801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300372, "uuid": "61597603-1f17-4e49-b02c-5b962b89a67d", "value": "49152:5rFSkNpI4KnTVaSs3joRHYKv9T2FWrMpOwrTwNk:HpI9nTVsKJ2E/qTwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300372, "uuid": "17baa252-a3b1-436f-95e9-7075632b4c3e", "value": 2036964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300372, "uuid": "d378443d-5bd1-438b-ac6c-647f7955001b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300372, "uuid": "a6899054-f318-47ac-b3d8-0bea28e884b3", "value": "6aaab1406de381b302e742ed314a23d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d0b7a5-9ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646293803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293803, "uuid": "a384d8ca-148f-4b58-a96c-181f43104720", "comment": "Malware payload (AgentTesla)", "value": "09687e105689667e7a614e78eea33069", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293803, "uuid": "d1afef83-3603-4fdd-9ceb-b69e4ef8a80c", "comment": "Malware payload (AgentTesla)", "value": "1d28ef8970e10321758e58e1ceed195ca5ac2c27730d10254778d1c42df9518c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293803, "uuid": "f2f3dc87-0db2-44d7-94df-b2ae9143ba85", "comment": "Malware payload (AgentTesla)", "value": "2119e75c53f647b95cfcd753923b97f8eeca40f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293803, "uuid": "9f7bbb8d-4d15-490b-a54a-f33f8e1dea22", "comment": "Malware payload (AgentTesla)", "value": "ccdef3827d790cee2761d384c0cd990503458c03a328fb9d49463e09d1da4d069476453f0989d5db1920c80f2a760f3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293803, "uuid": "b3a8740e-69d9-445c-817a-2b9ba990e5a0", "value": "T169053356330FABF3631144B297A65787559E3F0081B265CA3FB7F9A6EC20A71021A42F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293803, "uuid": "5943a95a-bb54-4497-aee7-ecfd26b36f61", "value": "24576:N2Gx7CC+1qQsjsypdA+gG2f9KhBgdb+f3fGB:NFWCABt9KhBqaf3fGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646293803, "uuid": "11b43c6b-a3d5-4b2b-b8ce-c10ded4ccc58", "value": 797460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646293803, "uuid": "67250ee3-c60d-4730-873f-0cedd59ccae8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293803, "uuid": "73423b41-256e-44b0-b7e4-96a7a5f50213", "value": "DHL Shippping documents.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3bf2d5-9b0e-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646324710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324710, "uuid": "b47a8a40-8b87-4a43-b48e-eddbbd114cd4", "comment": "Malware payload (Quakbot)", "value": "21473c415e8b94b17886ab82183f1300", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324710, "uuid": "c6aa3a00-4cb1-4403-b359-6515ac72614f", "comment": "Malware payload (Quakbot)", "value": "1d34388c2b19ca4ca95128d415c8a8149f9b8e37bc9ad13688752372655873af", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324710, "uuid": "6f3bdf7c-d2be-4ce0-b9c2-bcd8deaeace7", "comment": "Malware payload (Quakbot)", "value": "5c11f7284a252f8f07a49c78e0bf81d66aefc699", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324710, "uuid": "aa3242e9-b197-4a6e-98db-2e6bdf44f172", "comment": "Malware payload (Quakbot)", "value": "6fbea806c072b45e466d76c092806b7069841076b01472fe3ca513ffc3e250b4707138f075cb3693f93dbdabc9dba77e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324710, "uuid": "8c03c980-15d6-4e1c-b66e-8f685b927c81", "value": "T1D3B4BFB875146CE1E6BF163BC995ADE803762632DE87D8CE506477C709733A1FE1280A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324710, "uuid": "4285088d-01eb-4a4d-9c51-bcba011f92e6", "value": "0383b6e78c7f005efbff386cee23786c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324710, "uuid": "871c5c20-133c-48fe-8af3-d4cf2ea82f84", "value": "12288:vnKiMBsfsXtxbohL+/JkjFbK5BFHGiIDwqJ6dYcH:vA6fevoVaJmFbeBF5IDt6dYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646324710, "uuid": "04228f2a-2726-4778-868e-d1e829e16099", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646324710, "uuid": "7cfa46d3-3f70-4c90-aead-3ea05d1907ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324710, "uuid": "a4945dcc-8b79-471b-984f-3b129b829885", "value": "3777894.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a4a7f9-9a88-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646267278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267278, "uuid": "8bd99dae-bf39-4640-8274-71c30285b25b", "comment": "Malware payload (Heodo)", "value": "e5d0c26b328f92e2460ca798ea2be9b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267278, "uuid": "c64d7ff5-5960-450c-b0f1-918e0d366399", "comment": "Malware payload (Heodo)", "value": "1d3dd219386979dafe781961821b93d93e306bc26ce732a5c4e7c312e313f9fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267278, "uuid": "a21ac28f-ef20-44b3-ae12-5752ea0f3ad5", "comment": "Malware payload (Heodo)", "value": "f575ebd4cf261d89dbed77ac0ac0df70f7ea2a0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267278, "uuid": "f05ea5db-9a54-4886-a841-1d8a0c26ca26", "comment": "Malware payload (Heodo)", "value": "06512644b94ed5b055410f319222bf6335e666085ac70666c80076385f2ba185e9246d85c5912915fee90a971c5ff7ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267278, "uuid": "86d6da76-2199-4033-9f6e-e5f26a69731d", "value": "T110D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267278, "uuid": "8d09a05c-7e5f-429d-8796-505b37847642", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267278, "uuid": "943e03a6-842b-4251-8948-adb63dc044a4", "value": "12288:ZxpNJJJ2NHPoczJvOtIhxf3foRXIa5EPwvA:Zx2gczJvFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646267278, "uuid": "efea9878-6a5b-4aa6-b1cb-d8d596d02a3a", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646267278, "uuid": "48c8a3a9-8ef5-47c1-907b-544174d336a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267278, "uuid": "5e471d83-b83d-4555-8436-c4db842bc1bc", "value": "e5d0c26b328f92e2460ca798ea2be9b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3071387a-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646300097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300097, "uuid": "905ed345-8718-4f23-bb51-80a2ef4a2e0b", "comment": "Malware payload (Formbook)", "value": "abacaba7978b47ece90f2f06b2913817", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300097, "uuid": "f120cceb-1d54-4acb-8648-b8fe175dd3c7", "comment": "Malware payload (Formbook)", "value": "1d3e6f0af15176c7d85042d0822fb3bc4875fdd42043b760699db3e5252c059a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300097, "uuid": "cdd9b603-fac8-4a29-a851-477fc75b1f9f", "comment": "Malware payload (Formbook)", "value": "83a8ec5a0fcf833f2f5036d21a4a2cb6037b97d8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300097, "uuid": "3482217e-fe24-42b9-91af-f666edea4ecb", "comment": "Malware payload (Formbook)", "value": "7826f4a25fda70c4e30dd4a377603ab5b1b3c803134c4d14776f63c35f92c89536ba1cf73d0a26c326e03f856f5ce00f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300097, "uuid": "87010f10-2b44-41b8-89b9-2e21998c5658", "value": "T1C51412293996395FE1D3AD394424216C20E9BD13D744BBD4AB88F08F5C3995982F8FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300097, "uuid": "c784037b-25f9-43ba-80c7-35de149b4637", "value": "3072:QClFOtYLkRUyrTCQPjXFZx6WCItyIyWcuhZKTzMvYSQTuNwjpvj/YtA/O:j/OtokRpTfX56w5qOxwtvjYtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300097, "uuid": "24f4c445-9ab1-4b31-8bd6-9cc9204a6387", "value": 191128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300097, "uuid": "ac4a9803-4b6f-47da-9b90-7c048f5da8d7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300097, "uuid": "c948a728-a348-44b8-bbd6-2b86f20d4650", "value": "NEW INQUIRY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd003eac-9a88-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646267261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267261, "uuid": "80f7625f-ed62-4fa9-8c20-23e7de5b5e17", "comment": "Malware payload (Heodo)", "value": "587ec81b8c7a3bab244606460ce6092c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267261, "uuid": "b373d66f-0354-427f-b93c-436d35c4ddc3", "comment": "Malware payload (Heodo)", "value": "1da304dade3eb8276c25aac78a8af85a9724b1217a7d2dcab30dcbce58e901e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267261, "uuid": "283e6fdc-dbbf-4a8c-92a9-9650a18a9a20", "comment": "Malware payload (Heodo)", "value": "f830ea968138c55d5b9f6b952e016e2b62296dac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267261, "uuid": "cfb9e4ab-b9fe-4a43-9323-9e5cdf0105c5", "comment": "Malware payload (Heodo)", "value": "215514aef1216e14f2d6c9abf31177531cfd07ff5467d4a7ec6ff506eb4f79e46dcdfe2801241be9858248f33ca881b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267261, "uuid": "a2e1eef6-375e-4af2-8a16-77b40cd8c9bf", "value": "T11CD41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267261, "uuid": "deb2cb2f-3785-4367-b351-f327cac8555f", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267261, "uuid": "acc2df3b-0e68-496f-adc9-91ebd219eb74", "value": "12288:ZxpNJJJ2NHPoczJOOtIhxf3foRXIa5EPwvA:Zx2gczJOFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646267261, "uuid": "79d0de6a-e864-4f8b-9dbe-a8819c33edb9", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646267261, "uuid": "b5117967-bb17-4ca7-9ef6-893786c970ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267261, "uuid": "356eda47-7420-4019-8293-4a6b7ad7d12a", "value": "587ec81b8c7a3bab244606460ce6092c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a40c7dc-9a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646268867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268867, "uuid": "7f1d1871-f584-4ece-b302-db1b37003ab8", "comment": "Malware payload (Heodo)", "value": "417c96c5ba2b5cbbb6ce0dec3a4bf980", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268867, "uuid": "e8ed02a3-75d6-41dd-9f98-cb742379f9cb", "comment": "Malware payload (Heodo)", "value": "1dd72bb8913711fcc541a33c808b2cf588e9373e8d64c453e92c933a83a9f786", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268867, "uuid": "277ed38f-8f18-4d6a-a0a8-85ea109c85b5", "comment": "Malware payload (Heodo)", "value": "bc9a0b1c23763c6aa32fdc876866d30bc620aa41", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268867, "uuid": "380713b0-f1f7-439c-8ad2-c731026e1d34", "comment": "Malware payload (Heodo)", "value": "3dd06c25a9740e82be2d44c15e06f8975ee7318231bd8ca192b2b01d3b84605c0dbc6d51d8d5ad3a5a59ff6601358e6e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268867, "uuid": "2f886246-b728-4b88-a82d-9ab44606a4bb", "value": "T194D41B017498F0B3E38918B04A858AFB724B5DB296117073F2ED378CA7725F15CE766A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268867, "uuid": "20c0f3df-f9a2-44fe-9ffc-efb8e0701eac", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268867, "uuid": "24f04c4d-dedd-47d1-9b9a-49c75e1c47b2", "value": "12288:pao0Se86lloPxHHVVIjqxEqRVoQmiIII999tLLLdAkkJoFLZZWbClgluPcRBATfz:AqxETMJ777u3OmONFqNJtN1v96TOAnX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646268867, "uuid": "6e59ff4a-58c2-4c35-9f46-d6517ae3ae0c", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646268867, "uuid": "409514a4-8d3f-40c9-b53c-3e17f06c0c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268867, "uuid": "4c8b610e-7e0a-4ec6-ab5a-c49ad90b214d", "value": "emotet_exe_e4_1dd72bb8913711fcc541a33c808b2cf588e9373e8d64c453e92c933a83a9f786_2022-03-03__005423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b9c5a4-9abc-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646289682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289682, "uuid": "89e12e73-2cf4-4bd6-9118-13c3b23426b9", "comment": "Malware payload (AveMariaRAT)", "value": "04241822f8bd8028712a24bfea7a2f8f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289682, "uuid": "4bd591e2-7926-4f07-987c-0f5012f3963b", "comment": "Malware payload (AveMariaRAT)", "value": "1e4a719dbf73767e3fc658adda053f9e355298200b4ee8ac83380505db4e1125", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289682, "uuid": "56011a32-5e58-4dbe-9ea4-724c1d2ec184", "comment": "Malware payload (AveMariaRAT)", "value": "695b43b1a1d84ae55f199676075d56fd97a37846", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289682, "uuid": "0ebd93b8-4286-45b8-9e2b-bf86969407bf", "comment": "Malware payload (AveMariaRAT)", "value": "3731c73488b6b162b8011ca29d4cd981a0e8e9bf75b2a1f6385a4a585ae8012b404df7e52a3d4c605bbd44f2661dcf79", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289682, "uuid": "2f7e659c-20bb-45da-be12-52793dcf3af3", "value": "T16EE41AB96772D535F966863E84E9A40C13A06C15EE439EE370C6B7BE6E332C49D32143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289682, "uuid": "61f11ce1-8ea8-4d31-97dc-defa439ce26e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289682, "uuid": "8dabf478-dbe4-4d94-93c3-e3680178fdd4", "value": "6144:/kqd8sVCD6lU5F4ONFH7daeUSsIsIv1mbcA00f/0gBtQyAhmqrmRfm:i66/4ONh7daFIsIv1ucA0xEY3mR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289682, "uuid": "3d48c9ab-2bc0-4dcb-8004-19193bedde3d", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289682, "uuid": "76486022-f334-4e45-978c-747645dd3276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289682, "uuid": "09571200-afd7-4e62-a321-8fee238082e3", "value": "NEW ORDER727733PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73019cb4-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646301067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301067, "uuid": "fb22cf93-616c-4de3-af9c-864e8b782abc", "comment": "Malware payload (RemcosRAT)", "value": "9178e2122908b95b87ff223a7f970d24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301067, "uuid": "a51fcb25-e661-4a31-bf27-9d2750861797", "comment": "Malware payload (RemcosRAT)", "value": "1fed413e1cf6bf9886f077ac4ebe4c86b566917bf3b0cd806805acbb89b27558", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301067, "uuid": "2022b484-0497-45a5-9191-f15e42d6bed5", "comment": "Malware payload (RemcosRAT)", "value": "b3eb44c1d129086791b7078a78f61f136015d063", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301067, "uuid": "be03184a-4b5b-4545-a16d-b5daedbb5b47", "comment": "Malware payload (RemcosRAT)", "value": "86bda6c36a8f04977a29bc7d65e1cc5d7638a05ff05af4e8f1af8d7ab552eb678fbbb05e9a163a932b05777e40c47399", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301067, "uuid": "dcb9e340-878a-4843-aaa9-f9841ba21738", "value": "T13B14E00092A0F82BD4623674DC3596F6AEB68D23C1758A430793FE5B7EFE2D049CE615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301067, "uuid": "03eff606-b646-4187-9a5f-24b41b704751", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301067, "uuid": "bf767b63-230b-4c82-9125-7862554f5aec", "value": "3072:rvbG7N2kDTHUpouY7lMbOG7mhaOyt8hoVybRmsK1IRMrsUZCoa2BPYRhPF:7bE/HUolM/mk38homR1KxRZCKBwRhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301067, "uuid": "6d169ec8-c021-469e-a78e-6023f22af47d", "value": 203408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301067, "uuid": "2ed81eaa-0cc8-4320-a6b2-53fa55b539be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301067, "uuid": "ddc6ffbb-e294-4c84-803a-78c08cf77bca", "value": "9178e2122908b95b87ff223a7f970d24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bd987e-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320990, "uuid": "f70da10c-731e-4ebe-90a4-c55a236c6508", "comment": "Malware payload (Heodo)", "value": "43f2f1f4b2c3486b1aa854309f190327", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320990, "uuid": "21734426-23b8-427f-9433-27f0ea60044b", "comment": "Malware payload (Heodo)", "value": "20233bb1ee8203b427c9b57336b2225031b51f770c5827f4d3db675a8a4e9b93", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320990, "uuid": "3b06d7e5-9ea9-4683-92ce-6af8b64ff21a", "comment": "Malware payload (Heodo)", "value": "f31b2e94ad66f04a690e5cb6ab79ab46737c315b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320990, "uuid": "63201006-f5e6-4e46-817a-891c4e35e414", "comment": "Malware payload (Heodo)", "value": "0f51a238b478e6f09eaeb687ea80c1e332bfe48763f1d3ae9b85abdf04f659fd03262829a6e67706cf7c2c8a177c7790", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320990, "uuid": "ba8bc4e8-1cb8-4741-ac6e-99156c2dcdc5", "value": "T10B23E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320990, "uuid": "45dff7b0-23b1-497b-851f-e2620b0a740d", "value": "768:qqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:5rVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320990, "uuid": "39d84485-605b-4c45-86de-f43c530541f3", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320990, "uuid": "3a463e31-3aab-4540-9a1f-fee1f25fd8ac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320990, "uuid": "d56385b8-cc35-4cf7-82e4-aa5f65391b0f", "value": "OMICS Publishing Group.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bb03e7-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646298361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298361, "uuid": "c2af5106-9ed0-4bea-898d-4cd94c76c8b4", "comment": "Malware payload (DCRat)", "value": "6129e20e5f39c1373d24713f07ecc05b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298361, "uuid": "2490ee23-34aa-421c-830d-e1e3de649b3f", "comment": "Malware payload (DCRat)", "value": "2032f4c705391c616308c070f4aa16aed376c18cdc1deb207e8c9048edb0cce8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298361, "uuid": "c0a35db4-16f4-4210-9372-9f0a22bdc17e", "comment": "Malware payload (DCRat)", "value": "9259419376b79657f872900c52b58d87d3a8647d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298361, "uuid": "9c4736dd-8fa8-4a8b-89fd-c40278ed3021", "comment": "Malware payload (DCRat)", "value": "1e4d5177c28d22bc4fe549a5053250298c92f4692e228839e2e82657d8dd52aa0454f351b26e7e8bc9ef6dea281ea9ef", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298361, "uuid": "36fe898a-e8c3-46e9-a7fe-3c45702092ba", "value": "T1E6D5336223E79BB7F087633582CD68E939FA219EAF1725D3A74C1C067A103D4D1BA507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298361, "uuid": "6669089b-c23e-4e42-8ad3-2973efffddaf", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298361, "uuid": "33eeccf6-a70f-4824-a541-3480b41861c1", "value": "49152:mxwRncZQc9yLWXTzHkmuPf/jFWZuNsB9TGXy/n2WjnSrvCSO56gGOoc2vbY:mxwRghDD2XjFZKV7STCSOXL2v8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298361, "uuid": "011adaae-1c92-4d06-9d5d-4cafb340b167", "value": 2757803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298361, "uuid": "6bbca5a9-818a-4303-874d-89c09480f710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298361, "uuid": "88a8ee14-7222-4d74-b072-0cc44c11832f", "value": "6129e20e5f39c1373d24713f07ecc05b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a81f48f-9b01-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646319146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319146, "uuid": "e3b7b086-cf20-4416-8d00-1301c42156eb", "comment": "Malware payload", "value": "30aa977b8b65a3c42d99aeee2918798b", "object_relation": "md5", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319146, "uuid": "1f2452c3-779d-42bb-9d33-b5d37fd53648", "comment": "Malware payload", "value": "207d2ad4916887df229fad7f1dd3d826da506c01debbe13d00832b20e42c8f6a", "object_relation": "sha256", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319146, "uuid": "b7b111d7-a4e9-40dc-aa69-c4f93f7189b2", "comment": "Malware payload", "value": "d2b80b2d6105444806172a8f059a2d0cbf4ff712", "object_relation": "sha1", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319146, "uuid": "8daee2f5-bf42-46de-b6b3-f9ddd3837e7b", "comment": "Malware payload", "value": "7e64516ba93978049b0b0a573373745cbc105ecc0b1aeaaa5d58c1702197de2a3da1e8a59949a9831497d56f7021ed8b", "object_relation": "sha3-384", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319146, "uuid": "d4e8e16a-15fb-4b0d-b8b7-985f3d99f682", "value": "T19A73AA10FF52EB15D4D9473EACA7CBAF99217EE84D26050BF0A8771E18BB990A550F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319146, "uuid": "a884d18e-807b-49d4-8d4a-b544ef4f3610", "value": "384:ceKMuZHcRHeL9doXMZngJ2bA1i38hOzYt60zAOwPjPxBhrNkxFyZtO:7HGCqYoDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646319146, "uuid": "c630f860-76b6-423a-9ae7-0944efb5c8ca", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646319146, "uuid": "9cd2913a-a3d6-47c6-a7f9-3b550f9fa474", "value": "application/vnd.ms-office", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319146, "uuid": "dd6da603-c4f4-42b4-8be9-ea33ef6cbb50", "value": "Purchase Inquiry_pdf.pub", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6c60b3-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298345, "uuid": "d5a6d7a8-1a9a-4f0d-818a-c04ba40b9fcb", "comment": "Malware payload (RedLineStealer)", "value": "69bed4d83b53a37d8c12992989dc72f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298345, "uuid": "d1e360de-00b4-4a8b-872a-3c33b34b18bb", "comment": "Malware payload (RedLineStealer)", "value": "20c001b516886d62564d7dfa31c64df249aa336d0f58984122edf2b3885c8271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298345, "uuid": "51ccae68-02f5-4dc8-9666-94c493d42fd1", "comment": "Malware payload (RedLineStealer)", "value": "81486f126f94bd7b8fec3e1732a3de31d4ff1133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298345, "uuid": "0d8b9f8f-4602-4e37-9d98-64e77189721d", "comment": "Malware payload (RedLineStealer)", "value": "065e72a38d646bbab9d275c8f0cfd07c90640de659f8d91b73f17f25e26d46fb30f5507a2f4369da521add4f3524dd1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298345, "uuid": "9a12777c-204f-451d-88c9-89d8435574f6", "value": "T16036335E30ADA804D5BF28B0E5CC6CD1ADECDBAEDCE848D95E564163228349C7E059FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298345, "uuid": "ce8535d1-9b40-47ff-a7b2-52e00ae7892a", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298345, "uuid": "10795709-35d2-4875-9592-6d0afc715c39", "value": "98304:vw2nxl4JGLgtv5SxHR82KxsuPy27Y9Xuuk+/618QjrIc:o2xl4J4gIHR82Kx37eeukW618sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298345, "uuid": "47535b21-f486-4965-94ed-222d7752bd9f", "value": 4997064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298345, "uuid": "41eda155-98c9-45a1-a6fc-b39032f2e333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298345, "uuid": "c6320b28-782b-4d7c-b4af-f3e2893bd3b1", "value": "69bed4d83b53a37d8c12992989dc72f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ec788e-9abc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646289394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289394, "uuid": "fd6764dd-ee83-498a-ae09-abce29f941ae", "comment": "Malware payload (Heodo)", "value": "910bdf41d5de2aa3d1d6c2fc647cd926", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289394, "uuid": "74043bd5-222e-44ca-8eef-8f28222e9eae", "comment": "Malware payload (Heodo)", "value": "21302809f39ee2451f2e136ed00b81181bb087cb2dd9d7f019bd5dd8e1072429", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289394, "uuid": "05a02ff0-7200-47a4-933a-1aa7a5d7c4f3", "comment": "Malware payload (Heodo)", "value": "7ef25da93915cd498c8330c0e748e6012a164ca4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289394, "uuid": "3265a8d9-7aea-4cf4-b5ff-f2913dc7fc4f", "comment": "Malware payload (Heodo)", "value": "fdb596abc5c62545c71f47d9ad1557fb8a83f104cddb67bf78d21e3a6f450b008a17ad9f6939446bbaed7b0b19426ae8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289394, "uuid": "3253a1be-0da4-4b16-9206-ace372e70566", "value": "T1F623E02AC5207828DB3A4C35820469D2721A7D05DDD5FB5A3145FB4C3B86BFB53AF88D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289394, "uuid": "05b36804-df3b-4527-a90a-97f7670af781", "value": "768:31m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:31HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289394, "uuid": "7f8bea99-78b4-4fed-b714-03c7f8af5352", "value": 47653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289394, "uuid": "eb5de4c9-7e50-4bc8-b93d-0617eca07ca3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289394, "uuid": "511a7c24-a687-4c5f-a34c-e0077f75e922", "value": "Rechnung 2022.02.03_1628.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78eeecca-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646296782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296782, "uuid": "564e29fd-7f85-4644-99e7-80925e86e5d1", "comment": "Malware payload (ArkeiStealer)", "value": "39de12c9f652763bec841050e3184fe7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296782, "uuid": "55ff6130-05fb-40b3-886b-6b7e5b5894e0", "comment": "Malware payload (ArkeiStealer)", "value": "216133bef9784f48c167ad33933eaa2a6776c59f5d24cd3add538c0fd28690aa", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296782, "uuid": "587b26c4-7633-49e8-acbc-45a2c8f1e9f8", "comment": "Malware payload (ArkeiStealer)", "value": "91a50b2c838a23d7ac86283e5bfbf43f2d46c779", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296782, "uuid": "7df1644b-f916-406e-ada7-762354e32dbf", "comment": "Malware payload (ArkeiStealer)", "value": "7eedf465eeaedbf46269f70140a5a5c344deb7221d0ad7acec748f0b689088b4ddff879abb24fd8d5f0f09d352179b62", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296782, "uuid": "b1cea25e-3e99-4435-85e0-c7eaeb8cf708", "value": "T17EE4F110BA90D035E6FB26F8487993A96A3EBEB15F2065CB62D137DA07352E4DC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296782, "uuid": "9790e76f-0bf2-46ef-867b-debe4376923c", "value": "c20aaf28a6597d3e2b7aaa9c8e55011a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296782, "uuid": "8e58eb8d-9c78-467c-b25e-ffae911dde18", "value": "12288:xr4LMWEfkIllHGZUd5ie7uG54Nv5PV15J+2XPuLkLcrIL1FqGqS:eLqcqHGZUieCs4NvdvrDfuLkwrIzqGqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296782, "uuid": "de2b5ea0-7618-4216-bb8f-320bc2cac466", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296782, "uuid": "c992e622-8c75-49af-bad6-d852c1f4371f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296782, "uuid": "63762067-e293-4725-a014-b1ec9b487460", "value": "39de12c9f652763bec841050e3184fe7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b08bb75-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646301054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301054, "uuid": "250eb377-aa9a-4aeb-bef9-428a8602799f", "comment": "Malware payload (Formbook)", "value": "1970bbf710c8db5b20ce28d568ebe361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301054, "uuid": "9f37ff8b-5309-46cd-99c4-1f45821c4391", "comment": "Malware payload (Formbook)", "value": "21791c7eba15ff44e84b44080fa6c85cf824afafd5d987ce18d445dc942c34a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301054, "uuid": "b1a25541-24f5-48d9-95d9-987cb22f0521", "comment": "Malware payload (Formbook)", "value": "baa917881d3271723bcc8b49de5837a48e8de40b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301054, "uuid": "c5f15276-4ef7-4b67-9f69-488b46fa1fbb", "comment": "Malware payload (Formbook)", "value": "87a7bc833d27b7740d7cd8f8ff2e0c49aa1588ee3661b4e9e33a409bc25b74ea0b1ff30610c62992ed0fef6a0b1d49cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301054, "uuid": "a994452f-6b6e-4251-b09a-fcbc7118a42f", "value": "T19985AD00A2B97616C1BE063DD0B7DC345767B6D7F77DB34A4438E6482BC228399322E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301054, "uuid": "a5929d31-86a9-4425-8083-4fa2431c69de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301054, "uuid": "e928ffd3-fb45-454f-9625-384e7129d254", "value": "24576:8ib2QhThnsT43pEjtOXEP8kSHhj0svPFixFTXLAA1rkafZPUvN95:NITmFUEkSBjtPo7NlfZPUvL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301054, "uuid": "90b6fff2-f7f1-407b-b1b8-4a895a11fc67", "value": 1845248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301054, "uuid": "a38ed35b-ade1-4482-a564-cf551987c869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301054, "uuid": "2a9fa67b-e7e8-42b4-98ed-18c14fb8b422", "value": "1970bbf710c8db5b20ce28d568ebe361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2f4ecf-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646294535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294535, "uuid": "1f71490e-292b-4d85-9912-907b9b6ddcb1", "comment": "Malware payload", "value": "a1008e75714b219fac80bf179a50a94d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294535, "uuid": "a5bf38d2-0375-4f2b-b145-5d1d0278aa6e", "comment": "Malware payload", "value": "21a3cf6fe2bd11d4efa324e7fc69504c7b0e08622c0041214e6dfa06fa22c41b", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294535, "uuid": "2e43f1db-0884-4640-ad45-634144142cd2", "comment": "Malware payload", "value": "4911a7296d4a39e2a8c523ff74ead6192051248b", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294535, "uuid": "12cb10d2-816f-4230-a08e-0de8c5db3149", "comment": "Malware payload", "value": "a0e52364c620d59061911d8a974e10346654e762b40bc8e2545de532487b72d5fbe5266963fdf57e97239f8ded2ddf93", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294535, "uuid": "0c7e5ae2-f069-4c5d-8a1c-cc5d258cf0fd", "value": "T1CC14029C27497BFAF86D6939F9F8A6C604719CED25503B8A084B7A6F0874C0F6D00677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294535, "uuid": "b37ea2cb-9fde-406f-9b62-0b2e8c2d57da", "value": "3072:g29esIsXXdT0WCr70xcgQWDK7+HTJeLy13KhLSdsB6a1n4pfHLxQo6CNER:He2pW4OWUXyxrdsog6fdmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294535, "uuid": "4d2ee24d-0aa8-477d-b53e-9fdfc8d61765", "value": 191224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294535, "uuid": "690dd5d3-9720-4bf3-a57f-0a3ee7a11a88", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294535, "uuid": "ef0ea5be-e076-4f18-b25e-000734921c4e", "value": "Scan00030322.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1c6f2c-9b1f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646332010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332010, "uuid": "997b1854-d60d-4abc-8240-41568561999d", "comment": "Malware payload (RedLineStealer)", "value": "1d3e0b736692cb1ccafe74c27e1a0c15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332010, "uuid": "aec86be5-1815-432c-80e5-8e6c725c542e", "comment": "Malware payload (RedLineStealer)", "value": "21b8d4abd97f566a604e26b415a59cbfea70a45dac5f704140c331d7784a134e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332010, "uuid": "e4120b75-f3b8-4794-9653-746d13fd7101", "comment": "Malware payload (RedLineStealer)", "value": "14bfaa9fd0bb6d94ff3207eeeffa0237f12b49c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332010, "uuid": "63ce1a99-8141-4ba7-9c7c-f888eb325333", "comment": "Malware payload (RedLineStealer)", "value": "63213e84d168f97dafe4b322431f48cf0c2d4624db3531ffcc3b39671efbad8181c782d3a260de43600db42aa66958c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332010, "uuid": "bcdcd074-8723-49b5-9e54-ae0a70f33445", "value": "T156F3C78736C0C49CDE7917F652A60041B3B5BCFBDA28A29F2BCD62661FE21D1583171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332010, "uuid": "80f5f37d-d97c-4133-b2ba-f2b24a6accb8", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332010, "uuid": "39c1c864-cc0d-476e-b70b-7267d0fab179", "value": "1536:PxmqWRQtRpKM5/gR94hUrClTe1z/s5gQSHf0gsEltGbVx4LYM:ZBtaM5EWCrATe1zU50Hi4cM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646332010, "uuid": "d8317eb7-3160-47ba-bd2d-23e4bc47ddb0", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646332010, "uuid": "e389d885-e432-4c93-92f9-cb6a6ad0e510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332010, "uuid": "cfa0e7a4-2439-4cbb-8bd4-165173d08970", "value": "21B8D4ABD97F566A604E26B415A59CBFEA70A45DAC5F7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a966ab9-9b38-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646342795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342795, "uuid": "a8e96289-2048-465c-bed8-8b0cabccd784", "comment": "Malware payload (AgentTesla)", "value": "6c183dd46e98acb290b7302192625aa2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342795, "uuid": "22dfdd13-6e75-4352-bdb3-837329176193", "comment": "Malware payload (AgentTesla)", "value": "21bf6ae86de572a5dc66569f428de4fed7e043150af21acad84aa7dcad7543db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342795, "uuid": "83363e71-b7fb-4887-ab28-c8f5b0bc819d", "comment": "Malware payload (AgentTesla)", "value": "cd4bd35671851a5c254f74d3f82ea67b5c7d0470", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342795, "uuid": "3712f946-348e-4f5a-9d84-c324467a5b67", "comment": "Malware payload (AgentTesla)", "value": "e06daa660fa24f4331e5c70f78c2a2dc3b994461c7283d7c8a16f039deedb6b561c5e99a715e0ebc0f2df790adbb10ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342795, "uuid": "f63834e2-9226-400a-ba28-903a67babf00", "value": "T15B15D00438E68034E97A87B0CAC4E7F0DB6DF625E189B0F664006E157A567BEC945EFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342795, "uuid": "6bd0c25b-66b7-45fe-ab70-523979682912", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342795, "uuid": "017dad95-45d3-4aa6-9b62-42fcb930a7d0", "value": "24576:so9a2JrnhievMtCiUMNu2DnXxHzsPzvE:sIJrIevMQXMNtXxHUvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646342795, "uuid": "0926a791-3c21-4928-8846-d620b172e9e0", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646342795, "uuid": "9f03ce64-12fc-494f-9065-5c1478cbf572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342795, "uuid": "8cb8d2c3-ff81-422a-9b00-e363314725f5", "value": "2P9ofTcA1L4uYS3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e23fae3-9b4a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646350425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646350425, "uuid": "af801c36-87b3-4cc5-9009-ad83d7d353cc", "comment": "Malware payload (AgentTesla)", "value": "8e1a6517c4287758e5e2b7d6c7f73f3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646350425, "uuid": "0ac10db2-b852-47b2-b2d5-c49c15e6a07c", "comment": "Malware payload (AgentTesla)", "value": "21c837b50be051641e8b0b2b0d42b03e42a505cdf7d6fd9c21eca1420f792018", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646350425, "uuid": "07622a8f-dccd-4df3-99a2-333f6ae6f9f2", "comment": "Malware payload (AgentTesla)", "value": "04133ad1e593f6b8db4937853b71fa84ed3952cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646350425, "uuid": "a9a536bd-2455-4839-aec6-bced05a70080", "comment": "Malware payload (AgentTesla)", "value": "6d3f0a227ff2748b5fad5005f476122ced3eeb4d0aaeed2674b1eb2fd582621be06b46254b44151303b7f973a4bc4c43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646350425, "uuid": "efbb090e-d086-49fc-8b25-c7601622cd73", "value": "T1550512163AC8E666C7CC18B4EDCC401806328E5E2751F38B69B9FE6633C7BE7C852559", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646350425, "uuid": "213a8913-deb2-4ea5-a284-219cc05cd504", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646350425, "uuid": "3081aec0-2e8e-4eaf-8da0-d9524738e360", "value": "24576:RtAXbRM8J58uJ0zCgLfQrCrrQxOMfnOGntS:RtALRnJO3CgLYC/QxOMzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646350425, "uuid": "e557e26f-656b-4c36-a624-dc51ee8ac3ae", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646350425, "uuid": "3ef13a11-9ef5-4e11-9ae3-7f695587b255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646350425, "uuid": "fba873fc-96e1-416c-975d-37c3b8693f7c", "value": "Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cbdf97-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "1dc2cd07-9054-4152-8f80-a49559cf5d4a", "comment": "Malware payload (Heodo)", "value": "eed1465f4f88e6cbf4cb230880b12928", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "585bb8e0-ff33-4982-a3d6-270d42eb264e", "comment": "Malware payload (Heodo)", "value": "21dc8ae2546e09358615b3650ceceeb5f446bd952423dc4c47d8d21ec50c9dcf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "da5418f9-c5f9-4878-941b-5078f93a239e", "comment": "Malware payload (Heodo)", "value": "4b307832f981b05fbeb98afac74f6e133795e257", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "7ef39839-3bf0-4b8b-a396-a2e83f8738ba", "comment": "Malware payload (Heodo)", "value": "2d4f8302dfaa2e08e2e4f6d2482050cf01c8b2bdcb66cbd41b159aefce91cc68900ea55b249dbdfd7225cca43733ddb9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "3c744aec-b7bd-4a10-876a-2d46867b1418", "value": "T1C2D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "650b06db-134f-435d-992b-e474595b548c", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "7ed38fdd-72a1-4df6-9c4d-edfdd6d6a05b", "value": "12288:ZxpNJJJ2NHPoczJVOtIhxf3foRXIa5EPwvA:Zx2gczJVFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265795, "uuid": "b423071d-e685-4e53-aba3-4598ea736b65", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265795, "uuid": "c599fc60-1f7a-43f9-a1dc-f8424f284f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "11fc1cc4-9766-44ee-ae73-4395e69238a3", "value": "emotet_exe_e5_21dc8ae2546e09358615b3650ceceeb5f446bd952423dc4c47d8d21ec50c9dcf_2022-03-03__000305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb4191d-9b48-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349808, "uuid": "e0794ecd-4cf4-4832-8bfd-27b916700381", "comment": "Malware payload (Heodo)", "value": "7842663a110449786e483384adc49632", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349808, "uuid": "29c98d79-b27a-4f7a-9654-c12753df3623", "comment": "Malware payload (Heodo)", "value": "21fb806a3f961e4438bd30d08d4f4f787d3022a9d1d24e7d2ab29553652ca84e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349808, "uuid": "6a3f19aa-c34d-4f59-8bef-7d5b0484f0e3", "comment": "Malware payload (Heodo)", "value": "680b150cb6ed3f2615bed4fa6ba7b6db9a760c58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349808, "uuid": "1c0d1794-9fa1-4437-8e68-bb786d79d4c3", "comment": "Malware payload (Heodo)", "value": "9d79cd67fc7f764f72e8f6c778f8e7600b4f3de341cdcef08033d0e8b81787fd139e4fb34e106882f55e57f2507adeff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349808, "uuid": "7a01244d-7da7-4b80-8c61-8ada38cab750", "value": "T179D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349808, "uuid": "075e81e6-4f75-4dc0-8893-9045c440a995", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349808, "uuid": "fac7adfa-a02c-49f4-8c1f-b164a8176c19", "value": "12288:J1U8sNY8/z0rYebzwdzCoGEAbcVBLku8w:oq6z0rYcMdzVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349808, "uuid": "c9c054a3-565d-40bf-87fd-0631581cae02", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349808, "uuid": "30f14bcf-3ceb-466b-937b-b719247ce215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349808, "uuid": "7cc4af51-01cd-4bf5-898a-0c1fb86d6fd4", "value": "7842663a110449786e483384adc49632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42419a2-9ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646293956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293956, "uuid": "4703e513-e7e3-4b15-a912-525e6f9a0661", "comment": "Malware payload (SnakeKeylogger)", "value": "97e984e979196779f7f791af543f833d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293956, "uuid": "1585017f-dcb4-4730-8320-22c84ca849f3", "comment": "Malware payload (SnakeKeylogger)", "value": "2242ea210aaa705fc4c800ac734264aa15f0919087ffc7e275be4f9222ae0d0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293956, "uuid": "60bfe905-14fa-4550-9fda-6d4be8f946e4", "comment": "Malware payload (SnakeKeylogger)", "value": "835d0d75a45a4d6d5b5b825db50886cbac8af1d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293956, "uuid": "b8e12329-7092-41f1-bfe3-5ddd703074a9", "comment": "Malware payload (SnakeKeylogger)", "value": "d6d332cd362d1aa7ae36aefc90ac281257dc533c67d969a9bf1563971f350cf5cc3c4ab4cd53a88de81152c02d1fdc0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293956, "uuid": "c81fd75b-39d3-4174-ae91-0653c7f430b6", "value": "T1FF5209A5ABA8D6F5C9B90ABA1C735B011F29F197D4169E1F35C9730B2C2370604B2B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293956, "uuid": "2018fbe7-de21-430a-9e39-a31ef0a6e6d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293956, "uuid": "8bce034e-086d-48f3-93fb-47e1d49a8053", "value": "384:2fUktbJnzUeZYqpiiay9ycyrsR2vZMtAS:2fUQby8YcycyrsR2vZMtAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646293956, "uuid": "ef4cf4f3-4823-4093-877d-0c11c643126d", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646293956, "uuid": "aa54a089-59ba-4457-84ee-e3ce712c4097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293956, "uuid": "723ed023-c6e1-414e-afd9-90321a0324d4", "value": "445678909876242553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f3481f-9aeb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646309580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309580, "uuid": "65230979-06b2-48c3-aebb-ccfcf82596a8", "comment": "Malware payload (RedLineStealer)", "value": "22c04ec49de717fd81bcc3ebbaec1e56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309580, "uuid": "6d38be0e-9275-41c0-a844-1c26db19ffe4", "comment": "Malware payload (RedLineStealer)", "value": "22b8162447789a7a0fd4440e491074cb8b02d58e319e1b0d398b26927855fc2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309580, "uuid": "c7cacfe5-87a7-46ef-ad3f-24c6ec60d42d", "comment": "Malware payload (RedLineStealer)", "value": "f7d90da3db8b1dbc2c68bb4f38e9fc5365f4cc88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309580, "uuid": "236efb4b-de87-4285-9a06-8c9060c8224c", "comment": "Malware payload (RedLineStealer)", "value": "2dd44b249c6c8bea9f56cf0e939e25615ad2443a2b544ecd40a4c1367182feaaa1833dabb07071f01b3b0e4688445457", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309580, "uuid": "b5862633-720c-4772-b58f-fbbdce81ae56", "value": "T141C423EB5784340CCA875BB02AEEAE578BA0B3747DC1D0F3B62C869767454D296240FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309580, "uuid": "edc3a66a-d140-4aa6-aed1-08783f501284", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309580, "uuid": "a47a6cde-1d7c-4b9f-94e7-677cf34fdf35", "value": "12288:MXf5wzzOYpmwRyQS03ULaHNqrxlKIQNoKEqolY3NVzrEei9:MXf51YkKykEaHNYK3d7oy3NVzLi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646309580, "uuid": "8817df08-ae70-4cb9-a116-8b7617396375", "value": 562480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646309580, "uuid": "26ac8cc2-e7c2-4f24-a125-f66e4c72c7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309580, "uuid": "ad3db033-4f24-42ab-adf5-7824ae9dba32", "value": "22c04ec49de717fd81bcc3ebbaec1e56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33624c85-9abd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646289794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289794, "uuid": "033bde05-9cf3-4fc6-88ae-08ac3c14a6a9", "comment": "Malware payload (Formbook)", "value": "eb8160f18895de95aacbe020a90af6f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289794, "uuid": "a9e56262-10d3-421a-88ca-b7fc2cdca32a", "comment": "Malware payload (Formbook)", "value": "231d52105802198387ad5225ed435d6360e41d82aac59236da672a4a4b1559b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289794, "uuid": "ac14e1e3-0909-4376-a7d3-44c084f343af", "comment": "Malware payload (Formbook)", "value": "f47e23ac2d64d615e36f785d52b5fe741338d845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289794, "uuid": "84feb47c-2b8f-4518-8624-4a0047dac794", "comment": "Malware payload (Formbook)", "value": "2db1f47e48e4d0676d0b7127d6d790c4b76d7715c75dbdf5d39d337e26917bff2b9c452849d0cb24b5ae221c9e81385c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289794, "uuid": "6bfb24a3-9cde-48cc-9c61-fb23464866a9", "value": "T11DF39E32D642C031E2A242F5F2791B7B883E0D353255A0AAE3E51AE56FE45E5F42D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289794, "uuid": "0ac12712-f39a-498c-9984-40122041e03a", "value": "3072:1JXO2eGfXV+47MYhq0k6E+Oi9DTtFYFDFPKDekrSQZVS6w:f/AKMYs9M1t2FBPdISQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289794, "uuid": "969e090c-50a4-4281-969f-3e7de7478dcc", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289794, "uuid": "025e82aa-3af6-45f8-a35b-6cebc34942ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289794, "uuid": "c444abce-3f84-451c-a49c-4a6affa82049", "value": "VN 030122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5374fd74-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "47f657a9-64a6-43c0-8921-09cbb8673bfa", "comment": "Malware payload (Heodo)", "value": "562f9c93a91a2b55b9723831d28559e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "07447e48-f079-4c0b-aaa9-69d459eb84aa", "comment": "Malware payload (Heodo)", "value": "2338b57c8c5b66c7b5a5311caac0d18491fe2ba996fd4fcccec3614e0c3bd683", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "a2ae513c-9583-45f2-8ac0-df95f0ff4564", "comment": "Malware payload (Heodo)", "value": "5727c07e6877978702e06567887675759790c1e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "7ffd8897-4b29-4be7-935f-c53250595840", "comment": "Malware payload (Heodo)", "value": "d4ce9cece99d4be8a14b8c8ced0cc3f57b5b8e8000df075b5d9334c6ae34da36dbd561cd1d948b4cae0b1e13035d32ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "bdd54304-10a8-475e-8ad3-405881fac895", "value": "T132D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "82f9157a-e3df-47e8-9ce1-737cfbb0ca00", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "ddf32d14-f4de-4466-9089-a856bcae4df1", "value": "12288:ZxpNJJJ2NHPoczJrOtIhxf3foRXIa5EPwvA:Zx2gczJrFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "535b9395-5968-49db-95d8-401a2f888be9", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "2d72aa0d-e96c-4641-a1e1-ba945a234c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "be7b2510-b6f5-4a2c-bec0-bf51fa2f3b8e", "value": "emotet_exe_e5_2338b57c8c5b66c7b5a5311caac0d18491fe2ba996fd4fcccec3614e0c3bd683_2022-03-03__000305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bf64f9-9afa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646316106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316106, "uuid": "ae1b368c-ebe1-4936-85a3-669b5dc640eb", "comment": "Malware payload", "value": "d4787a668588fae62f5be7f49e5b6c56", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316106, "uuid": "59115b60-5c00-4e06-86a9-866e0069ae28", "comment": "Malware payload", "value": "23b00b0c767009a815a518cc1f9528419b3d0a71687d57e454dc85b1d946c893", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316106, "uuid": "9408f164-94ae-48e7-920a-b3320fe6093f", "comment": "Malware payload", "value": "96dd6d67d303864f13d3797e059c93b2e69b2bf9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316106, "uuid": "09645053-01b5-424e-8ba5-9913a36d5259", "comment": "Malware payload", "value": "7eba6fb23a93b9f6edd7824059684a3a0128f006378864a90772fb219eae7e33d2d1aa1f7959ac379aa0886e84ca7c8c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316106, "uuid": "946c287e-8133-454c-a6a9-291c92537ff0", "value": "T17D31ABBC2BE65DC6D488A7F21CE96B3E6F686465138F27CBC1830D1A1D07F6253A9443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316106, "uuid": "ec76ce25-b4cb-4398-a1dc-5969eb862c07", "value": "48:gKKKKKFbbbbb7dbbbbbbbBKKKKKKKKKKoKKKKKKKKKKKK:gKKKKKFbbbbb7dbbbbbbbBKKKKKKKKKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646316106, "uuid": "aca78a90-925a-483d-9a80-b39243cd7c90", "value": 1744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646316106, "uuid": "e7f2283c-ef1f-46ee-9ccb-7c984d82a5df", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316106, "uuid": "5d3d1213-8b50-4399-85b9-f862d39e788c", "value": "23b00b0c767009a815a518cc1f9528419b3d0a71687d57e454dc85b1d946c893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e910c6ea-9a86-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646266476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266476, "uuid": "e6d8f8a2-acc6-4b44-b5d4-9199f3857d24", "comment": "Malware payload (Heodo)", "value": "7f6fba7e99b4832fd051e0df5b09fe27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266476, "uuid": "a3fb1f9d-a30a-4e94-8281-f3cc8fcfee96", "comment": "Malware payload (Heodo)", "value": "23ec004f310660a5a442140921bdb8882def76922d239772aa69dbc89f0cabc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266476, "uuid": "4651021d-9902-429f-93ce-809826030656", "comment": "Malware payload (Heodo)", "value": "8b885fbbecdbd61fecfdb3d14be927e1a8fc1d9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266476, "uuid": "db2be7cb-3e76-406c-8662-b2e166c255e1", "comment": "Malware payload (Heodo)", "value": "76b2f56898b2039d40ee1b00a96538845e5c1b46a7f0e293e06689387c8cdabe10534b2338392238a6f3d59fbb5c0d93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266476, "uuid": "b0b45bd7-bf99-42a4-b400-750ab2435750", "value": "T16BD41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266476, "uuid": "08565826-60a9-47be-8f9b-701528978fea", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266476, "uuid": "efe2c4ba-e1bc-4e3f-ac1f-658f145e9d67", "value": "12288:ZxpNJJJ2NHPoczJmOtIhxf3foRXIa5EPwvA:Zx2gczJmFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646266476, "uuid": "e6562daa-c823-4a95-93c2-130990c29289", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646266476, "uuid": "9f93b932-29b3-470d-bd19-6fab7a68523a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266476, "uuid": "374d1c58-d4d8-43c7-90b7-8183d2437b11", "value": "7f6fba7e99b4832fd051e0df5b09fe27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34893c0-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320986, "uuid": "5e4a8b7b-c066-4a44-9521-ce1d49762c5e", "comment": "Malware payload (Heodo)", "value": "18d5939ae8ee8e18fb405cf46b76df07", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320986, "uuid": "f6b3c844-58e1-4e1d-a2eb-0a72ec17d3e2", "comment": "Malware payload (Heodo)", "value": "2405af70a68124d948266fc1251303d0ae4196eefe7a3571f83b5f33e70c7eb4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320986, "uuid": "d3e5550b-6f1b-4dea-80ed-0aa0eea3fc90", "comment": "Malware payload (Heodo)", "value": "1ddc44d3dc5a4b8f1b6275846697c7c7de4c2ffc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320986, "uuid": "71dff450-9b4f-46d2-b366-ce600ea69318", "comment": "Malware payload (Heodo)", "value": "23bac075bbc6eb4b01643efc21d72cbab6447b6218f1b209af6da4f7b42593cb0a2e43463075c7c2e6db3d8ebecfb45c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320986, "uuid": "7f2a2c1f-65dd-490a-a60f-d28c7299b9e2", "value": "T19D23E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320986, "uuid": "a821e49f-6063-4b4f-846a-478b58f7c67e", "value": "768:6/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:6/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320986, "uuid": "d9771e93-861f-4400-834c-4238483df284", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320986, "uuid": "ac53343d-d7ba-462d-9a1d-4e26891e35d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320986, "uuid": "f5a5ef77-9053-4413-bc1c-80a0efbd1770", "value": "Omics Journal_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4475636b-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298842, "uuid": "d7022de1-1a89-4234-b8b9-6112edb3a16c", "comment": "Malware payload (Heodo)", "value": "ff4da4f8253d5c435726fd5fadfd4b50", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298842, "uuid": "69bd7066-1ef7-499f-b513-9aac86339067", "comment": "Malware payload (Heodo)", "value": "241ac3c009aa7ca0f311b7b0062dc9e27b0b823f4fa67144de434371b2bb5e4e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298842, "uuid": "00ff921e-bd2c-4140-ac4a-9b0688769ea2", "comment": "Malware payload (Heodo)", "value": "0ac1bed318acdf330c82bf10d8ca0bef4540c8e8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298842, "uuid": "483a7c83-bd7f-4361-be87-4c019e09230e", "comment": "Malware payload (Heodo)", "value": "f03169d094012da20da2fb23a4e4d1986e5596792e9646de876876294ffb259027807f9734ed6a89ecdbc34bd544b4db", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298842, "uuid": "f4b9c8ff-e323-4741-966e-b838866876b9", "value": "T1E323D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298842, "uuid": "9c0b32ef-73fe-4645-9862-8f5ac04960a5", "value": "768:eeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:VoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298842, "uuid": "8d5011d3-4b07-4cad-875f-0a1041ee78ac", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298842, "uuid": "6cd4e866-64df-4772-bca1-01242f206e7f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298842, "uuid": "7aa99b1f-30f2-45ca-9956-887c53e46b68", "value": "4885919353808986.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c86bef-9b4b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646351023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646351023, "uuid": "671a3e07-50b5-489f-a5b6-e71388f41547", "comment": "Malware payload", "value": "74b5b6353ab650bfe4d0f11695f44c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646351023, "uuid": "80e65f2f-6aef-4543-8ead-67366e3cdf98", "comment": "Malware payload", "value": "24691289dd059bdd5da4ed754101d3348b10d70845bd89b9a5caa3a7cd6f2bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646351023, "uuid": "988fb31d-aa34-43e5-9036-df6a632debd8", "comment": "Malware payload", "value": "c77be5f75dc5262d48a25e456fdd9b2e93b27e5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646351023, "uuid": "95cca4a0-ae0e-49f0-9323-1c3a8edbafa3", "comment": "Malware payload", "value": "3016a0cada8e66a914e044515fab042392ff68b599f93f8911fa73b2c6c6d97fbac1faad8c349e60148a126cac5755a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646351023, "uuid": "ef0a825e-a378-4ca4-a814-7dd4fde2bda3", "value": "T1D2A4D056A440C69FDC771AF1F42FDC1817537CEFA6A0A70D269A79267AB7243002B70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646351023, "uuid": "a8253dca-e98e-42cc-8170-ff79d50e6c27", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646351023, "uuid": "d72b836f-dd0b-4403-8953-87840868685c", "value": "12288:NjOLiYk8xOVhH3Ke/W+rmkXLramQfpIjIOLctVtceffhTNZmW:NjDYLkVxKUWyf/g+jIOLqV+wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646351023, "uuid": "66de65d1-7bef-4e66-a046-e1e38fdbf2a0", "value": 489498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646351023, "uuid": "62705445-a9ef-40d2-9804-51cb3839c347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646351023, "uuid": "b8e5fd14-2d59-4357-8197-a44852874f2b", "value": "QUOTATION-3.03.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6ccb34-9a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646268868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268868, "uuid": "6b726c83-6da4-48f3-a578-c2a6634b957e", "comment": "Malware payload (Heodo)", "value": "7c25c8fdcfdf1b5e990d269236862a67", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268868, "uuid": "ac37741e-fd9a-4e53-8bc1-60b5ce6a9722", "comment": "Malware payload (Heodo)", "value": "2470127c2d0122631757989566334349c0426258002fbf86e5f6c6db81d7f58f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268868, "uuid": "bb0b9217-4cd8-465a-9370-f2b1cd4bae89", "comment": "Malware payload (Heodo)", "value": "4dafc4791a33f48a74fd77d036fd295da242b812", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268868, "uuid": "b6604a2a-6bc3-4aac-8bae-cd37ad652dce", "comment": "Malware payload (Heodo)", "value": "25855bd9e0bd66599f2fb26afd616e50842c671f060f382c8613fa5c6bba43e92e34be8ffcae4abe82c865ef1f7d6337", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268868, "uuid": "c4f92b0a-b6bf-4405-ab1c-e49b994c939f", "value": "T185D41B017498F0B3E38918B04A858AFB724B5DB296117073F2ED378CA7725F15CE766A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268868, "uuid": "fdc522e4-69fd-45cf-a5a3-02d080484230", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268868, "uuid": "50ce5fe7-2539-4ab4-8fb9-df97ecad55ac", "value": "12288:pao0Se86lloPxHHVVIjqxEqRVoQmiIII999tLLLdAkkJoFLZZWbClgluPcRBATfC:AqxETMJ777u3OmONFqNJtN1v96TOAn42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646268868, "uuid": "106bd7d2-2381-47b0-8f05-a552370ebb31", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646268868, "uuid": "b2b9052a-45c0-4105-8fc3-33200da55b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268868, "uuid": "969b6794-d05d-4345-b802-09711e114589", "value": "emotet_exe_e4_2470127c2d0122631757989566334349c0426258002fbf86e5f6c6db81d7f58f_2022-03-03__005423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f58c851-9acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295854, "uuid": "e491fd58-4263-4dc1-b96e-2b405a16fd95", "comment": "Malware payload (Heodo)", "value": "bda45670bbf5dde438c66131ba09cd67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295854, "uuid": "d38cfda7-1848-492c-8c8c-93d3fd959b2b", "comment": "Malware payload (Heodo)", "value": "24bd34e933a51396ce5160a879c6ec6a5d824ae2fffa8a2f861e3154f7943c3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295854, "uuid": "4e3a9b7c-444d-4bd6-9be2-2a5a550d914a", "comment": "Malware payload (Heodo)", "value": "3da6d2dd103b261e62458d256dbf36606548c73d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295854, "uuid": "af474cc2-6d56-4b15-9c62-094ee6799ef2", "comment": "Malware payload (Heodo)", "value": "b5de8ea62832adc0d76c236d38cb8942c51da982dcfbd35716d3f40c0b907f7e032e2cc7a4c5a2eff16de10e51a15edd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295854, "uuid": "54edc601-eeb4-491e-951c-e4fb28f5f6ed", "value": "T111D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295854, "uuid": "0dca84dc-9021-4b0b-a9c2-248f4b911fc6", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295854, "uuid": "60a71dfb-9be3-408a-bfe6-95be11264707", "value": "12288:ZxpNJJJ2NHPoczJPOtIhxf3foRXIa5EPwvA:Zx2gczJPFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295854, "uuid": "7253ab32-e5e0-4335-bb60-a22d8c6d5b47", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295854, "uuid": "736bc7b3-418d-4d34-91f1-f12c9369584a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295854, "uuid": "3a4d4a41-4cfa-4c1d-808f-d5367b746168", "value": "bda45670bbf5dde438c66131ba09cd67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32b9167-9b02-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646319617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319617, "uuid": "a595a1c9-3c9d-4faf-997b-ad664da7624e", "comment": "Malware payload (AgentTesla)", "value": "e2d82fa0a58c6390557022e9e5f428e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319617, "uuid": "5611decd-54dd-4ce3-9848-f65d9143179b", "comment": "Malware payload (AgentTesla)", "value": "24f6a08fe6568bcc5f17bfb2db429da0d1335238ccdcca666248bd7b0d64f40a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319617, "uuid": "85600017-22d2-4a16-86db-7ce258c61ea7", "comment": "Malware payload (AgentTesla)", "value": "9c6318f0575eceaf9dccf308be9107ec09cced75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319617, "uuid": "514c20b4-e0b7-4450-8d56-b701903f9776", "comment": "Malware payload (AgentTesla)", "value": "8a7bdfea2319177b8a9d0a5371eb92da5b836d9de5e320a63e6cb601ec2c748933d9b733bc14047977a0bd454611629a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319617, "uuid": "421afadc-22b7-4936-848c-8e570db0a94c", "value": "T19154CB33D4F7962BF97A89F9B1C581297E626F24C522E3116242F32A27F4CD05BD6B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319617, "uuid": "6a5cbe8b-b0a3-4c4c-a192-06a503699715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319617, "uuid": "4f609604-c015-4681-8cca-0df09e9bcec3", "value": "192:MnVlTXydzmKy2kjpMQLKdocCo+I5hwl/9wm9sGmmMwmmIwmwm/IRN4q84W8ERAa/:MbLy1ByBeQWDpSUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646319617, "uuid": "f0b41b02-f4e5-4abb-9507-e07810c5f330", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646319617, "uuid": "c919dc50-d77d-4cec-9125-268fff58e1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319617, "uuid": "62b48d59-019c-4bac-8347-60b1f192eaf5", "value": "NYI-Purchase Order P.O. No.4036041334.z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb86868-9ad3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646299289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299289, "uuid": "57574b01-9ff3-4e17-a514-eaeb92b37f3c", "comment": "Malware payload (RedLineStealer)", "value": "75838b7cbfebb34257f557f003d3f86f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299289, "uuid": "4825d858-5144-47d4-84e8-30ba23bee76d", "comment": "Malware payload (RedLineStealer)", "value": "25b3945211ad368695f5b4d2c42ccaab83f3b42717f11b06b5630d1e39fed4b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299289, "uuid": "576774d5-39ca-45e8-a7f2-22be79410239", "comment": "Malware payload (RedLineStealer)", "value": "acdfa74ac1ef7e0f928e6ddb6ec6f96d5d9d89d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299289, "uuid": "1d1b3b5d-ae45-4662-ad5a-ccf73bf91067", "comment": "Malware payload (RedLineStealer)", "value": "7fc8349614eb3778e31495a0fbf80662126e65d447dc0aec3df842d9bd66de7e02d4bf2d8110408371396941ea89a8e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299289, "uuid": "61c0c24a-3d0a-4df1-b361-b5c0005445d5", "value": "T1AD2633FA92C1F66DC585C27EDF267CD881CC26CD59E99CFA172432ED36410DE82C84A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299289, "uuid": "96ac8b90-d4e1-4ddd-8bd3-4eacbd0ef68f", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299289, "uuid": "2853fd3b-ca95-48e8-8d2a-da726f9cd2c0", "value": "98304:hPaMxWeU1hfkW7HrSViszJ85yI+hjzqQv6/4TD90S/1/lSv+aW2j8DKlshN:hiIZUHfkgrxst6d+h/v6WF++QjcCsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646299289, "uuid": "779036ef-3501-446d-934e-ddf8f4ecc389", "value": 4860056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646299289, "uuid": "20f0cbcd-6dab-437c-b560-24c40665b943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299289, "uuid": "5ed806e7-8f68-42eb-bf2d-84999cc44872", "value": "75838b7cbfebb34257f557f003d3f86f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276c2c05-9abc-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646289344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289344, "uuid": "da86e040-5f0b-4645-a2b6-e2db24f48187", "comment": "Malware payload (RemcosRAT)", "value": "3adaf79a4ce36246306dd8eb702aec2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289344, "uuid": "6fe4013c-bd10-4172-a081-099755c8897c", "comment": "Malware payload (RemcosRAT)", "value": "25be6685bc4456b6bbc605d6c22ef057a49b511e61dde14a51fb120bd259c42a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289344, "uuid": "08c3016a-0c62-47a2-b889-de4779a782c0", "comment": "Malware payload (RemcosRAT)", "value": "015aa868d599b5f2f10e4a90447992b13022dd6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289344, "uuid": "33083bcd-0273-4171-8465-ff599eff62f2", "comment": "Malware payload (RemcosRAT)", "value": "2cd266e5214f1146ac9be29b7fc3437ac828ab73fa6d4e419ed8ffbd2ef0d2c53c18b92802dba13b63eb953d6ae67408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289344, "uuid": "262acbc9-b22f-4d70-b1d6-5e91a03268cb", "value": "T1AE35D00439E65038FD368BF1CEC0EBF1DB6EF221E98931B554000E159A56BBC8959EBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289344, "uuid": "8da9b7c9-f97e-4bb5-84af-98eafa76ff0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289344, "uuid": "6ca08394-a09b-4098-a4fe-276256b3c987", "value": "24576:xBitLcAM1widBNFyV04TH9GJunAW+KCyFQ1t/84tHf:xBALCNU24TVAW4yFQbXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289344, "uuid": "7b40d232-079b-4ce2-9d2c-c731d1d31c50", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289344, "uuid": "a345f1ac-1604-4209-8bd2-4cfcc45c2677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289344, "uuid": "94ca30ee-3aea-4645-a27b-bb53a8b76baf", "value": "DKM5890-320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38121c66-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646297962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297962, "uuid": "326d336b-27a3-4412-9db7-46ef0f07f17b", "comment": "Malware payload (ArkeiStealer)", "value": "20fecf8a01795083c8520caa8d4c8d6e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297962, "uuid": "2a47c9e6-6c5f-446c-bf10-2622149506da", "comment": "Malware payload (ArkeiStealer)", "value": "261c34f31739e88e66aef4689ba519ef181ad4da4741ada7951f4e278020083c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297962, "uuid": "667f95bb-805f-48af-9402-d9a3a932a167", "comment": "Malware payload (ArkeiStealer)", "value": "031c7a63fd8531de180909d29d0b8f12fcf25169", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297962, "uuid": "daf0de17-8136-46b5-95ab-d40fa75346ee", "comment": "Malware payload (ArkeiStealer)", "value": "58276fd3e83ae7e06d2ec8bed6d1cebe8bdc25e5f57077b60b8093bd15fcbc07ef7d639ca065fdbffc5d4c5f693cbbf6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297962, "uuid": "88132df0-6e77-467d-a06f-2c9ed1b656e5", "value": "T191D3CE1B9941C4ADF54D2030BA261176CF6B7E51C3F879AFD2D8EA3167CA327258930E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297962, "uuid": "ccdfa5ef-a7ad-4d85-afa4-9ed313cad411", "value": "0a20caacc7815f61225db34fcf397b6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297962, "uuid": "f6b3df3f-8491-4209-80f8-7786a67cc81f", "value": "3072:sZzCgsWfP0WO8SoIVpYpc70RNVS2Zz4oRksucIe7G:2Cgr0W2VN7ypie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297962, "uuid": "ff577126-ec79-47eb-8269-cbcdd7a45e4a", "value": 132976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297962, "uuid": "55102af6-b3ca-4f50-b133-2609c6a88ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297962, "uuid": "e512a463-7099-45a0-a147-f4ccf33b558e", "value": "20fecf8a01795083c8520caa8d4c8d6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f877fcd-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646296606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296606, "uuid": "93fc4a0a-14cc-400e-ade0-6be23aaab2b4", "comment": "Malware payload (Formbook)", "value": "1d49923885911bec6854216dfa14b7de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296606, "uuid": "c5e2a521-a5fb-456c-82d7-ee55b25142f5", "comment": "Malware payload (Formbook)", "value": "2630c44d4f84ca7abc040505a9b4105634bfcd99b4e4de8cb75993eca94d4cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296606, "uuid": "ad5da04d-d905-4e28-a5f0-5a37d9d073d4", "comment": "Malware payload (Formbook)", "value": "0be9854d9fb05c77f814e076dbf1b358687470e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296606, "uuid": "09b00193-c37d-43b2-81ae-0ea4e710bf86", "comment": "Malware payload (Formbook)", "value": "3d93bbc39d0df0fa46d3580dd7c0db35c79039dcb33155f05f912b5834257e92d608bd79205bb379e87c9182f61999e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296606, "uuid": "2cc5b0cc-ce38-4396-bef9-769bf613e652", "value": "T18964231ADAD4D623D7E6593007B7D3F4F3FB89C645A3A603EBA80F2276193970895C81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296606, "uuid": "f7525ffc-d6f4-4332-9e6f-efef7cd859fd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296606, "uuid": "8037936f-6389-4e21-9be8-3f92c755fff1", "value": "6144:rGiKYNm2sowL88I76J/+L/1AP0h7iuTys+qirM2cmHzqRShq:3ZwLs6JrMh9TmqAfz/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296606, "uuid": "f6f2390c-ca58-43bb-b4bd-e221cb2fc86a", "value": 306818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296606, "uuid": "1f1c0d50-ec91-46d4-9dd6-e5e6d81a0974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296606, "uuid": "37a48bcf-0f2e-44a5-8258-55c0046b7245", "value": "1d49923885911bec6854216dfa14b7de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350ad603-9aee-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646310842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310842, "uuid": "034e29f8-5e58-45f4-a941-c3f5cda625cb", "comment": "Malware payload (RedLineStealer)", "value": "81a30361b3e0369da285d6840a1870a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310842, "uuid": "c63ad14d-e5f7-4006-b002-b7f19c7f48fc", "comment": "Malware payload (RedLineStealer)", "value": "26328f5caa371e7caf9286e2619b3f0e3b9aa9b6cc73257a8c524e7d917d77a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310842, "uuid": "275810f3-9075-4016-a8fa-af1087cb0ba6", "comment": "Malware payload (RedLineStealer)", "value": "52791c74a464535f12db8df3bbfd7eceb0558078", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310842, "uuid": "f548e3ad-9c3c-4a58-a4fb-0a210a08a62a", "comment": "Malware payload (RedLineStealer)", "value": "69db27dabad3e5f06bf2f42d8539e87e97edf92a4dbed6ff2c5018d21921d9040d5d99a504785492270c0331fc062653", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310842, "uuid": "0b42ae61-7967-4c02-b136-f57f39d3f483", "value": "T12F36330934CC99E6F40F4B3EF665676B4732D7C47C601EA143556842BA200BBDAEFE4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310842, "uuid": "2d7bc195-9521-4c13-9ee8-642035fad378", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310842, "uuid": "7fa064d3-fd8d-460a-a1cc-921bfd6f8acc", "value": "98304:D2AOvKa6ILjYu0svqPgVP6vbqSNgzsQpCaSIKW1NMW8x+sv:qAOvKa6IABzPc6vbqkUsACajKWXby+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646310842, "uuid": "2711dc3a-fc24-4c65-aac8-7a26e59e2b29", "value": 4888216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646310842, "uuid": "cc38a98b-2087-454a-801f-60ad3724107d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310842, "uuid": "902d7b01-a78a-4cfc-8106-f632ac0cc75d", "value": "81a30361b3e0369da285d6840a1870a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36581bc4-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "195d7ccf-7b60-4485-afd8-bcc6bb33852b", "comment": "Malware payload (Heodo)", "value": "49a991059b5b2c00395d7d5ecd9e9828", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "2e219753-a8cf-4287-9f7b-8e4160a2499f", "comment": "Malware payload (Heodo)", "value": "26be3800ed843d606b26b1b15885f4e9b1bf122ee1baae29af44d0ac5cee3845", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "7afb67dc-be5f-4365-a201-1c79c8a5ffc4", "comment": "Malware payload (Heodo)", "value": "87512e16b762e3c8d7931a8717864557ed059002", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "03ca5ebe-17bf-4413-8cb6-155dccbb5ffa", "comment": "Malware payload (Heodo)", "value": "0a5ad242c057bc8214256fe7c0c28063dbe78a4151cedb0f7ae1f5dd15080e75109e7db94e1c163408df2f6f88db94f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "f66b6fb0-7b23-4a96-85dd-e8b445fbaebc", "value": "T1BA353942BA48C5BDF04E08B9181EAA69667E1C447B3296D7338C7FDDBB319F90832517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "0b649335-a664-404e-89dc-4bbe263637af", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "bfe63fc4-a2f0-4871-a3aa-695c3269c191", "value": "12288:C4rjnpAeev7HmOsVUCfbWierRcDFtLlirkfLcsMEPe6MpPfXxiDjM+R:5rjpAbv7HmOsiR1cDFXiQfAsUPv4DjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298818, "uuid": "27701420-0a8b-4146-bfca-e1c6a095f3e9", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298818, "uuid": "24e29613-8ebc-40ea-b0bf-888b268b4774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "9ad99ae7-3ffc-4bab-9163-9781d823acab", "value": "emotet_exe_e4_26be3800ed843d606b26b1b15885f4e9b1bf122ee1baae29af44d0ac5cee3845_2022-03-03__091333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534de240-9b1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646329791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329791, "uuid": "b622ac90-8b5c-4856-815c-1a2182321042", "comment": "Malware payload (Mirai)", "value": "03acfdca755d022d529b73353de36824", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329791, "uuid": "00cf6562-a9d3-45a0-806f-d0da4397722b", "comment": "Malware payload (Mirai)", "value": "26db7c32f4df7ac53bdb8115c717e8ce16d6fac76d5da548db387539d550f99d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329791, "uuid": "456eb73b-2e38-43c3-9fdb-00a29a1d4ea2", "comment": "Malware payload (Mirai)", "value": "0b4d77c55bdea318c17288e2261ecc651e478f56", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329791, "uuid": "5862292a-51e3-4451-8d3e-97b4e04a1e0c", "comment": "Malware payload (Mirai)", "value": "a3e02748dee0395a77cc33138cd55b157cbeb419d4ce53530e758b38c97d841a5780fe4597b6c18e1e5ef66a7944bf0d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329791, "uuid": "fc8dc84e-b627-421c-9d1c-9f1d9fa15d80", "value": "T172935D27B552C67BC08752B42BDFEA615833B4BC0B32720B33D47DA52B269D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329791, "uuid": "5c6763d1-20db-4f5e-8fa8-b65ff6992a06", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3wyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKAifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329791, "uuid": "b53cedd3-4017-44eb-9e13-515117d4bc25", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329791, "uuid": "2f522395-0a5b-42a3-be3b-8bf033d44f97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329791, "uuid": "0a6af0f8-8ca8-4834-a4f2-ab18d647bfb3", "value": "03acfdca755d022d529b73353de36824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e5ec34-9b12-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646326458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326458, "uuid": "b1fb3869-fcbd-48a1-ac50-5bf123850ba4", "comment": "Malware payload (Mirai)", "value": "07521aa073ae243e80ed5d490f295f95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326458, "uuid": "0902427a-e518-4208-9882-540e7c476e25", "comment": "Malware payload (Mirai)", "value": "26eb527c47d57e34aa2f1c9ac71945733bd82ca75e99dc9e6759318c4574def2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326458, "uuid": "a55e646a-0cbb-4a13-bd3f-ef48403fd065", "comment": "Malware payload (Mirai)", "value": "4db11ed8b4a1dcbfe0add91658df5f9cad5ce04f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326458, "uuid": "8884f8c1-2f09-4973-8123-0158bafd38cd", "comment": "Malware payload (Mirai)", "value": "5d70be28704cd9492f9774ccdda089344c1842bba3b6a100579bd8e3b0102f096d8e7c6f76b403888c174ed2e6d0280b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326458, "uuid": "e057c644-d855-4e63-b2a9-fe35424d0fa2", "value": "T14FB31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326458, "uuid": "786f6b41-d1b4-4903-8a1b-3c044e4ccfd2", "value": "3072:MSY+46m1qOzssIFPPKNy+AmkZrQAhPDCXFke:06mgOzJIFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646326458, "uuid": "e9c649fd-08a4-4508-80e2-1539d4ea2702", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646326458, "uuid": "e89b14d0-5849-4192-8070-cbee0d220185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326458, "uuid": "495fa55d-6153-41e2-bda8-f1a5df5b1850", "value": "07521aa073ae243e80ed5d490f295f95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa38d4b-9b13-11ec-9275-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1646327046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327046, "uuid": "7ca20037-46a2-4d55-8da8-8ccfd678b9d8", "comment": "Malware payload (Guildma)", "value": "8abeb02e45cc7227f3c2d46c96f91695", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327046, "uuid": "c6aba5ac-d17c-4207-8f6b-f22a5642f0a7", "comment": "Malware payload (Guildma)", "value": "27b1d2981f5ee678dc840fe47e3866fac762d728392f1305c5994cb8e87e908c", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327046, "uuid": "e293b209-0d4f-4a7d-a6c0-c5c0803235e7", "comment": "Malware payload (Guildma)", "value": "a70028496835e48cd33f0367757b11a7ceafc3ed", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327046, "uuid": "222b0664-996a-4eb8-a78a-428779a00a91", "comment": "Malware payload (Guildma)", "value": "b17943ee0401500e49032133eff1b0c498094fc84a6e94f9472bed84b2337cf58887a49a284eb6b10610b99aaa77e223", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327046, "uuid": "555ea5ce-4e80-4030-b13b-d37677eb9797", "value": "T14DF0DC4040512B40C9614033C8B78B10096AFA9D57872111E2D9AC47AD96080E94A55D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327046, "uuid": "b9da0d47-44f0-4c2e-925f-3f41b216c2e4", "value": "12:8rfl3OB+9LHPjYQPlwteQwJXi7GPiO78J/:8H9LHcQNGeVJXiKv7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646327046, "uuid": "2226566c-447b-4506-93f1-e227c5bf2e3c", "value": 513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646327046, "uuid": "1e9a5661-dbf4-4e7c-84a0-89dbfa1312e5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327046, "uuid": "0fb849a2-0a0a-4e20-8927-ff5992516ee2", "value": "NFe_7632231486.761992.63753.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecf6eed-9b37-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646342292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "9f982737-9461-4291-a58b-92605c420123", "comment": "Malware payload (Heodo)", "value": "9bb038e7cc16d6f535e1d4b17752a72e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "0a203939-fa6b-4d5b-aa69-d66af2b578c4", "comment": "Malware payload (Heodo)", "value": "2837672a09f8534cef9068972e7254418846feb72e4fa820e89bcc4a616ad5a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "8fbaefaf-5b53-4256-a8e5-4aa8f399eb98", "comment": "Malware payload (Heodo)", "value": "89f4b7a145053cba7ec7efdcebf5374367df338a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "a879ab12-f2ae-4489-af21-8afa1ae7d4e7", "comment": "Malware payload (Heodo)", "value": "57c81fe3b436fae7d83284e83c6986be640ea5605fc95fabfc491cac5822ee11e3c4ff0e0f2945c4e031ef04bd8e231d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "55b5510b-4186-4c15-b1ae-85d201cfe51d", "value": "T12FD45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "589d3e47-115e-473b-a252-0fdba8e8d155", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "0daab717-56a2-4a84-9834-3a21cd3cff14", "value": "12288:J1U8sNY8/z0rYebzwdiCoGEAbcVBLku8w:oq6z0rYcMdiVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646342292, "uuid": "345a082d-488a-4d55-9618-4efa7aeeb8d6", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646342292, "uuid": "f8aa129a-d725-4c32-bb44-669e09f86ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "e2544040-b7a5-4ac9-8de2-b5edc80791d6", "value": "emotet_exe_e5_2837672a09f8534cef9068972e7254418846feb72e4fa820e89bcc4a616ad5a9_2022-03-03__211806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a2f08a-9a88-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646267269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267269, "uuid": "b8c04154-7e92-403d-89d7-0d33e6c0915f", "comment": "Malware payload (Heodo)", "value": "9fb9806bf354807e788d47713c4aba22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267269, "uuid": "4ebc5073-df8d-41ee-8d01-a763413820d3", "comment": "Malware payload (Heodo)", "value": "29273892a25cb9ab23e306a0870d30a7a9264c8009fcb185890738fff2778056", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267269, "uuid": "fbf81835-3050-439e-8c5d-82c48ebf68f1", "comment": "Malware payload (Heodo)", "value": "557941f19cd4ca221656aa0ac1f6b91f5b39b7e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267269, "uuid": "65ed1b6a-d858-4e78-8001-be91e7079a3e", "comment": "Malware payload (Heodo)", "value": "1c13889dc36586030b55dcb56d4ab986650ed1d15b50f62790488189a72d48d5a90f9afd2bcac9e3379d5cc245a76009", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267269, "uuid": "9f1f3e88-d68e-4d0e-8049-fe7b1774fa7e", "value": "T1B0D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267269, "uuid": "8fe80568-064a-46e7-ac71-96d691067801", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267269, "uuid": "bf669be7-f80a-42d2-85c2-0c8a7d93717c", "value": "12288:ZxpNJJJ2NHPoczJyOtIhxf3foRXIa5EPwvA:Zx2gczJyFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646267269, "uuid": "a1bc9f3f-2463-474f-b0e9-471134ff6b58", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646267269, "uuid": "c31609ca-5a8e-4405-bf7a-ca23b17c4f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267269, "uuid": "db13b57b-7a67-4ea6-8317-9e00519ce149", "value": "9fb9806bf354807e788d47713c4aba22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf63f71-9aa1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646278081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278081, "uuid": "41c50d80-cff0-4fc5-aa54-82808fcb1734", "comment": "Malware payload (Heodo)", "value": "8c499cfe934e6ec6992fa2570ae3a556", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278081, "uuid": "a8392528-faa7-49ed-ac93-09a93494303f", "comment": "Malware payload (Heodo)", "value": "294ff1f6271b1f6c03dcad443d2d8e0375ef534a861e937d57085bb261dd121e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278081, "uuid": "ddd27580-89e3-497f-bbd0-a31eba020f49", "comment": "Malware payload (Heodo)", "value": "7778a3164d60a789c9486b1d144105432e4e9d0e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278081, "uuid": "e38ae234-13cb-470c-9837-5335a4a8bc8b", "comment": "Malware payload (Heodo)", "value": "7ba9091e70fce1d767354d409c9e177c964a11af248463b652ea09ba155f1ee51e884b04ee5aaa9e6bcabcdcc2340e7e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278081, "uuid": "d4f325af-5b54-456a-8c45-47a583c9f5ee", "value": "T16B23E02AC5207828DB3A4C35820469D2721A7D05DDD5FB5A3145FB4C3B86BFB53AF88D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278081, "uuid": "7f276b48-5397-49ee-8622-3e3b8a7ded7c", "value": "768:r1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:r1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646278081, "uuid": "f2f47459-e306-4048-a36e-86cec17c0914", "value": 47653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646278081, "uuid": "b9b84902-ee0b-466e-b080-01cace54e1e5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278081, "uuid": "ae145ab8-595b-4c03-a62e-c27ddcc8138f", "value": "Payment enclosed.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edf8927-9aeb-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646309570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309570, "uuid": "e4145552-68da-4c1f-8a7e-7dac7e275ca9", "comment": "Malware payload (ArkeiStealer)", "value": "ec4e2b32ed37f77e3bd83ad117b4d7bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309570, "uuid": "8e7fd766-6df4-416e-a4d3-2f6d70a93ab5", "comment": "Malware payload (ArkeiStealer)", "value": "2960e76a6626b30c8952e0642c1453f08a98e55be3d611a56f33e4c269ef8952", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309570, "uuid": "7d5b285c-cc25-4809-94c8-37bf216c7c04", "comment": "Malware payload (ArkeiStealer)", "value": "42f04ee2438d8cf7bebd3350bfa7d15c0dcca1a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309570, "uuid": "e7631709-2bc5-4637-8ba4-4e4bddc0b3a2", "comment": "Malware payload (ArkeiStealer)", "value": "e5c1bdabd67bbf29716bce9cc8c9ee098ddc6ca64834a3c6f2430fc3aafed141eba474effb124ba01e4e693c961ee30a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309570, "uuid": "c83b79a9-4a8c-4922-9744-507972267585", "value": "T100E4F110BA90D035E1B726F85AB9D3A9762E7EA15B2460CF33C57AEA57346D0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309570, "uuid": "f78d5c08-248f-4378-b6a5-10136fa0fd5c", "value": "33c707c2a415a475d1f7fd53625c54c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309570, "uuid": "07f20123-e376-4302-b49a-9094159cda73", "value": "12288:CMoE3HHYJdJ003e0FT2TV/6e3nKCf0yiSdivLPzM1d:Lr3YvLu0p2T539fTcvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646309570, "uuid": "46501290-2273-4b2e-a36f-c862ae8c7360", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646309570, "uuid": "d6deae86-1dd1-4a5d-a25f-52c6da92e89d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309570, "uuid": "6cb786d8-5692-4fc5-989a-11be861b7220", "value": "ec4e2b32ed37f77e3bd83ad117b4d7bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cab9e0-9b1a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646329659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329659, "uuid": "a1c2e14e-006b-44cb-ab62-8f13830a9167", "comment": "Malware payload", "value": "3cb022fcb8da17f36b207273d53a272f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329659, "uuid": "b1acf846-0d0f-476b-b185-5b5bc6813dfa", "comment": "Malware payload", "value": "29a75e1a539efa4eed391504bcbed85225aa7483b2cd3fc03a450d267f2cf3a0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329659, "uuid": "6310d7c4-1163-4b84-8ae1-8616a97ab8a9", "comment": "Malware payload", "value": "f779e9472af88b62c2790a8e7111cb34d12690e6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329659, "uuid": "c831c028-25f3-4ba1-aa32-4c2155575ef0", "comment": "Malware payload", "value": "733f492665bedd5ce2cbcd30e8cadb8804e88a2047cb20d5445734ac51081120a109911f0f746397a0cb4a2e0282e5e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329659, "uuid": "e27279ef-745e-4f6a-9635-9f9e28d161e4", "value": "T1254191DD05700CDC94648D293263C8A69397ED851BD29E44E3B2E3B194CC60FF8D2B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329659, "uuid": "f073053a-209d-4749-96e0-820f80065e4f", "value": "48:VMygHAzxxp7HGZhx8DX8D78ZH8xYadDn5HU71vwWcHA7hVNXH2BgC0SHErPDH2xS:VMygHAzxxp7HGZ/8j8H8ZH8xYadDn5HQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329659, "uuid": "a13a0c7c-2520-402a-9663-fe2188274d06", "value": 1975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329659, "uuid": "2dcf2c49-9b8a-4de1-b199-d7afb9f9e3d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329659, "uuid": "dedff702-37e0-487d-b86c-fbf25edd2f5e", "value": "29a75e1a539efa4eed391504bcbed85225aa7483b2cd3fc03a450d267f2cf3a0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a931f6-9aed-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646310340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310340, "uuid": "294b44fc-7b1e-4aff-9b1c-311a8480cd0f", "comment": "Malware payload (RedLineStealer)", "value": "8addb787cbfc54ddd065a54f0ca86c4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310340, "uuid": "788b570a-b97e-4d59-9fc0-cd0f35a26ec0", "comment": "Malware payload (RedLineStealer)", "value": "2a72df9389aa95c77d443831525b194594fbc1e40a1fe7b3e73e9c6a2d3b2544", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310340, "uuid": "6406de6b-6e22-4298-b00f-7661e8abcdca", "comment": "Malware payload (RedLineStealer)", "value": "7d5f4b85e12aca275c8c221691ff1c863d2ec701", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310340, "uuid": "ab15a6ad-f313-4423-ae25-11b4941e2a19", "comment": "Malware payload (RedLineStealer)", "value": "375c567c2a5cf5dbace244a20478446c5b4b99810f8a2fa509aa505fb01e44ff075205c0deb5ac2f7ccf11d17cea5ed9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310340, "uuid": "42a9980b-97c2-4d9d-ae43-d072e14fa5fd", "value": "T1451633373A862477CB504D3535142730FA21F2F88BD52EB9F2EB52981D9449BDC826BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310340, "uuid": "ee487ecb-3422-4bac-a67d-85b098e77b7d", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310340, "uuid": "5fee5151-43c4-4932-a075-b7892081f05c", "value": "98304:EGJxJfxdTY2Qj7GnoIsMYhQiaIjSTSdiT1Ej7Mv0fk:HzgjCnoI3biauSHREjSuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646310340, "uuid": "8583d841-4af2-4b81-a262-080e650b8e78", "value": 4145816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646310340, "uuid": "509a0785-ef3b-4540-848f-326d00468bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310340, "uuid": "f57f5e0d-fce5-4881-9481-dc714620c16a", "value": "8addb787cbfc54ddd065a54f0ca86c4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8403eb4-9b48-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349797, "uuid": "8b7a5c8b-283a-4ae4-a76b-dc227fb70eda", "comment": "Malware payload (Heodo)", "value": "286799adcb1e80dab3034497cefd5a0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349797, "uuid": "8e6f1477-16df-466d-94a6-8b1b0f8dbe9f", "comment": "Malware payload (Heodo)", "value": "2ade8512c055b3bedc4f9cb7cf32b18f18c7db05573a4925b08c65de6f3d8de7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349797, "uuid": "11051315-078c-4584-b77a-5f67d8330fdb", "comment": "Malware payload (Heodo)", "value": "53abd2deba234596c166d8bae589295f4942523d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349797, "uuid": "76943077-7745-424a-b12e-c9bb2876d4b5", "comment": "Malware payload (Heodo)", "value": "89278de440d3c8ffeebc397517be5192481d9479226af681349c90e1226f48d78405809adbd068989121beb1811d226c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349797, "uuid": "ae252e98-e630-4150-8ecc-cdbce71ea4ee", "value": "T17BD45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349797, "uuid": "840813b0-2826-448d-b065-54f4f1244780", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349797, "uuid": "ca51cb4e-3560-45e3-84e4-bcbdbed405c6", "value": "12288:J1U8sNY8/z0rYebzwdUCoGEAbcVBLku8w:oq6z0rYcMdUVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349797, "uuid": "685383d3-e6f8-44de-9015-25fbfefb92f5", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349797, "uuid": "074741a0-31ea-4a7b-a86a-f95e523372ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349797, "uuid": "75f09f5b-317c-48ef-a875-608e1c3bb9ae", "value": "286799adcb1e80dab3034497cefd5a0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3578a601-9b48-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646349497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349497, "uuid": "5d8384b9-e9a3-4076-ac80-d0a98d453066", "comment": "Malware payload (AgentTesla)", "value": "93b339b8eea8e36a3d668208eb73b207", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349497, "uuid": "7f994adf-ba8e-4db0-95d8-077cff858e85", "comment": "Malware payload (AgentTesla)", "value": "2b3b5dd915bc551c2064081d3a441bf26136a9bea1fbdb66481e58e4201c384e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349497, "uuid": "e9f23b8c-47d9-4a83-b78a-d0db6a2e3aae", "comment": "Malware payload (AgentTesla)", "value": "e22747beca278d8d470678cb5eb22836049c24ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349497, "uuid": "f4df9423-874f-4671-9cd2-cd3ede689a9f", "comment": "Malware payload (AgentTesla)", "value": "3dcb0ced2c732f63798e558ef0d0dfcb5fc195f69b3902ba468cf7b6351af7ea7e397e7f8da2c063ad188a4467c4d11e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349497, "uuid": "c5bb2bf9-4613-40c1-91fe-76bf9cbcbb02", "value": "T1737423160AD18433C5A340300BF597FDE37952E60E8A2197DFE86FEB2EB548319257B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349497, "uuid": "be171571-6885-4bc1-a85d-4d997ad8683f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349497, "uuid": "c61a3c6c-1c1b-4252-acae-dfc5358b3e65", "value": "6144:rGieCZfsRdu6BOMQCsUQoKnz7jz0qn6Vp5SKzfU/I6khOwoLn0CS6X38KfMq6+:DaRQ6BOxUNS7TYpF6I6p4Cp8Sd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349497, "uuid": "3abec9f9-8765-4951-9d44-02e4057bd21b", "value": 355589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349497, "uuid": "b4451d20-28de-4223-97a0-39a7a5617b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349497, "uuid": "d3f8e6e7-db90-4dc9-939b-abe0c7e0cb6b", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779b91f4-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (TrochilusRAT)", "timestamp": 1646296351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296351, "uuid": "901c1bf4-56ba-4613-a367-d4df1f36909a", "comment": "Malware payload (TrochilusRAT)", "value": "1634d4a7ffdd698f6ccb541719fbff5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "TrochilusRAT", "colour": "#252DE1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296351, "uuid": "9913d0b5-ea5d-4303-b793-77ad07aa1225", "comment": "Malware payload (TrochilusRAT)", "value": "2b7e4e5758699f924f50615e8fe48e13bf428d7aa1fcbfb2ed4f64a0fd6a8f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "TrochilusRAT", "colour": "#252DE1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296351, "uuid": "0114b5d8-d14f-43ef-87d9-6549ffb1cef5", "comment": "Malware payload (TrochilusRAT)", "value": "8d01203d8279404db353a97be2acee79cc9be1cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "TrochilusRAT", "colour": "#252DE1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296351, "uuid": "9a87a1f7-c361-4493-9c63-000058ff76b0", "comment": "Malware payload (TrochilusRAT)", "value": "b0d98b520e856c3cfdbd772b06e8bc15be67275801536f04509adca6f8aa3ea69101666e0ebf79d2a7c6006dd474ddc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "TrochilusRAT", "colour": "#252DE1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296351, "uuid": "99f1df1d-dec0-4142-aa9b-238ad2a02cda", "value": "T1CCA5AF217790907BC57E3632574AA3B9B2F9E9309E35024766A01E7D3E348D2993C27F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296351, "uuid": "26e97eeb-e00e-44f2-a0d8-ac8fd9c4199b", "value": "a01522d1e6a438332d5131e139326c71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296351, "uuid": "b3eabe28-3be7-4110-b5b8-929e40b9f5df", "value": "49152:1yhZ+bW+qp2UWp9YkieqYftleW4lojGCpMIPJtuqLZHGNloUHKv5ksTAvEypm/jM:16+bW+o7WgkieqYbeW4+jGCpMIP1Gfos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296351, "uuid": "dd43ac7b-d099-4306-8bff-378be0e771bc", "value": 2066944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296351, "uuid": "97baf0f9-32fb-48a7-a6b7-cd249c8dd82f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296351, "uuid": "7ea95b25-37c6-4c02-b665-d0c174b15572", "value": "2b7e4e5758699f924f50615e8fe48e13bf428d7aa1fcbfb2ed4f64a0fd6a8f93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0020e216-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "3ca9e811-ef5e-4463-9a2c-6501888716f7", "comment": "Malware payload (Heodo)", "value": "6136aaccd13f196a8a41566c9bb793f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "519b36f8-58d6-4dba-942f-8e86bb057c4a", "comment": "Malware payload (Heodo)", "value": "2b91b563748ab8b435c81452dee4e50772aa644037a7e45f03255bc0ef0a530c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "14e189ed-0b62-492c-aa5a-b7806c1796b0", "comment": "Malware payload (Heodo)", "value": "b1617287057d2970e57b93f9fbb91fea033a1e8f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "37b106be-bb55-4189-b96c-e4b658569ac0", "comment": "Malware payload (Heodo)", "value": "dacfe0d0f75a5b74e9641c5d4fbc6fdf61d0eef280f761ae3807d1a5f97dadefcadf137b51b3b7165a613378bea2384e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "483f3eb1-747e-4463-abb8-5892b09d8661", "value": "T1E5353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "214d306b-fd7f-47af-91dc-1c2d40d97a8d", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "2c79bb46-66be-43b7-980a-b44e65021a2d", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZV1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZJytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298727, "uuid": "e487846e-df0f-4edf-be2e-3271fdb3e937", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298727, "uuid": "321d73c5-5d64-4201-8e1b-f45244446fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "3a20c1b5-2c97-4472-8185-7b0309b3a79d", "value": "emotet_exe_e5_2b91b563748ab8b435c81452dee4e50772aa644037a7e45f03255bc0ef0a530c_2022-03-03__091158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36579bd0-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646296241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296241, "uuid": "1280ab75-1d2d-4584-b810-9fbcf7f74c14", "comment": "Malware payload (RedLineStealer)", "value": "25069c464f72f2bbddee5104f73e20d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296241, "uuid": "39e998a0-b065-4425-b413-ada3dc63d3f4", "comment": "Malware payload (RedLineStealer)", "value": "2c5e97c51a0cd9e1de4085535595a9f90a2ba07974d0e2f17c8648cc3e7b1ad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296241, "uuid": "02f4095e-1c23-4843-91b9-63619b184caf", "comment": "Malware payload (RedLineStealer)", "value": "806718b4d638c302af8483db301ee36a1dc0fb13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296241, "uuid": "9d508dee-4501-45ac-b2f6-6de76880520c", "comment": "Malware payload (RedLineStealer)", "value": "d0d06b844d09b71dc0234f2e360e48ea68c9237345ed732c366de32f04d2c859293e8fcfd726722bf1dc30ca4e076709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296241, "uuid": "1a2510d0-099e-46eb-9b25-e99cb9eed77f", "value": "T1FB36016321750025E0E58C398537FDA532F63A324F56D8FFB3D979CA1A365E1A632A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296241, "uuid": "dfecdce4-5d09-4321-bd07-5ee0a8186e71", "value": "b2ec5e305a410e6442f3911ef61575a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296241, "uuid": "d514f391-a876-4941-8c59-53c446164f18", "value": "98304:KasfMoRvcG6bN3unEWiH2mdnyPi/60SEJSnoG52N4vnR3rO/KZz:KXpiTJuEhhd2i/607SnoGHfR7Zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296241, "uuid": "a5d2b1e3-1070-4ad1-af56-4e7464174b6a", "value": 5210480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296241, "uuid": "0f4e4e91-54f0-43c0-8925-13b7f9d62b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296241, "uuid": "5b1c8e58-4172-477b-ab00-b7bbb4bd0712", "value": "25069c464f72f2bbddee5104f73e20d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e7a9ee-9a94-11ec-9275-42010a9c0029", "comment": "Malware payload (LockBit)", "timestamp": 1646272489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272489, "uuid": "83f835b8-41b6-41d4-a0bd-bc8f598c6487", "comment": "Malware payload (LockBit)", "value": "10bc6cfad55db97681205bdf17b6a53b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272489, "uuid": "240c953e-a3dc-493e-b98b-92d92f76f5c6", "comment": "Malware payload (LockBit)", "value": "2cf51d2d9edcfcd6fe5a8c323149832858f9655742dd5e327ee182960e558ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272489, "uuid": "049f2467-0626-45dd-b7ee-9fa369a5c0fd", "comment": "Malware payload (LockBit)", "value": "32174e86cbd0c019a70a3dc7c336e9e2e9539cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272489, "uuid": "f7c937bd-d128-4c42-be35-1b75f9853f56", "comment": "Malware payload (LockBit)", "value": "a1e46e7fe6bc45dbdf3021afac2ddddb0a5ba6f42038eb02a6a5beba2cee7a79560a149274d1dbcf70caa7ec2537857a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272489, "uuid": "b91138cf-a8cc-4772-88a1-99eb1a2e3637", "value": "T12D253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272489, "uuid": "b4aaf37d-c370-4d03-9483-f9d045423f16", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272489, "uuid": "fe1764cf-0b4e-4603-8d36-c22f5a034376", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdfF:Ujrc2So1Ff+B3k796J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646272489, "uuid": "1acd407f-b10a-4ca8-b59c-65369891c1bf", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646272489, "uuid": "27cb9daa-640b-4ad6-aafa-25ad44244073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272489, "uuid": "f4803ccc-dbbf-4b4a-97e0-a7308c541cac", "value": "LockBit_56EFF9037133F36E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992e9ae1-9ac0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646291253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646291253, "uuid": "7611d2da-8212-4d41-8dfb-14b110d9890f", "comment": "Malware payload (Formbook)", "value": "401ec890ed9689e1fbe4bdb2fb56539b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646291253, "uuid": "c841a503-d073-4cb0-9131-d29079b2fee2", "comment": "Malware payload (Formbook)", "value": "2f2065afbf5ecdc1a4b6f31fbd1f19eaed628d432fba894c0e55a48d722cba72", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646291253, "uuid": "2dd9283a-18aa-4ffb-8c43-c8e16575759f", "comment": "Malware payload (Formbook)", "value": "43e71dcffc4fc432b134f7310f03be281e47b5bb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646291253, "uuid": "0e283f6f-e302-4ff7-91b2-c12320b2fa59", "comment": "Malware payload (Formbook)", "value": "ceab45e5d33b0984dab03a4b00139e191e1b3461ea2fcd856a9c552573167fa20cc4f63e8320a1e3d17d6ecaef2edd5b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646291253, "uuid": "efcb8d4f-866e-421a-84e6-797df83b63e2", "value": "T1BBB423326655FC97EF880397D1DE81ABCC600B7BD36CCF6863605A0BE8ECAA55C145D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646291253, "uuid": "d01b4aef-f2ed-4134-bcf7-3ce4c2125e0f", "value": "12288:MczUAcRmM/DDq2tFLwTI388MjW1h3i3/H0xE2kQcv:Mcz2RmM/q2tFkz82sxE2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646291253, "uuid": "f5ea7f1f-1769-4377-8610-d036d7fc3d30", "value": 523905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646291253, "uuid": "870bcf92-042c-4b2f-8da9-b599277f5ac6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646291253, "uuid": "554fb2e4-f135-4e78-87e2-ae0559d77a51", "value": "WERHJKL#.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91844d7d-9abc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646289522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289522, "uuid": "2fc0704f-1ce3-4c13-87cf-7572d54beaa3", "comment": "Malware payload (Heodo)", "value": "592c1cd436a7998cc630638ad96e5148", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289522, "uuid": "5bc4463c-9980-4907-b7d7-f25abda9b057", "comment": "Malware payload (Heodo)", "value": "2f3554b0ae7754f154fd22eb0d1a41e90f6d1475ad6ad6618270f066ece5c7f4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289522, "uuid": "08778802-7e37-4e4f-a12e-be8273ed20f5", "comment": "Malware payload (Heodo)", "value": "228d9015cb2cf329e34ecaede644844a13e77b2c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289522, "uuid": "aade1136-b60a-4311-a58a-69d8505d1082", "comment": "Malware payload (Heodo)", "value": "afb82f235527965681e1eebebb16d9c0b61616c1617f67a948d83819080d69fed73345e3dbf1a5f94c58cec95aca4314", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289522, "uuid": "e72e2c5f-c3e9-43d2-b230-6e4eb23ae2cb", "value": "T15123E02AC5207828DB3A4C35820469D2721A7D05DDD5FB5A3145FB4C3B86BFB53AF88D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289522, "uuid": "dc3bcdd0-cca8-4970-85fe-4fcbcc38d907", "value": "768:X1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:X1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289522, "uuid": "1fab3612-831a-4b42-864a-de371bfe3b5f", "value": 47653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289522, "uuid": "07a40d02-0051-4321-8bb6-52ea44add042", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289522, "uuid": "cb82e8fb-0e7b-4f83-a38d-773139ad5250", "value": "2022-02-03_1534.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbf836e-9ade-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646304250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304250, "uuid": "08569e95-8bf6-411c-8c3e-983339b60e41", "comment": "Malware payload (CoinMiner)", "value": "da195cbe6be757763cb478b603cd2caf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Domino", "colour": "#57E4E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304250, "uuid": "d563354c-d02e-421f-8594-c20a474068f8", "comment": "Malware payload (CoinMiner)", "value": "2f70a1335ed3513ccf2996cf0ed45442692f79a4f9d8ea08e400d0f257c17394", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Domino", "colour": "#57E4E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304250, "uuid": "6892f9e4-dc0f-4218-af2a-dafa27f117f7", "comment": "Malware payload (CoinMiner)", "value": "c8e3cf92a0a6e03bdb83890ac17215882408184d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Domino", "colour": "#57E4E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304250, "uuid": "607cdce7-1730-4fd0-82c5-18787bcfabe2", "comment": "Malware payload (CoinMiner)", "value": "451fa66979326ed27edb6d383a77b3a219337e0429eda459186f3735da401dafcf20541d3b084a5bea8db5234cdcb804", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Domino", "colour": "#57E4E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304250, "uuid": "5f4dd80a-eede-4aa4-aba1-a870d22b0fc1", "value": "T12EC633302449DA11F87BD573066492EB670FBEF191F702934B0BE8B4129C2516A79AFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304250, "uuid": "17020add-9ce8-4544-bab8-f3e84db73be7", "value": "5325385994d9fb6377aee38728cb48f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304250, "uuid": "f8134276-7d5c-4b4a-9658-ffc27034df4a", "value": "196608:v6g5duNbMBv8jfvuY8MWrSN8oAaXjF5I8qPf0j0sjbYKqHdvHYX6IYNBw:v6gPuNi0jXuYlWrSNFjx5/qH0jzjbYPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646304250, "uuid": "579e3862-8a72-4602-859e-9def0ed8657a", "value": 12048384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646304250, "uuid": "123d6d57-9208-4b98-a4b7-d61f3fcc920b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304250, "uuid": "11e14545-115a-46d1-9850-3b140ac01ffd", "value": "Driver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81817d4c-9ae0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646304957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304957, "uuid": "4ea074f7-c155-4cdb-95c0-4d4fb305defa", "comment": "Malware payload (RedLineStealer)", "value": "d85c26559685967509c9226d989de2fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304957, "uuid": "52fb8680-38dc-4159-81ad-9881b2c91a20", "comment": "Malware payload (RedLineStealer)", "value": "2fa45bbf3a94fa57c65d3c36d54ded8b8a7d9f2872df7c1767e67340bf689176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304957, "uuid": "34548cb4-14f1-481f-948c-60f1e265af48", "comment": "Malware payload (RedLineStealer)", "value": "2a594cd23dec2404d108bacb80ab18dba44284d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304957, "uuid": "e6b6a27b-4190-4c85-bc0b-b2df8fc6a83f", "comment": "Malware payload (RedLineStealer)", "value": "17940e178b4cca02680b8981bb98a677605c21d6031fe5890136fddafdeab4cc7463b1ed3e6297b2dc766f564e9925c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304957, "uuid": "54d65e66-b7cc-4724-a204-6da38f9e4cba", "value": "T197645A2439EA501AF1B3EF799BE4759ADAAFB7733703A4591051038B0B13A81DEC153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304957, "uuid": "946638b8-46c3-473c-a2f6-7e9eee1fb69f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304957, "uuid": "c38da5ca-30fc-4a54-9031-ffe96433a271", "value": "6144:2lLsvsBMF3FyuEhL+Y13Iy2g3F3SJDfGNbV+JQOITk2DQ5BO7tBei:2lLsvrFyu0R13F24tSJDfGNbVuQBT1Dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646304957, "uuid": "fcbcffa8-f87c-4126-9e4a-800afca124a8", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646304957, "uuid": "46338bc5-00e3-4a2c-9fed-67832b3dd998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304957, "uuid": "1cb764a5-6d1b-4a25-8c64-75d23386b557", "value": "d85c26559685967509c9226d989de2fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695d2588-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298045, "uuid": "0104b62b-a844-4013-8fce-6b9621602b76", "comment": "Malware payload (RedLineStealer)", "value": "33843f51bf1da8c660eaad6960f631c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298045, "uuid": "d6860219-1a2f-4a12-8cc5-bfc1c74c9bc2", "comment": "Malware payload (RedLineStealer)", "value": "2fec7b4ea47561285e6f6136a1df0d4c60342567be0ab0d3fba37f4bf9f3049e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298045, "uuid": "29dcec7a-a9e0-4f41-bb50-3eed320bec56", "comment": "Malware payload (RedLineStealer)", "value": "d147d6132393ca4a08e8650cf95a8e7453208e11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298045, "uuid": "ce956423-1405-49e7-9a51-d14dd7c5bcc9", "comment": "Malware payload (RedLineStealer)", "value": "11de70e10ceeab1d4aa0dfece6888a07707603a24fb6fd082b2feb7903b30f46566711eb93128685faf4ca2b6183d4c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298045, "uuid": "6ed9f94c-4a44-46be-b9ed-5a3a6368a046", "value": "T16F353333E31F571FC072C6735D39560968AA929ED2E083793F0CB868951E052EEDB16B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298045, "uuid": "8de95312-28f0-4e50-b567-61463e66b12a", "value": "df8581eb68ff1419cc993e3838578f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298045, "uuid": "8bb4c3d5-81b6-4cc3-a4cf-7e8d4b79c5c2", "value": "24576:jbKWoM2j+xvAD8Q0oDSvCls2jDEcp2Du7eTB/nioHn5q8gy:ja+xYD8Ef9DD0iUBrHY8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298045, "uuid": "03003d8f-3860-449f-9772-baa8d3c61213", "value": 1129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298045, "uuid": "6d7c7cd0-5966-4d06-96c2-f63493fe1f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298045, "uuid": "109490e4-10eb-4345-95ec-30f823cf0179", "value": "33843f51bf1da8c660eaad6960f631c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d91077c-9b12-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646326452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326452, "uuid": "2f599a33-d982-4757-bf1f-a0648e3474fa", "comment": "Malware payload (Mirai)", "value": "9cb76bd82f1e5a76f02516b5f38853e5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326452, "uuid": "4e9f3e7c-2de0-4bc1-aa43-a262677369b3", "comment": "Malware payload (Mirai)", "value": "2ff3e8053b983bfedcc1a5ef2d0a13f85ef35612af2011b3bf47b4de216d1beb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326452, "uuid": "3324dd9d-2802-4e31-b7c0-0f7f2e10dc40", "comment": "Malware payload (Mirai)", "value": "41f2d11aa9775929ed13d913203eb5bebf4b7ee6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326452, "uuid": "581f5511-1e3a-4c50-8131-ef3eeb29f87b", "comment": "Malware payload (Mirai)", "value": "0593b42b803c94795614302a483e9dbf833d9bfb7abc832c43bf4dd1426ffd4bbd40dbc685b4916e3eb0c053bfd7dca1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326452, "uuid": "7c91ce98-9093-43e9-a40e-a0d971af59ca", "value": "T119935D27B552C67BC08752B42BDFEA615833B4BC0B32720B33D47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326452, "uuid": "d97c41d1-723e-41b5-ac63-8a057469da70", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3xyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKBifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646326452, "uuid": "e15fb189-0ab2-4522-a55f-9249f21a9a99", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646326452, "uuid": "4b0b8c0a-d183-4172-9bba-a590e6a6e081", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326452, "uuid": "7977a951-6d75-4d61-9765-093a9e575861", "value": "9cb76bd82f1e5a76f02516b5f38853e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40135396-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1646300123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300123, "uuid": "f80dd70e-c915-47d3-990b-b596448c0d1f", "comment": "Malware payload (STRRAT)", "value": "3cdd546b7c16ce98ad1377e8a5ffbe6d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300123, "uuid": "3ff5d26a-3b87-4d93-87cd-3cb7712a2411", "comment": "Malware payload (STRRAT)", "value": "2ffa5813138a840e24ab419187262f2204e3f664ece5256fd31705dd823fa418", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300123, "uuid": "378b4369-f0d0-4199-bdbd-8ec20a8c28d7", "comment": "Malware payload (STRRAT)", "value": "e7243aeb524cffa29d6f52e90f665afab1895ba5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300123, "uuid": "344992ce-e05a-4d5b-b79b-25af9088fd0b", "comment": "Malware payload (STRRAT)", "value": "3bad7b929f70a36547755ef1d2751c76df7610efcf010beea416e48213b48758f6990623b73c17a852e11396504f1006", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300123, "uuid": "345f017e-7910-444f-9333-f9ceccb895ca", "value": "T1DB0423F346461E78E2870BA436691EF9F97620731FBBE92370B71510CD5A991B0C6DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300123, "uuid": "76b5787f-1bbf-4060-a835-3add36ac3f3c", "value": "3072:SQFIdQ6R1JT9YX3a0sLVx7elyEcTpK+8//AUE+YGsOq0e1vjMiJb0Jp:SQsQ6R124LvylyEwYpAUEKzKvjMub0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300123, "uuid": "a820a3ca-1943-411b-ac32-0369fc68444e", "value": 181408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300123, "uuid": "d12e76ba-28b9-441c-91b0-a4306b903553", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300123, "uuid": "2b5bd560-6a5f-4462-9153-ed3283d8f44b", "value": "PACKING LIST AND INVOICE FOR PO42850.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c84280-9b39-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646343342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343342, "uuid": "12948ce8-0c62-4ba2-98ef-ca5168a23ba1", "comment": "Malware payload (Heodo)", "value": "4f493f56c14bdd97d151c61b5f876189", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343342, "uuid": "03fc6101-f1df-4b1d-8977-5641dd5c73d5", "comment": "Malware payload (Heodo)", "value": "305af9404a6faedb5e5f2e75d1d41eb38c6d69db6abbf8f84ae8de4a3f82bba2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343342, "uuid": "6645d6e2-9d56-4ad8-b860-bb0c440c5260", "comment": "Malware payload (Heodo)", "value": "1bdc749e85351e83362fef73c6bb83a87b5f3500", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343342, "uuid": "d6bf1797-1655-4f7a-8a6b-5e58a49dc613", "comment": "Malware payload (Heodo)", "value": "64abc7dacde71c2650de7a52ddd57dac62467a70cff0dd63281a0e487c2021c7d9c2b703dbadcf81f280c21ab6b6a2e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343342, "uuid": "5535a1d2-39fb-40de-9ef0-cf79ba8b7789", "value": "T117D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343342, "uuid": "b3b59928-8934-40a0-9dae-3d23b0f8ecfb", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343342, "uuid": "7e80d879-63ca-424d-900d-435f520b87a5", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLyCjzhmD/bwb1r8Hc:Bg4IqjYTy20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646343342, "uuid": "889f3824-396a-4089-813f-28cbe85e5d3a", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646343342, "uuid": "fb7fbe16-eb97-4726-a64a-217d29dc9fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343342, "uuid": "613b7e80-3544-47d3-be47-37865b766e1e", "value": "4f493f56c14bdd97d151c61b5f876189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6a3f2a-9b21-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646333052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646333052, "uuid": "9397396a-4474-489a-ad4c-b8c0b657570d", "comment": "Malware payload", "value": "aa930fffb560e9f88781ce71def10ff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646333052, "uuid": "67b74941-fff3-4c91-8d03-c9d5d2a7a289", "comment": "Malware payload", "value": "30ded1e17972660ebd0af64f5121dc6fdb4e2445714cb890c539eb2897cc0cc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646333052, "uuid": "181876a4-5dbd-4113-ba3e-69d1e19616c6", "comment": "Malware payload", "value": "9297011cb371343b7cf00e9fbf9713ddbf6a50fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646333052, "uuid": "9ed3b104-e527-4c36-913c-a1a43fc03dc1", "comment": "Malware payload", "value": "30ce66bc577975edac4492c301bcf7d56727eca725df7c7ac71d3647db1ff50a43b1b6e1e7cad0c9d5fb283d66b202aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646333052, "uuid": "951c19ce-6aa7-4ca1-83f8-4c27a3a18016", "value": "T1D352D64AE7C88127D1B942F560F3470BC77195661986DBEB7EDC905A3F223984293387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646333052, "uuid": "6ffea7b5-7d62-4321-a339-1d094775c74e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646333052, "uuid": "5c3af850-c39b-4a73-b432-d7f9fd9e13c0", "value": "384:PPrDbYAVxirXSuTCB7oVagMgMQGmptYcFwVc03K:PDXxVx+SXV0+itYcFwVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646333052, "uuid": "880609aa-8ec9-4dbd-8cb4-e4e9431a39b3", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646333052, "uuid": "dd97577f-e7fb-414a-b58d-4cd26e026d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646333052, "uuid": "664319e6-d408-48e6-a4c4-1e71379e7212", "value": "TrojanXD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f289d848-9b48-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349815, "uuid": "5c35db2d-667c-416f-840b-791e0b1300b1", "comment": "Malware payload (Heodo)", "value": "a6b15d204a0a4e127955eda281516fc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349815, "uuid": "460480cc-6dc3-4708-8ff1-15a0aad83700", "comment": "Malware payload (Heodo)", "value": "3108323cf0ece2415056fe45f91535fe02f16e43f1e012f20f41a4260c101da6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349815, "uuid": "87f88cbe-8695-4827-8035-765a6c866ccc", "comment": "Malware payload (Heodo)", "value": "44703acb6eb855b9fa5c2f2f46d08057ee713557", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349815, "uuid": "34f188a5-25a5-47f2-aeea-5d71490f16d9", "comment": "Malware payload (Heodo)", "value": "e8453394f8ee7990f3d7539dfc58e438bb81454c1560fcdfef9ebbb8fd26951dc59a89797b932e9367936746ee8de366", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349815, "uuid": "a23ec576-9f3f-4cd1-bbc6-27e5c879a813", "value": "T184D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349815, "uuid": "16bf878c-5a0a-4d30-a1d0-ada17901541f", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349815, "uuid": "b49d317d-4365-4526-b8cf-ace90b0b1d8c", "value": "12288:J1U8sNY8/z0rYebzwd/CoGEAbcVBLku8w:oq6z0rYcMd/VGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349815, "uuid": "cd1692e2-42c4-4c95-8a0e-d1520b345315", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349815, "uuid": "162afa03-35ca-441b-ae91-c8c0eb912d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349815, "uuid": "1df667b4-fe09-427b-8ce8-d6aa59825cab", "value": "a6b15d204a0a4e127955eda281516fc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3376b0f8-9a8d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646269178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269178, "uuid": "ad85e941-2f2d-42a9-b055-c07732df31aa", "comment": "Malware payload", "value": "91e302f8e27ee049e664bf26d8c70bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269178, "uuid": "70d85431-929d-4acb-a51a-5eb2007d1d32", "comment": "Malware payload", "value": "31570964d2dc4de722c3e5d3a72a7e7d41992482355d99ffc03d0b31e99fcab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269178, "uuid": "52b48f09-d440-42a3-ba4c-2cc286f62629", "comment": "Malware payload", "value": "6d44c9a5b1068a72d0500a18ac0e8d764ad3ffdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269178, "uuid": "8433387f-f90c-4759-b15a-3d7b27012f96", "comment": "Malware payload", "value": "f774b1391cd1eb285f6fa7d7edee2e50ff12ffcdc50245ae4a9d080956f0abfbba43c5a482f65edc13f7e589443e4395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269178, "uuid": "49e126c3-434c-44ea-bf22-fb1b84738c25", "value": "T150942343E94F11E1C1920BF98996FE6FB7204470331B8A47B345DB61EAA32C4AF71676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269178, "uuid": "fd4c8460-da46-4901-b931-d169f9deeb0b", "value": "f11f87642badc84e7fb44e3ac9b293a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269178, "uuid": "10e29a2e-1a2b-4fe2-9248-90824970432a", "value": "12288:GsE05umZPem7nAW04hrr5Qt0qfeErVEuj2vZrx:hZ5u8PemjFrCtBmErau6px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646269178, "uuid": "8efedb56-6926-4aa6-8886-85e7669ac9dc", "value": 421175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646269178, "uuid": "6d16c6fc-3829-4963-ab3a-73752a4f33ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269178, "uuid": "15d57b3d-0e69-40c3-88db-00a38457b899", "value": "barry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eaed1af-9b21-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646332762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332762, "uuid": "1a11f570-933a-492f-8776-4d93c9a09198", "comment": "Malware payload (Heodo)", "value": "499b28468bb07d2944ce90879df9748d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332762, "uuid": "86ab68e0-b481-4201-81d2-c017b1623200", "comment": "Malware payload (Heodo)", "value": "325b21b017f7a8c01ccd9cce9e361214b741abe624f06a29f18868b64ed2f815", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332762, "uuid": "6710148f-8a67-4c4f-98f0-82ce7de4a49c", "comment": "Malware payload (Heodo)", "value": "b5a377c83e92791aafbfe3dda904d68327268338", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332762, "uuid": "4e480a41-7f1d-4483-bc4e-9d5d5f94c3b3", "comment": "Malware payload (Heodo)", "value": "3b4ce4800f2b2c0195b27003814b5d09770c812b0189f3ae64e2f150905f19ab9e08019ff413e653779b2b9acbc9cf09", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332762, "uuid": "c65b42df-9dc8-4a8b-b13f-86e6a787ed9d", "value": "T17D13D02DC0A61E99C727283DD6149AF4124C1D4A86E0FA9F1D5463DC3B6A2FB074FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332762, "uuid": "823f216a-24f5-4578-bba0-bc17de5e1fc9", "value": "768:a8uomihd8DOevZCwtl5yKfcrND59V+L9Rw4eWrXcTqZ0VfvfSa:a8uom8eDDylND59V4jwmXc2CVfvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646332762, "uuid": "ef9f2657-dae6-49a5-8da9-ec1ae077f56d", "value": 41798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646332762, "uuid": "723991df-a94d-463f-9aba-8a9e90e0cc83", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332762, "uuid": "2a9da92e-ce7d-4e52-8125-14b750673dff", "value": "03032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764e47a1-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646294631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294631, "uuid": "2cf4d15c-e26c-4491-a55c-808c4139cadf", "comment": "Malware payload", "value": "22ee7d197cbab211c40caacafe6131b3", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294631, "uuid": "66e57d88-4024-43e9-ac2e-2bbb446d7e4b", "comment": "Malware payload", "value": "32915881a602a7031a4edaa16d7364869611da0fd6ef471faa27126447682708", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294631, "uuid": "244f2cf2-e831-4d24-8fbf-da9a698b6a27", "comment": "Malware payload", "value": "da6490cdc8ed54b932bd72fc2fe0decfe1d24ebf", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294631, "uuid": "d0877a22-3acc-40d3-8999-51c2a23f0a6c", "comment": "Malware payload", "value": "70b8d8e9e71599e11a0f7c9440e7c8d1501799bc784591d3a5480976766401d35902582dc0df523b9d8437a97ea79e4b", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294631, "uuid": "ac8c73e1-c5e6-433e-937a-e52d10122295", "value": "T1311412136F0AB31FE3A0A67C5E5ED08158E2FCAEDD1ED61A16AC33C442B4E1A01651E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294631, "uuid": "99340000-9d9e-439f-a621-a5ff8d294530", "value": "3072:sIxdpPkQdrkZjdxaFDw3Tf+FP0JQnM7ejGzNu+ZtTyLYR8nqO+tvKeTpCrH:PBkikpdx5L+Fcd8GZZ0LY8nqO8vh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294631, "uuid": "fa79851f-5b8d-4c24-b968-cc7a59417572", "value": 191272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294631, "uuid": "efa178eb-3d91-4c45-9f8d-753fa1e54299", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294631, "uuid": "52a88b4e-ee80-4208-bf96-7931e5ddf58e", "value": "NEW INQUIRY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df80796e-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300391, "uuid": "42a4d350-b04a-49ee-b642-8c4ed3c576c3", "comment": "Malware payload", "value": "6910577c3db31ed21d876e13dff98aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300391, "uuid": "747fe01a-4ee5-40c1-9ff6-e7f39c038f72", "comment": "Malware payload", "value": "32af7521317aba96668ce4494b4c1fb6add9732ac039ba5ad02a6389cdc2b68c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300391, "uuid": "182e2ab7-b85b-4722-b1a6-941c1ec2e211", "comment": "Malware payload", "value": "f320872c001b0fd3d65d7642bdf7121999b89b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300391, "uuid": "e7dd073d-4442-46a0-a194-4cb25a2aaebb", "comment": "Malware payload", "value": "bde577e4319a83f07aaff800c6acb3d3a4be821cd65601c74113387e80d5edd4784e3e76730a6660892650abebcffcd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300391, "uuid": "1dd2a744-175d-4a32-a26a-3e7e377e5a37", "value": "T13C7633D18127C3EAF06E8BB1AF410586DF7FCA1EC2551F58B6B4C18781CD88927792AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300391, "uuid": "c6e35d42-631f-4e72-90cb-2170e158f84a", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300391, "uuid": "e3808361-c03d-4639-973f-2373da096329", "value": "98304:NnS2fG2u59nRmBtTNWrApvfGoRZ4u9rOflBKo/+6zFX6vbyMm8quTaSppQ7BA567:I2T+Rg7pXGa5gl9W6EuMm8fGSfR567", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300391, "uuid": "044134df-22c8-4d0c-87ef-86f3b5770225", "value": 7125144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300391, "uuid": "0f76ba49-731c-459e-9039-203d2864f2d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300391, "uuid": "61ee097d-ea6b-4c10-835a-fcf6ebe36c4e", "value": "6910577c3db31ed21d876e13dff98aab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b4bbcf-9ae4-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646306493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306493, "uuid": "2f3a9bc5-8320-484c-9f3a-b754434aef3f", "comment": "Malware payload (RemcosRAT)", "value": "4a21c3f899f33ef1df71f802f04ee602", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306493, "uuid": "ceac39f8-f4a7-429f-b91c-4bf19a40e2f9", "comment": "Malware payload (RemcosRAT)", "value": "32b2815cdaadfdd47448673d44b03d480939162234234bf09e74aa8ab936755c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306493, "uuid": "40cd52b3-f5e4-441b-b0fc-8307a2c19aa2", "comment": "Malware payload (RemcosRAT)", "value": "459df0acbb9b0a35306773063e2bcd31ce37a24b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306493, "uuid": "3eb28677-e9cc-47bd-be59-d7eefcd4b3ba", "comment": "Malware payload (RemcosRAT)", "value": "9c2ba982f5e567ec097c9b563adb0856f001cdc521c0500871fc2018300c23563e3b9b5daf650fd202aabe196d2709e5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306493, "uuid": "b6b915e8-3788-4ee4-8377-267df9a416c9", "value": "T136D42334A5AF1DD7B522036689F01EF060BF235FC19AC887A43E926FE397AF50B15056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306493, "uuid": "c12cc259-f575-4c7d-8292-1d209f5dd9c6", "value": "12288:uKw/Z37O6/lJJonb0D7DmBSfTXM930Otv12iFcNXmsEGFd:0h3i2lJ+i8WLM935J12iFcNXQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646306493, "uuid": "fd79b1af-4009-495c-8858-252dd1a1ce5d", "value": 631922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646306493, "uuid": "0ab5ba08-6c51-404c-842b-102ea195f0be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306493, "uuid": "c9049a13-4b15-4e95-923d-b2ff536da6a8", "value": "SUCT220002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f418efb3-9ab2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646285393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285393, "uuid": "79b4f811-13c2-4b5d-8c68-2375ad208a7f", "comment": "Malware payload", "value": "202f7b711ef64efb46ec1157d5ce82bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285393, "uuid": "38c4066a-6085-4749-8aab-a940f73a4bfd", "comment": "Malware payload", "value": "32c49417f75eef39fd3a6c49236c02b7d11b8474b9184d4ca42c8313a70cb895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285393, "uuid": "827727d3-4f6d-40bc-a07c-f53bedb5d600", "comment": "Malware payload", "value": "b8a45d68ed47d290173f445ca3757fb6021486ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285393, "uuid": "9f50d26a-59a1-4b09-8c26-cb244c30ea92", "comment": "Malware payload", "value": "e348f0d429d696659da7b73cfb94e6c3d22427b2a7c1c05cb4fd7aaf54cb557b8349adfc1eef5b5ffb1e467f9374163a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285393, "uuid": "1f49f80a-71e0-4e5d-87c3-31b9f1e0dcca", "value": "T136A5F23AF6D08437D1236E7CCC5BA794A834BEE02D24508A7BE91D4D9F39B9125263D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285393, "uuid": "ebdf494b-3be7-49f2-868a-9050d65f741f", "value": "8d08b9aff260461badc1821f4f717247", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285393, "uuid": "ca44f9a9-81e8-47f3-b2c1-1e38bace9a5c", "value": "49152:YjuIGEXJLIjuIGEXJLrduEyztsR7OQzQzAml:YKILiKILdd/yzt67OUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646285393, "uuid": "a348a45f-1189-4a4b-8843-8cc097a0cff6", "value": 2079232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646285393, "uuid": "3d26d59a-cac3-40a9-8b1e-91a9e521b5c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285393, "uuid": "2a36718f-d7e4-4e70-bcca-5f7a670920ba", "value": "mbrlock.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b27b8a-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646296858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296858, "uuid": "8f7eb963-548f-4e13-bf83-5ef506ffb7dc", "comment": "Malware payload (RedLineStealer)", "value": "48a8e047774777d632c34536f90b8309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296858, "uuid": "d0f923b5-4399-46b0-9eec-01652dfc70ba", "comment": "Malware payload (RedLineStealer)", "value": "32d911dad50f9953ea5d795265806991a386dd4a693cd87b1f741739c1df0ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296858, "uuid": "4df31af4-a4ac-40c7-8426-7f8e4acef68d", "comment": "Malware payload (RedLineStealer)", "value": "09556b7f00f924cc502589ebb8cf607f0e40867e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296858, "uuid": "125c06b8-54a5-4081-9622-b1fe501c42c1", "comment": "Malware payload (RedLineStealer)", "value": "baefb959422e3bca88fb58dc7a7f15e2c17aacca8ea7fd56d63c2361fe7a54a9506b29fbf29a6b0e90d31cab914af6aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296858, "uuid": "c35dc9a0-cd1c-4253-9dab-5ea94c18e6fa", "value": "T1AC0470D06F89CB30E3A90AF05864C194C6B4BD0E7BF3967A5BC920D51A27F40953D6AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296858, "uuid": "f0694f27-8082-47eb-af56-8b6ec0aee57b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296858, "uuid": "2f1b9017-60e6-4188-8376-24e08ede3105", "value": "3072:rucUJy9CfYp07VOtfyxGGzrXv3+JCaTees6KOHbcHg0qDnDuk:rucMq0HfuQHXOHbcHg0qDnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296858, "uuid": "1da7f3a6-4e9d-4624-b74c-4347f8cbeb05", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296858, "uuid": "bc3c7aa8-7104-4e7e-98a7-d86a79c50787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296858, "uuid": "015a6990-5e9d-416b-8ee8-fe28ea63735e", "value": "48a8e047774777d632c34536f90b8309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0616121b-9aa2-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646278121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278121, "uuid": "b3aa426c-7edd-4d82-9c2e-5cd877d40e5a", "comment": "Malware payload (ArkeiStealer)", "value": "6cd2a1ef915859f2e6cfaddfcc876c98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278121, "uuid": "545f3457-a3ff-45d3-9731-332f468678ea", "comment": "Malware payload (ArkeiStealer)", "value": "33ac0ea43c425209053f9360bd243e68deca0eb5cb4e638c6da557eb36f78935", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278121, "uuid": "b59fde00-bd56-46e7-95ae-2fb9fbcc27bc", "comment": "Malware payload (ArkeiStealer)", "value": "9c8975025e9553c08546695b98e8b6987251def2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278121, "uuid": "e0a051e5-9263-4f5a-a412-385605b97e2a", "comment": "Malware payload (ArkeiStealer)", "value": "5998ffe539015a9580ce82d9c51e7efd498c8399215d069176eaa16ac318780ee7ccb2c353021a65e647e73a1ff1b2bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278121, "uuid": "b6ebc9ed-6267-4677-a57e-a3811d84a54d", "value": "T103D412257F90C032C1A678309061E7B52F77F822D6A59A47F760675E0F392D2637A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278121, "uuid": "6cf4fa85-b37e-4ae2-85af-8eb9fa89aae6", "value": "0623e16f7ad169cff85e84a96d4a7da6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278121, "uuid": "a515ba30-a996-4c45-87dc-4c20a4a7009e", "value": "6144:gDLQupIxDnW3V/4L9gdaTZHxpx6J09e3W2mHcvG4IE/zyCKzbotyqJ5f5:gD0upIxbNPTZDxW0L7E7yCKXotyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646278121, "uuid": "bc1a6a61-91ce-4cac-8e4f-92894adfa1c7", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646278121, "uuid": "f0a4a600-5e65-4210-8443-3307b8672161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278121, "uuid": "1c4f7411-82d8-4b29-89a2-da3855831656", "value": "6cd2a1ef915859f2e6cfaddfcc876c98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8edf314-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646300433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300433, "uuid": "bdd37211-93ae-4265-bd86-67e6384e367b", "comment": "Malware payload (Smoke Loader)", "value": "77588bced8464a010cd5a4c2a9b9bf3c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300433, "uuid": "34328111-0967-4fad-9a61-b601ca236fd6", "comment": "Malware payload (Smoke Loader)", "value": "364cff281907f2f5048a111b2ae9a412839fdba5ab8a72231550f77c402e355c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300433, "uuid": "409e3a70-c890-4fa2-8888-3dc9e08ff918", "comment": "Malware payload (Smoke Loader)", "value": "7fb2936fdda62ebfeba8ec40714f64b2aa47f66c", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300433, "uuid": "dcee6e0c-4be1-4fed-a010-ad88dcb59ee9", "comment": "Malware payload (Smoke Loader)", "value": "04b5e975e3d9a75d2676ad8af1f9748eafe09d6e5d1275a4916881d102cd04632ace02d7443efa523e8375b11080ce4e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300433, "uuid": "3f2d23e5-9c64-472d-9096-6d5b645905d0", "value": "T12504AF1031E5C032D5A716364470C7F45EBBB8A62A326A8FBFC52BBD5F256E1973430A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300433, "uuid": "5737afe0-4dd9-48af-a1d1-00814f638dc8", "value": "fdc337a25282d3662375292d95cfcd8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300433, "uuid": "987dca95-c88d-470b-a495-bfd7adf56019", "value": "3072:idK8LWz5xCJisN5g4JboP6N7SuABmO4pX7/LTnRmCtJ3:OK8L4y+4JsP67ABmTpXfT3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300433, "uuid": "3d0296b7-3ba0-4399-8039-db9b4b6794dd", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300433, "uuid": "72c1aa21-e6e1-4e23-82dc-9c034c53bb9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300433, "uuid": "bd72fe61-1206-409e-9993-0d956b00ad7f", "value": "77588bced8464a010cd5a4c2a9b9bf3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405c6463-9acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295829, "uuid": "5310431c-2e38-4b11-bb1f-ebb35a3bb722", "comment": "Malware payload (Heodo)", "value": "9d4e4a4ea03d007d47f3a37e6f03a34c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295829, "uuid": "3b856c7d-c489-46d9-91f5-9033b5d851e0", "comment": "Malware payload (Heodo)", "value": "3705fdfa24572abfa8edf8f40b6028aaa49013c646ba8e12ce736dd91975222d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295829, "uuid": "abd4e3e5-4e20-419f-936e-3ff9722a5fb0", "comment": "Malware payload (Heodo)", "value": "f1fd9fc527ebff756c96d71e02d5642d69c7933f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295829, "uuid": "c3403eba-7f8f-41bc-8afe-6f60b9f07ca8", "comment": "Malware payload (Heodo)", "value": "574a37f4764a8057046e59b3cc9f6efed21ba20d4d9d40c384cabbbdf31bc6bb937be2be65f2142c62bd69b5435c986a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295829, "uuid": "68bbc3a2-725c-4df8-910f-c29ce0531332", "value": "T196D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295829, "uuid": "56024ca6-9a71-4b17-9665-2ff32377c9a6", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295829, "uuid": "4e71eb11-08ef-46c0-aa05-14d38dbe005c", "value": "12288:ZxpNJJJ2NHPoczJ1OtIhxf3foRXIa5EPwvA:Zx2gczJ1Ff3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295829, "uuid": "47e9a304-32fa-4fa3-bb32-4217055db49c", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295829, "uuid": "fabbaa10-f82b-49bd-b822-5b345c8a0a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295829, "uuid": "86ca82a7-5c4a-41a9-b838-a3cba8dcb89f", "value": "9d4e4a4ea03d007d47f3a37e6f03a34c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3c8d87-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646298853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298853, "uuid": "2dd48b21-75e3-49fd-ae18-7e0f55d1cda0", "comment": "Malware payload (Formbook)", "value": "49b7566e2e342441624658966708f024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298853, "uuid": "e841fefe-bdac-4e2d-84b0-4b01332bafa7", "comment": "Malware payload (Formbook)", "value": "373d39a41fed9b2661abb060a3f6c74d9cb7dd892da0c7742453d84fbc3e924f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298853, "uuid": "dfedd2a0-b9e0-46f5-810c-34a2864e70dc", "comment": "Malware payload (Formbook)", "value": "6e34f485538ee1e47aa1e5ad1fc3d06c8c5a388c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298853, "uuid": "9b244b00-04d3-4ed7-bc8e-cefe20f3e0e8", "comment": "Malware payload (Formbook)", "value": "a6b028503aa23f5f37434fd58640df42a97a0aca0289ca7fd00ea8d1a127eaff40e4cfe6fda442613898b14af11fc85c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298853, "uuid": "5ca02ba5-7fc8-4822-b74a-0957cb5f77c1", "value": "T16564132F9B82DA5BFA070B3454BA6338DFBEC7DC15014D9B47B96EEE5D127710818222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298853, "uuid": "23bdbb48-be7b-44dd-8b77-a3720d8d3654", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298853, "uuid": "04392535-27bd-4c70-b397-f2a8673b18dc", "value": "6144:rGi8+EaoklAq3uH0YiDFfLVh/hhmIIFnRlaoA7bBZEn:5lAKZLVhpk9RsnEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298853, "uuid": "111f2522-a93b-49cd-bb1e-3d56063ce80e", "value": 317548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298853, "uuid": "f5e27736-8c95-43e6-9096-a2c38ebd1153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298853, "uuid": "78a9c33a-e093-4ee1-9c85-896a9c0ad263", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36687ae6-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "80e94aa1-8740-447d-859c-04c15a13ad62", "comment": "Malware payload (Heodo)", "value": "64f48322a77fff8a632e056793607c6c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "7ef30516-29bc-4f2b-bbd1-6b40b131dfbb", "comment": "Malware payload (Heodo)", "value": "377d02c878dafd06843e9cfca7421dbb3cab69d475e444848364fe11c1aa98cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "35861ed5-f5cb-405a-a08a-add0e52500df", "comment": "Malware payload (Heodo)", "value": "090280762ed216ff566093afb10482f3edcd8192", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "df916c99-6b17-4e13-80a3-d2007f18961b", "comment": "Malware payload (Heodo)", "value": "956c6faf2a2c9114c58fcd72ece1e752c5a87a44701eea02a2f9d0a39f09ed82395db0e84ba0aae89c49595172752514", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "630811cd-6984-4690-a345-6ad84467ca47", "value": "T148353942BA48C5BDF04E08B9181EAA69667E1C447B3296D7338C7FDDBB319F90832517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "fdbe7e8c-ae44-48f3-b78a-8d01d64590c4", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "f655c11d-c32a-4810-86ac-7cda97506462", "value": "12288:C4rjnpAeev7HmOsVUCfbWierRcDFtLlirkfQcsMEPe6MpPfXxiDjM+R:5rjpAbv7HmOsiR1cDFXiQf1sUPv4DjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298818, "uuid": "3e8e2634-4769-4f60-ae7a-6353d552d0d2", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298818, "uuid": "18fb90d1-a79e-4a2d-9b9f-98dde8f554b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "85b3f201-809f-4947-a429-e16b1e98ec8a", "value": "emotet_exe_e4_377d02c878dafd06843e9cfca7421dbb3cab69d475e444848364fe11c1aa98cf_2022-03-03__091333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2f1690-9acf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646297858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297858, "uuid": "eac96014-8d05-4ea5-af88-aabfd9a22d4a", "comment": "Malware payload", "value": "2706cb24ae7e523580044a8bb4448d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297858, "uuid": "53638708-2fbe-4b69-8e6b-7c71e61f649e", "comment": "Malware payload", "value": "377e1d877dff96cc006241c8cb7e38e25eb25ceae12c4b7a51bdc0ca56910237", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297858, "uuid": "9dac2929-5a6a-4140-ad41-5c76db983974", "comment": "Malware payload", "value": "f2df57e6f1d271dc3e41d8762c2f34b62b933ffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297858, "uuid": "33c64639-9399-4a87-a432-15e21f7b7525", "comment": "Malware payload", "value": "3085e0bb805e29e7792da703fa346129ac24876f8f264180ff1eefbbbffcdf79ec256dd43ad23f370bb778c3345d7263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297858, "uuid": "6d18fe45-7100-4727-80e2-2010d7d18dd5", "value": "T1302633657760EE06CA5EEB7C12CA9F16830FED20A243BC5749E9F571B1848DE38912D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297858, "uuid": "34756e9c-6118-4a64-821a-bedee6a587ea", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297858, "uuid": "ff41b11c-a9ee-4ab6-89df-990bf18ef70b", "value": "98304:L51p+nQu2l7qNYzhNnby7oaUJYjRG3QKZyyO8lRU1ZEchX1Tr:rknQugqmDG7TUJ+k3O9eI1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297858, "uuid": "aebec497-5f67-43cb-a9d6-7f64922ee38d", "value": 4540416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297858, "uuid": "7ad3ca6f-b385-46ac-acb8-887b18f2dcf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297858, "uuid": "1a472b50-4e8e-494f-9a88-e549982f0a28", "value": "2706cb24ae7e523580044a8bb4448d73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b38b1c-9ac2-11ec-9275-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1646292111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292111, "uuid": "c863ee94-d895-43b1-8249-8cfbc8ab08e6", "comment": "Malware payload (Stop)", "value": "64671d1076995eba854718f19035bb6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292111, "uuid": "1db9081f-5a2a-4532-baa7-7bc472bcf3cb", "comment": "Malware payload (Stop)", "value": "37c73441b4721b0231c8794d6d4fde63de828dbf59c18f64a52c7fc2e456fa80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292111, "uuid": "d78042b0-926b-46ad-9189-460a895fba07", "comment": "Malware payload (Stop)", "value": "cba4fa9c564afb91c90cfbb4c1fab5fdf48bf427", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292111, "uuid": "c44770f5-581a-40f9-9a4c-b3219c5cd0cc", "comment": "Malware payload (Stop)", "value": "6083af3790513bcd29d50881b3f7572dbde0d48a01fa21a1c72093157d213720d753dd046a77f5905c9d055b92134198", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292111, "uuid": "e8d9af19-8f6d-4435-a5e7-f154ce8ee3d7", "value": "T18BF422827410DC76C44690B190A4CAE9EBEEFC135564DD837B68BB2E0F313E1E676789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292111, "uuid": "372612ee-363b-4e82-a391-43d725d102a7", "value": "228816d69bd3a411b4d5428ddd50c94c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292111, "uuid": "078af9e5-15a0-497b-af8b-45b371ecd049", "value": "12288:54xIlqBc3GGdzvWGiHI6MH8OKUUHIDH9UwRN4A0yS20r7kH8+IZcdAq/J+U4:5puk7aGEESo9UoNkyK3+ugJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646292111, "uuid": "fbc6ddf7-96dc-4674-ae3f-d47ba941530d", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646292111, "uuid": "18d35eb4-89a0-4d1c-89bd-6667ccbfe2b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292111, "uuid": "bab782ed-baf4-4fe7-a5b4-8402976714eb", "value": "64671d1076995eba854718f19035bb6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c759f1-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646320990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320990, "uuid": "96dc824c-aeeb-4f30-918e-f83f7ee1110c", "comment": "Malware payload", "value": "bd19f2a587f9bc4ad7981a29d0e80ad1", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320990, "uuid": "7e5dc817-f749-4349-b28f-12034082523c", "comment": "Malware payload", "value": "380bddc09c0d0617592963ac360ab5000d44b52e4cc6dc8133985f39321ecbdd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320990, "uuid": "d10aa07f-7489-4184-872c-b783355df390", "comment": "Malware payload", "value": "b1c571cdbf32c05c35738b81b2d26f2b41c73b97", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320990, "uuid": "600756d7-0949-4e8c-81fc-16b9a560e078", "comment": "Malware payload", "value": "830ca6788aaeb080d438a23252d4c6dfae7c152171b9436092df5c701dbbc04cdb4e1169b1eda8098bd45ef24a0998ad", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320990, "uuid": "fd86c206-f26a-469b-962b-29570890fd51", "value": "T14B23F2FCEDE93EA8CA34023ED21D08B544D938047837578E651AB66D03D1BE32BBB115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320990, "uuid": "2df664cb-1180-4427-88aa-872eca39bb4c", "value": "768:6Z+8xOIujIke8b5gLGlWDjH+uvAdwqX705RSAMt+2vfwc2fb5GIvROxQg7LrFyyE:CAIu8h8Rlqje4AXmVcRoccb5GHxpL5yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320990, "uuid": "9f88ddd7-3146-4901-a921-5a9303ad6f3e", "value": 48065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320990, "uuid": "80942b38-1d89-4a5a-affa-1b81538b630e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320990, "uuid": "4290381b-949b-454c-b461-cbed693287ff", "value": "Midtown Rent Roll 3.1.2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1879e7-9b44-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646347843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646347843, "uuid": "d5ef2ada-d23c-499c-b23a-86e74eb2f553", "comment": "Malware payload", "value": "ddba2a174995beb25b63c37446e9ba84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646347843, "uuid": "3d2c25c7-c37b-4774-bec4-9c807273203d", "comment": "Malware payload", "value": "38397ae587fdfb870f68796ef12c271f6e7c492dfa9f1751324aef64586b9983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646347843, "uuid": "f7f5ad65-8015-4dca-9c7f-760873a6ecee", "comment": "Malware payload", "value": "e46f566bf27a400b2afeb7d1ba4a955856fc6256", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646347843, "uuid": "37f553d1-fa1a-4288-a623-d2dd90d4f2d2", "comment": "Malware payload", "value": "445662e86ba5cb031697ce1dd48411f723432c3872342e7b545551833781f8aa7acae0eb2d938bcb061be2c3f4a8618b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646347843, "uuid": "1e254c46-2f0d-4737-bee5-ee70b1fe0595", "value": "T121830AB36A04D0C9DD5897B892DE5E610AF36F6F08D082D0B0DDB1BBCB3B65468EE504", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646347843, "uuid": "5ce3678c-c366-48c2-81ff-72372835da8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646347843, "uuid": "95df855b-209c-4e53-b04e-4091c641403d", "value": "768:E5p/tmn//Pz11PcQytKs9ESD4NeGB/Gl5nqkQj4xQz7Jj:YpVmn//Pz7Zs9L6eGB/GlFqkQkxQz7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646347843, "uuid": "fdc8f39c-8409-474a-b9bb-6bcfcf9c7346", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646347843, "uuid": "c3b235bf-7462-49ff-95d5-cce266377a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646347843, "uuid": "c73575e2-8a0d-448c-a41b-8e70496cf73b", "value": "https___radio-hit.ro_FEB2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8f08bb-9add-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646303585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303585, "uuid": "64f2c5de-983d-4eb5-8124-7cbaaf6f5f63", "comment": "Malware payload (Formbook)", "value": "bb923d7bf89149cbea7ce08ee333babc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303585, "uuid": "96759c2e-755a-416e-8395-e9156f7d9a81", "comment": "Malware payload (Formbook)", "value": "38444024682d6ea391135d374ecd6f457bb01df512801e25fcbd2931afe58d92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303585, "uuid": "ed8637ac-d570-4bda-93bf-b549601d7aa9", "comment": "Malware payload (Formbook)", "value": "33bef4380d7473182f706546fcff7effddda9bc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303585, "uuid": "369a873a-5729-4b68-9bfa-6c58008d7465", "comment": "Malware payload (Formbook)", "value": "d1156f7ed3c62202c800f8bdb5de3b43c31272d0d41f41f3bc7da994aef0f02329113d6cbcc8eb448b21561e269169ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303585, "uuid": "92b25ee1-b116-4d8c-8c8d-650afc324e7a", "value": "T1A184F19D1BC38366D954577A84F737442F10CC97947A8B2BC4B229562CB33EABEC09E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303585, "uuid": "92435d5d-ad54-4ea6-9d0e-5ebf22ba9f8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303585, "uuid": "01d98627-ad24-4a93-b683-e7d7ee7c239e", "value": "6144:qbUpdP1sMfedkBA9JiF5BSLRxCyDsB7pnPsMsHVVzqn7NWppOrMNKaR5n0EFkcd:ldPDfem2KFOLRoh75PsH00Fln7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646303585, "uuid": "99f6e5fc-3b95-4abe-81d3-ade2e8c13a94", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646303585, "uuid": "888ffe72-c9b9-46cb-8b83-f8bcf0c7eb7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303585, "uuid": "4bcdb8b2-3406-41b6-8432-d4f946d52182", "value": "bb923d7bf89149cbea7ce08ee333babc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dda5eb-9b47-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349127, "uuid": "a077713d-3960-45c6-9113-a8663b73c21c", "comment": "Malware payload (Heodo)", "value": "d6dc6e58ae256d967c4df5c5fbe4ceaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349127, "uuid": "8c770ebe-e1f0-453d-b840-184943f80493", "comment": "Malware payload (Heodo)", "value": "3906f66890f5c356160ffbdcf48a11eb43fa10d7723e985aa5fc5b2fe8d1c81e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349127, "uuid": "960b0183-67df-45f0-ac52-0503f4690ea2", "comment": "Malware payload (Heodo)", "value": "8ed6aef7e228cb5e1d7695c289e31eabe87a0e5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349127, "uuid": "9c6a26ec-8e88-4c32-9bb3-a75ffe5336a6", "comment": "Malware payload (Heodo)", "value": "aee386ffb4ee1ebbd9bc43b6b48fe9f18e0434343ab93da6e43cbfc6e4d764f425cac839af7251276aeacc49921e8aad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349127, "uuid": "8eb4c7fe-ca05-4274-9e42-c71e9fe176d3", "value": "T188D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349127, "uuid": "084e9717-42cb-4d30-bbec-3c31278e7328", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349127, "uuid": "20ef74fa-8fd7-47b1-bc71-6c4c8889e67c", "value": "12288:J1U8sNY8/z0rYebzwdJCoGEAbcVBLku8w:oq6z0rYcMdJVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349127, "uuid": "64259dce-47db-43a3-baf2-95f4c90c10e7", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349127, "uuid": "220b9114-2288-41f4-b18c-a9d4b628bafa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349127, "uuid": "2ff981ec-d02d-4ae8-92c1-9cea7afbf787", "value": "d6dc6e58ae256d967c4df5c5fbe4ceaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67426e57-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298041, "uuid": "d412164e-580a-4993-b5c6-dd90a6ae13f4", "comment": "Malware payload", "value": "155f40398681245e1dfdab63d846127a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298041, "uuid": "6ac05dd9-c601-4baa-860b-371291aa0919", "comment": "Malware payload", "value": "39233ad29392ccae0a5f1a13569d11baf3b942b57dd01de2ec15288beb8ec02c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298041, "uuid": "f8f15c46-221e-43bc-842b-dfcca021fde3", "comment": "Malware payload", "value": "f15189ca8223fbc728adbe9ff8c66ccec435a3d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298041, "uuid": "8ab7ef05-0533-42e4-b02f-7e830e0e5938", "comment": "Malware payload", "value": "532779d09ac50d07cb3bb4f8bdbb6c21be059e0815e88f1fbbb457036f4e108c9db51c052500119388cad726a7282b12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298041, "uuid": "75025177-55eb-423c-8320-c1602155fc84", "value": "T14C840191E3F581F3EAE2093202F5E12BA939635A5710DCC7E34D78415E81BD5AB742F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298041, "uuid": "4b6268c2-d9fd-4b39-a376-13a532569f3d", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298041, "uuid": "125ebb2b-6004-4b65-957f-9b1388e7b71f", "value": "6144:ezBkLL2NTB2H0TsrOTV7TX5vzp19b4mSlJWbmm1ltW70yY3SzNyxerVvdjKsQ5bl:eKyNTQK7TpvV19b470mstW7ZYMTvdTWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298041, "uuid": "f78856d3-f176-462a-ac05-8838fb21e51a", "value": 379800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298041, "uuid": "2d3c2c8e-dcd6-4c9b-b18b-01cec3c863fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298041, "uuid": "04dcc134-6770-48ee-9193-6838e4ff28fa", "value": "155f40398681245e1dfdab63d846127a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5171424-9af7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646314895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314895, "uuid": "379243ec-862b-43fb-9c7d-370db8a5bfc6", "comment": "Malware payload", "value": "0a16ab4574d59fca2cf639045710998a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314895, "uuid": "cd800580-2c23-4d09-a129-bf41923b8cc4", "comment": "Malware payload", "value": "3aa5adaee52ced8e47e5a6d6d8c47c97677d8a14a6f851cc70f932785465d879", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314895, "uuid": "ca45c081-92d7-4b06-b696-1748c2b2f5ac", "comment": "Malware payload", "value": "6b10b02e3bf4e07e8c8baae84b22a1b5a163ab04", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314895, "uuid": "d5f5218b-c3a4-4c4c-b306-3e565950caaa", "comment": "Malware payload", "value": "633169d248e148b1fe6e57f897615cd32aec6460c0b5bd81b42fc9e7e94c1c94c91a33524f266448e5c5d05bea45ee37", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314895, "uuid": "3b7c2007-c591-409a-8119-849dada693bd", "value": "T182C1DE0A749A43467153012C34A76F5F665534237EF198AC0213B984CF486EDFEF6BAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314895, "uuid": "da0fef84-c379-4464-ba6f-f605e46c1f80", "value": "96:XutZuIi+zi0yX+SgV0UaNb5mWRSfuvlKrhxvX/BwSaEoztvZlVz:XubuIBm0yOFg0xp/mSAtD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646314895, "uuid": "fbe3618b-ce82-4793-81c9-e2fcd9f67847", "value": 5663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646314895, "uuid": "5c4994dc-37d6-46e5-907b-6bb5eb4dd03d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314895, "uuid": "1ab1856a-b8a8-4c32-a55a-04e72cdb3a7d", "value": "3aa5adaee52ced8e47e5a6d6d8c47c97677d8a14a6f851cc70f932785465d879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35f7de5-9ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646293955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293955, "uuid": "2902ba00-8140-4a55-af86-dd3cf53346e8", "comment": "Malware payload (SnakeKeylogger)", "value": "92832838220543f46e8d675642a9de26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293955, "uuid": "9bbffd0e-5dfc-4edc-92d5-c35f9ad4f4cb", "comment": "Malware payload (SnakeKeylogger)", "value": "3ae224c94e8887513a9d90b432825eb35718a013107685e181d274cc5fdaf82b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293955, "uuid": "4b5d48ee-3f67-48a0-a866-4966a1808aa8", "comment": "Malware payload (SnakeKeylogger)", "value": "7d3a8fdc773ec575b529f2bfb395140798eb1c57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293955, "uuid": "99f46d08-7ff9-4d12-a7e6-1fe754d5ac73", "comment": "Malware payload (SnakeKeylogger)", "value": "79f2d1d182916f851dab063c1b891cd6486f7b1e3562dd1230eb1945269c20fb3a2fd02097b5dc1b5d09f9a293211c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293955, "uuid": "b49d10b7-4ca7-494a-9bff-87b28c2f4545", "value": "T1B7A533608F46E87CF8290DF98DF2464C0D58F64A741F9D9F2051789FE4A922A2F5E06B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293955, "uuid": "690d28f6-b03c-43b2-ba30-96613f63aca4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293955, "uuid": "4b019ec5-efba-499a-9836-de1eab33309f", "value": "49152:i0EhMdxOKcG2vr6nGvya4rCRVO/doY7WseYz5RR5gcH:ihyUdzj5VO/doY6Pc5T5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646293955, "uuid": "3f57de9d-eddc-4d77-9f7d-440294d6b50f", "value": 2110976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646293955, "uuid": "123d5a60-41db-4e95-b8d0-f164cb5313f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293955, "uuid": "d789fac4-bff6-42bc-a64d-f024518b2990", "value": "29876543234567890987654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eccf5cd-9b37-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646342292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "4a4e5765-4cee-45cc-869e-26cde2e496a9", "comment": "Malware payload (Heodo)", "value": "bc5b991823ce995baf1e3f32c348fa82", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "6ddb50ed-1622-4ce0-84f9-cb20bfbeb630", "comment": "Malware payload (Heodo)", "value": "3aec2224a1eb3b01e995b494b45565f91713ddbfa4454927d199999a26a59f5f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "934b3343-03c0-4ca9-9dd0-b26981125e27", "comment": "Malware payload (Heodo)", "value": "749292852bda4dc47ed95904aa6384df84006603", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "1ea949ec-b3a4-45d3-8920-d35a8f2329be", "comment": "Malware payload (Heodo)", "value": "c89ff822150222048091ccf9bf5daa42fcf9c1c9a5f5ce976d79809df877720269e051460614f3445da12f302ccf7bc2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "923a14c0-d2bf-4860-b0e0-893a51109087", "value": "T19ED45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "3a9b9fcd-58b6-41c1-889f-19cc7109b485", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "6fc0aab0-4764-4e50-85ad-b011c767f425", "value": "12288:J1U8sNY8/z0rYebzwdICoGEAbcVBLku8w:oq6z0rYcMdIVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646342292, "uuid": "6c2366d0-dfac-45ed-a28f-579e062374cf", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646342292, "uuid": "36b49980-02c3-44bf-9547-61872479bf19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "97d9df25-746d-452a-94fe-60c1a2960d83", "value": "emotet_exe_e5_3aec2224a1eb3b01e995b494b45565f91713ddbfa4454927d199999a26a59f5f_2022-03-03__211805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abd7e17-9b1a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646329696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329696, "uuid": "ab5cead0-b9c5-4d2a-969f-4f65500d313c", "comment": "Malware payload", "value": "959850cdd738ca33d4731d275e4237f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329696, "uuid": "79b88427-6455-4bf2-b411-515f0ef3771b", "comment": "Malware payload", "value": "3b2045efa4d24677089ffe5c74bfd774d6e9e4c0d31fe1e96ddd978348213881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329696, "uuid": "c57b7a59-9660-4aed-8042-371fed1671e8", "comment": "Malware payload", "value": "4994e10487a0cb771bfd51fdd0387d2924ba5854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329696, "uuid": "b36651df-9931-460b-aacf-b3cdd2f9d760", "comment": "Malware payload", "value": "90cc93beee74fe90bb16b1a9698a3a2a99d2d21e387f8146abdce01ea1ee0deda7a36dc85c792c4dd046e8f695411092", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329696, "uuid": "04204b25-af1d-42ae-be26-d6ec341940d1", "value": "T1F7E2E1BDF5F1F906DE5E6C74FFAE17628381B0C02786034A47A4DE90BEB5C4682490E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329696, "uuid": "41b94bba-122a-467f-90ef-38d38155df56", "value": "768:/dQM727s0rdd9vM2aivyoFVWrifbpRhOrj2/KWn:/dQ227Nd7vMMlfbpfOrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329696, "uuid": "860ea8a6-e114-4680-bea3-ae5b59e1b61e", "value": 34157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329696, "uuid": "dc895652-660a-4e30-9056-9b3cd7bd2b08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329696, "uuid": "122f3886-7fa8-42cb-ab71-4166261b9253", "value": "tty0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3635d25d-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "2e3b6877-cf12-4609-a30d-28f52d172412", "comment": "Malware payload (Heodo)", "value": "78955b6b482240b1044c94577c5c7122", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "2ebf811d-daa5-4749-842d-46197b1d788b", "comment": "Malware payload (Heodo)", "value": "3b2f668f720f7baf056f7b990809184cc0abd97fd4637659a5b9ce858f3a45c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "c09df4b3-dc26-4031-b543-5021f6f30e0c", "comment": "Malware payload (Heodo)", "value": "30ea4cb845689c3a139a38f35d15f37dd8f5d1ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "d1988341-eca6-40c0-ad62-41f2ea501c8b", "comment": "Malware payload (Heodo)", "value": "48dc8114057a580d1082ac89db63b3112c1afa153611aa12f6cd8b8f08c1bb400864d67693c36c0056d069dedf712228", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "f169c508-d291-4564-a9f5-b3b559937dde", "value": "T1EF353942BA48C5BDF04E08B9181EAA69667E1C447B3296D7338C7FDDBB319F90832517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "786d10f1-2980-4e48-bbbd-1a2a004059b4", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "d4b4dba7-9a20-410a-97d0-ef4526140c80", "value": "12288:C4rjnpAeev7HmOsVUCfbWierRcDFtLlirkfXcsMEPe6MpPfXxiDjM+R:5rjpAbv7HmOsiR1cDFXiQfMsUPv4DjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298818, "uuid": "ad300ba0-b1d1-4388-8399-e1f5206660d9", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298818, "uuid": "3bb732f0-fb0b-415e-a098-a4ab9ea5ac37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "7dc18305-ba20-401b-b9dc-a80e2e60803c", "value": "emotet_exe_e4_3b2f668f720f7baf056f7b990809184cc0abd97fd4637659a5b9ce858f3a45c4_2022-03-03__091333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f41c61-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646300101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300101, "uuid": "13d6f869-6ea0-499c-83b7-5bfc6b23992e", "comment": "Malware payload (Loki)", "value": "c2884b3137960df3c5e16b8ce9d01976", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300101, "uuid": "ed6e6763-ac87-409e-a993-68a81ab8dc4a", "comment": "Malware payload (Loki)", "value": "3b57b16d03a9e87089f756a8b35969d39b2f8191e75847c8dc087057901568b6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300101, "uuid": "d66b5e74-a0e6-491e-9d1d-dd0b59d14b31", "comment": "Malware payload (Loki)", "value": "af063cc1d33e976af963c29cc70d715e39705794", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300101, "uuid": "82a8146e-245f-4940-87f6-aa2f15f5e92b", "comment": "Malware payload (Loki)", "value": "308b1ce2dca3322121c121d8d5a73983149c1d06f59b0c3016115b1ed4c385519c0a4b3d84e908eb3274740034c9962d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300101, "uuid": "6a9936d4-66d6-4d35-b72e-70763297f4ac", "value": "T1C5141232E34DC2E5F6D8C77044AD78A3B876DC119F50B99FAD6C713A1ABB1583EA0580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300101, "uuid": "2f2115b7-5221-41a3-96ae-324cbb5047c1", "value": "3072:+rfw5vZOwBuOvbXgwXZjxWQ5as5bBMH2ITX524V9RQ9tRAgJm/8z17yWLz6LZbJv:EfwFTBtjhjR5as5VMH1tT9OLRJJX4Lrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300101, "uuid": "8af647b3-50ff-42aa-afda-6d6915de56b8", "value": 191000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300101, "uuid": "9a1eb63f-0940-42d5-b57b-cfac292785a2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300101, "uuid": "de393d6a-028b-4438-8dc5-5ebfd236a14b", "value": "\u0417\u0410\u0425\u0422\u0415\u0412 \u0417\u0410 \u041f\u041e\u041d\u0423\u0414\u0410 03-03-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88b5183-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (MimiKatz)", "timestamp": 1646294312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294312, "uuid": "d4e8284e-3ee5-4a8d-b9c1-74194ca8f794", "comment": "Malware payload (MimiKatz)", "value": "7108b0d4021af4c41de2c223319cd4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294312, "uuid": "8a1d2ee2-4c50-4f35-8579-bcb61cebecb4", "comment": "Malware payload (MimiKatz)", "value": "3ca5d47d076e99c312578ef6499e1fa7b9db88551cfc0f138da11105aca7c5e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294312, "uuid": "b4ed7e4d-0702-4a0a-b573-a43aa37c9708", "comment": "Malware payload (MimiKatz)", "value": "e6966e360038be3b9d8c9b2582eba4e263796084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294312, "uuid": "d326cd65-b475-4825-8db4-a57173a9a7ec", "comment": "Malware payload (MimiKatz)", "value": "265fd27dece0e8347b3af2b4ad34e7881391d36cdb277f82f476f43f4189a6bd7f0577ae8e6fed29d64e03dc280685fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294312, "uuid": "06d4fea2-0257-453a-9836-eea9430b972c", "value": "T16CF2F853A7E55498F1BB49B9DDF9C016ABB2BC557B3297CF2100824E0F62BC08E38765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294312, "uuid": "dff6e065-93b5-43db-b2a0-f5129ec2096e", "value": "059c6bd84285f4960e767f032b33f19b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294312, "uuid": "32d27f19-8720-4cd3-8f5f-7164e46578f4", "value": "768:/PVvAF3Sz0Kp4TC/ndBD8ipSsnA+vl1qlCGB8Ylu0WVHZC5isU:XVvPz0K3BtDlQlHB8Yl9WJwisU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294312, "uuid": "9f926b59-eedf-4672-be15-6c99fe6e584f", "value": 37208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294312, "uuid": "ae4328ce-f960-46cf-b6ad-209e0636f819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294312, "uuid": "fada52f2-37cc-4178-b66f-f7378a5701fb", "value": "7108b0d4021af4c41de2c223319cd4c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864b1a83-9a9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646275330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275330, "uuid": "e7b9f3ac-e8ca-4c29-b252-8a2cc4001760", "comment": "Malware payload (Heodo)", "value": "6b9ea4c08362b2ce026ad6b122292d7f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275330, "uuid": "1f8d9087-17d1-409a-968c-ba13dbf7b24f", "comment": "Malware payload (Heodo)", "value": "3d1c7b7963cbaa80bd2135fb2e95306808e1d147bf4267bf9c334dbad722a72a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275330, "uuid": "98c55a17-cea3-4a5b-95e4-e065865813f5", "comment": "Malware payload (Heodo)", "value": "9adf57ec207194d4e65e7c147d251e548a4c0dbc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275330, "uuid": "da65252a-73d6-438f-8f2b-c39cc0725164", "comment": "Malware payload (Heodo)", "value": "7a5ac607dbabc56909a7a06f15bfec99a78f0da4192d1d427824f4f2d8bd68f20b198a5e568cf097aa25e7a79dcdf66c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646275330, "uuid": "c05f8d47-d006-4965-ae84-61f25e137389", "value": "T1F623D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646275330, "uuid": "74d3b492-5fe0-4f11-9061-e72c2cd9609a", "value": "768:aeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:JoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646275330, "uuid": "d7a8b58d-2ae3-48fc-a08b-eb99029cfdfa", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646275330, "uuid": "bdfcac29-d122-48e8-8e39-cec36d4ec5d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646275330, "uuid": "2b3ea3bf-fca6-4a68-a6b8-d0dae32025c5", "value": "2022-03-03_0805.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b53f3b1-9aca-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1646295337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295337, "uuid": "bf70a834-a1cf-4e5b-9a38-8db06fab4452", "comment": "Malware payload (AZORult)", "value": "447858b067e7e1b1cb58bc68b0360434", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295337, "uuid": "3f8e4cbb-c5ca-4973-964e-818754d367c8", "comment": "Malware payload (AZORult)", "value": "3ea0d5204b7f00592980a76c06e5210758c6ac6cb1bc8e90c03739d0ec8ddf76", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295337, "uuid": "4d3adcc2-04fb-4723-bba8-c80dcfc72ccc", "comment": "Malware payload (AZORult)", "value": "ce01c8305b5fcc4877c1b2f953541bb7ca20fa7d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295337, "uuid": "9fa1549c-bc0a-4cc1-bf07-b55eca0db1fa", "comment": "Malware payload (AZORult)", "value": "b578a34e9d156e2fef530e686611e0e0874300477d6f2b1493bfb9540238ab78776ffebdf5d109f7b61d50d885c1d2c7", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295337, "uuid": "125bd28a-bf97-4d81-b09d-b042e0a99bf2", "value": "T13A05CF0439E64038F9368BB1DAC4E7F08B6EF225E589B0F654105E557642BBEC849EFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295337, "uuid": "c3bf83c6-d1d9-4b85-b14f-c9a8e8f28ce8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295337, "uuid": "7520262d-39c8-434e-ad2f-74acfa08c2f8", "value": "12288:IjUR/InTp1VvmbtojyJmqaDwDzYLYpTGmewQuOEIAYhemBn5DBi7Bfo3xlRE:IjTobZQqnYkVHQemB5d6Bw3xzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295337, "uuid": "7cd2fd62-f423-4ef3-bbb2-1b9e2f8f55e6", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295337, "uuid": "8ad3a4a4-9dd2-4794-bedf-a900f350c1d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295337, "uuid": "b428f645-9a35-41cd-a321-99816285cba1", "value": "447858b067e7e1b1cb58bc68b0360434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c114d52-9b2c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646337509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646337509, "uuid": "9fcb6db9-2139-4a5a-a7af-2bfe174d8ada", "comment": "Malware payload (Loki)", "value": "35fb329638f09bfcde8996357f02b321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646337509, "uuid": "48ddfd8c-3607-4b8d-8aef-e30666bb4ea3", "comment": "Malware payload (Loki)", "value": "3eea2ca0358c2fa846c7e599b2f6fdb616704211fdee82dc1bd142e22d6b1d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646337509, "uuid": "3d9edfa1-46e4-4d4c-921d-401b82c935d9", "comment": "Malware payload (Loki)", "value": "51867c23114860a35edbb8e7b2f5aa80f9a7c522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646337509, "uuid": "a55ff777-869d-4c08-a4f4-20be85240ae8", "comment": "Malware payload (Loki)", "value": "1237bd4cc89bb54829a4979bf6a5d2201d1e302cf4b8ace97f6cd7e86ade2b9f1634fa003ae61942082359eed2241888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646337509, "uuid": "5d159e93-17ab-48ad-99cc-acf18a199142", "value": "T181149E55D198480FD7724936C8B1D60252ABED4B2913C7DA53F83D2FA331A5BE3F21A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646337509, "uuid": "b46322e9-a84e-406a-97ab-1a3bbd2f09e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646337509, "uuid": "42e0934f-fde5-42da-9cfd-273543e609df", "value": "3072:z+bhRX3nPWlVQ9CKQ0UUVUUXjNBv2t5DkfMX:CbTHnE6gKot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646337509, "uuid": "50da3482-b182-4d4b-9927-6b832222c1c9", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646337509, "uuid": "4af872f7-a03a-4416-9e2b-355cfe267d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646337509, "uuid": "b2c229a2-7bf2-47f0-bc79-2224070c16b3", "value": "CONFIRMACIN DE PEDIDO PARA PO# 062618FPI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da3b3da-9b41-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646346478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346478, "uuid": "520c0f4c-543a-452a-9f04-febf1c0e2f72", "comment": "Malware payload (Heodo)", "value": "83b185bd4fd2ec2f38ec8b224bca320a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346478, "uuid": "84b477e1-94c2-4c33-a434-523fe28ac275", "comment": "Malware payload (Heodo)", "value": "3f599500e835834a79d0795cc4c75e7e04602d8b4020528d492aea6aadaaca70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346478, "uuid": "60cda479-0f51-426b-ae81-c4adced32e7f", "comment": "Malware payload (Heodo)", "value": "4baf4655906b5c71e2adbe13c1c0d797cba52475", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346478, "uuid": "fcf6d146-baae-42de-834a-874bda9a8b99", "comment": "Malware payload (Heodo)", "value": "6b58e704e904274d7f76da85d58354c576dde4a6940339f573a5429c0a5393cd87a264e7122213c9170c1c17f490bcfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346478, "uuid": "c894e68a-b227-497b-83d2-ef1a86933bf5", "value": "T14DD47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346478, "uuid": "697b0653-eed2-4053-bade-8c2f028c0f1c", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346478, "uuid": "de69d87c-64aa-4a54-a70e-e9c831430afe", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRL8CjzhmD/bwb1r8Hc:Bg4IqjYT820D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646346478, "uuid": "6939e32b-88c0-4bd3-89f4-e9db0c68f574", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646346478, "uuid": "0e8b8764-e42b-49fe-9fb3-5a60dbe46bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346478, "uuid": "5ff46870-79ff-49ae-91fe-d29464de9ac0", "value": "83b185bd4fd2ec2f38ec8b224bca320a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9b7874-9abb-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646289219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289219, "uuid": "afc4649b-8ee4-40aa-92c4-45d60882bd9a", "comment": "Malware payload (SnakeKeylogger)", "value": "be0aa483dbe3de9a3582edfa5b731a3f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289219, "uuid": "7e943cd1-b3fb-47ff-b616-d284fbfd14cb", "comment": "Malware payload (SnakeKeylogger)", "value": "3f7dce77eb0dc3f452f0e5e3ab6650aaa277b335d5267c8a4a786d9b50866d35", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289219, "uuid": "a0c06806-8a7e-46e4-b865-e0f696151d8c", "comment": "Malware payload (SnakeKeylogger)", "value": "9b03b55e46e10ed8de63fccb1e3c1247174dc451", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289219, "uuid": "0c3227e1-abfd-4748-adf5-140dc2a09258", "comment": "Malware payload (SnakeKeylogger)", "value": "9bd1c81d70b4584281ffbdefbde967576c50f9605722b9000013bb82294e8356fc9ec4b66bfbd38381cef892e476a8c9", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289219, "uuid": "e01537ee-6385-4b82-8be2-8ce74665a342", "value": "T1C1D423A0D4724D38E19A70E79090750714A572F8B3F51A07C49CAEA4AF12ED2BF9E74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289219, "uuid": "21e1df3a-34a1-4ae2-911f-920e60629747", "value": "12288:cR8mIGVyiRG633Kq8UWQmE9O/LKGtL/ifdZ8T39:cRCiJ33KXtFGO/LBAdZo39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289219, "uuid": "6c7a374c-da4b-43b7-97fd-8e84f9891bf1", "value": 610642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289219, "uuid": "3546f0ba-cdbb-4e22-998d-76bc9a505a3b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289219, "uuid": "8dae1111-7375-424d-9679-57807d2ddd1e", "value": "proforma invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3b969b-9abc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646289408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289408, "uuid": "c7f7e053-d480-43f5-ac3e-169fca3a4b28", "comment": "Malware payload (AgentTesla)", "value": "3225cf407c39df318f40f3b3afe4d800", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289408, "uuid": "d3680f73-d790-44fd-ab61-d07760f7768f", "comment": "Malware payload (AgentTesla)", "value": "3f8c5b0941e059175733fb601485e649b632149aba305121fc42ed52ee07041a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289408, "uuid": "ee9e1817-0f5f-4c08-b8df-0bf412e0bf30", "comment": "Malware payload (AgentTesla)", "value": "b09ea3958939a9bf9bd432f5c07f579c97da6bb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289408, "uuid": "a7367338-e331-4023-981d-3ad3596ac6dd", "comment": "Malware payload (AgentTesla)", "value": "5f5d6ebb0e4a67828f3fa007a857b4eb4c9eab57b88379d33861a6457b7f24317fce67d7f99cc2aec58c77c305603f29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289408, "uuid": "65324d2a-a092-4b42-b434-fdf3fd443d05", "value": "T1882301082ECBA2CF1AEC2E334D47E5F9A113358362A997556EBBF54D4C904E05B37328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289408, "uuid": "21319531-dada-4151-a15a-767369fb7621", "value": "768:miEY1Ecffa2ZpAeeRgIXNhl4IRVDbekpHL9IwglIPVtWNScauFFrT1qDwH6izx5:SCfFRdIdYIRVDCeHLGVIP3StFUwH6Ux5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289408, "uuid": "cbb4036b-cd8a-4868-a613-d02db09150a4", "value": 46096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289408, "uuid": "850e6c93-e19e-4146-9d49-f66c180b199c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289408, "uuid": "e7e9da3b-249e-4a93-b24f-bb9f3acffe79", "value": "SHIPPING DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f3c07c-9a97-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646273751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646273751, "uuid": "b42529fb-aa38-45e5-8663-1924129d2a34", "comment": "Malware payload", "value": "2903164c599f508a9b7923697de83ac1", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646273751, "uuid": "7138d2a5-5ba0-4165-8ca9-3c04611a087d", "comment": "Malware payload", "value": "40c0dc7117caba871b706dcf09aa54cc557f69ed5febdbf5e2b3844f9e9c7e76", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646273751, "uuid": "291d1629-48e9-4149-8c12-5e692fc7ce86", "comment": "Malware payload", "value": "1970ef95af730508f64275d854ea0ea9fd219231", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646273751, "uuid": "1f53d12d-59d8-490d-826b-69b6cd916218", "comment": "Malware payload", "value": "74ddc0cf937aceda68886d3ab95b3cd20a8225ac7ad54c25336abc06c55d85e9b9b0f9015b46e01e7c32842d56dd72f6", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646273751, "uuid": "d3b784ec-0f02-46ed-a5c0-fb1ca83d4d87", "value": "T13A226425B8868C9942736377DE53D408E7328367D1394A0032BCC4DACFB691DD2D6EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646273751, "uuid": "f9a741e1-4eca-4dfe-8452-6268f09a95c1", "value": "96:q/DGBVTv6ayBR/H1xal1qEDiylB10Z3pxmuWGI6QLIW2jbtSpfs1rcoRaz1+ht:eZayB8l1qEDiylB10Z3pE3sJvttgo4gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646273751, "uuid": "21410a95-e266-472a-b151-591ef2ab5256", "value": 10032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646273751, "uuid": "ba833049-9882-4217-9492-01205b2b41ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646273751, "uuid": "5cee2b9a-fa9f-4a9e-ad4c-926e8dfba941", "value": "40c0dc7117caba871b706dcf09aa54cc557f69ed5febdbf5e2b3844f9e9c7e76.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac51dc0-9afc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646316838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316838, "uuid": "aadeb235-d2fb-464f-9aaa-25fcc333c1c0", "comment": "Malware payload (AgentTesla)", "value": "e2c530d523b08dcd06a46a030ab947b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316838, "uuid": "44959a0c-0d4e-46d4-8da3-14f2f1912dc6", "comment": "Malware payload (AgentTesla)", "value": "415ca7f5459632096fdda7fb5a532c0869c8e8dbb629277e130fa3a4dff0b69e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316838, "uuid": "7bed90f9-d058-4897-913e-405938eb85af", "comment": "Malware payload (AgentTesla)", "value": "5cf631039ab7e2809b1a8c2676e92b998ba538f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316838, "uuid": "f1d306c6-e9bc-4f5e-9bb7-d8739af57722", "comment": "Malware payload (AgentTesla)", "value": "10f7f1be1d672768e33eaf6690a56cb0789b1f9e31bad44c13771e21ca86fd45cf64456c6270871eea183d4751179c22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316838, "uuid": "ad127216-5bcb-4129-8486-7f7867090f08", "value": "T17C15D00439E68038F93697B0CAC4F7F09B2EF225D589B0F664105E157A46BBD8D49EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316838, "uuid": "e725c533-6a37-4dd2-b190-2aa96751a607", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316838, "uuid": "46a418c9-3e36-4463-ad2d-85d8ea41f343", "value": "24576:y/dzKya99/owyC+uq6T7Yu/TNDUsTLcJ:OG2WRqOjTNDdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646316838, "uuid": "9a547c24-1928-4af7-b402-56c57653006d", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646316838, "uuid": "86b13d14-96ed-4186-97f9-7366abe7411a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316838, "uuid": "fc64f0be-50f3-4349-9d21-8f3f108e379c", "value": "PO #7696679TTR6F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ea5176-9a9f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646276999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646276999, "uuid": "6360a70f-a8b3-4827-b4e6-b0fac7afa966", "comment": "Malware payload (Heodo)", "value": "590b4a7bc2e916fbc70d12391ca6cb11", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646276999, "uuid": "5aeffcd3-85fc-4856-9b7a-a598474e6281", "comment": "Malware payload (Heodo)", "value": "419ed803db1a19cd2feeaff785e27d198cf2ac27acc9dd2fe6e92eed6b986121", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646276999, "uuid": "d43f9511-e084-4489-b5c2-d66dc468d389", "comment": "Malware payload (Heodo)", "value": "67d59ba662f0e175ff41a4832e60047efd86e850", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646276999, "uuid": "822cd252-ee97-41d0-ae2b-2b309acf6b5f", "comment": "Malware payload (Heodo)", "value": "8256f59a33ee73d367537f3c22c7d779a473c61597eec0e3fa5dd5b34dc10549cdafa74d3c9ea1d9a5f445255a2bcc82", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646276999, "uuid": "8884683c-ee3e-44f9-b50f-89337e3fd383", "value": "T15E23D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646276999, "uuid": "12feda2d-aed2-4760-9906-52387a25f386", "value": "768:ueoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:FoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646276999, "uuid": "498b5e4a-7a8c-4144-942d-1a6083c6f959", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646276999, "uuid": "733ca972-45a9-49e9-8179-870a9eae32de", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646276999, "uuid": "6c86ee98-1c40-4daf-b5b7-031a51bbd401", "value": "I6587279555121650115_202203030803.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa1c2e4-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298074, "uuid": "9cba4ba9-79e3-425b-ad82-ed4181146454", "comment": "Malware payload", "value": "24cce691709f1ed05d5c1c765a258180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298074, "uuid": "e711a9f7-7b89-4888-9804-949a02163e28", "comment": "Malware payload", "value": "41b39ef20c5490973503358df715382332ca0ef57016ee9a3d9d6d7639a6d4a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298074, "uuid": "747fe004-de4f-4f6f-976f-96ea48d31535", "comment": "Malware payload", "value": "5928f31633f3b4fc226297c5a2b1e920c1a231af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298074, "uuid": "28a7fefd-07ce-47a2-baa7-250959057495", "comment": "Malware payload", "value": "61cae15c0bc29dbce464651194ac316db99945effa7b0ae75ac7beeb431e874183f4a39d0087aa7e01ea5dbe1b82d2cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298074, "uuid": "45fb63f2-27e9-4060-96f9-61ab94c8e07a", "value": "T18853822BD7630C58C9303BFCDEA2DBA50A9C5F8D2C32C7D749A5FC5070EAA4578499A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298074, "uuid": "f7201daf-2ccc-4d88-ba4e-1a70e26a201d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298074, "uuid": "bf83f057-0021-4ca7-9b5e-f4396669993a", "value": "768:WobtA02b1R3A1wsV0hkOLKYlEO8eBCjviqErlCdszYdl0jya8zcwR0C:WobtiZwwsV0iOLdlEbaqEYdszM0N/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298074, "uuid": "6a059217-2405-4484-9ab7-e4417cf6878e", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298074, "uuid": "bb64edcd-f9ab-4851-9125-63668429badc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298074, "uuid": "a0d3fc35-6b05-43fa-bca4-7eb3323ca660", "value": "24cce691709f1ed05d5c1c765a258180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7569a5f9-9ae5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646307084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307084, "uuid": "b60b3a1c-d16f-42c8-8ccc-e53602d6dbcd", "comment": "Malware payload (RedLineStealer)", "value": "e6bc19cc048d9932f82fd92cefad6a8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307084, "uuid": "9143daa3-bce4-408b-bc5f-ba5a6b352dea", "comment": "Malware payload (RedLineStealer)", "value": "41b4787740c85fe089ae0f8f085c1cf3943dd5d76c6d58bef71d0caf7241de65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307084, "uuid": "8caa0f7f-5958-42ae-9349-db0cc0fb6901", "comment": "Malware payload (RedLineStealer)", "value": "0fc027e5a9d094c8a95af5e2e27540e150873927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307084, "uuid": "a34d4751-89e0-45cc-88cc-c40c70984dd9", "comment": "Malware payload (RedLineStealer)", "value": "75fbba2ca816cf86cd92cc5b05f35e1e98dedea21d9870ff9a2e6f8baef04021e8bbb40b9a0bfe21b99dada7a8e42e94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307084, "uuid": "455bb370-c3c2-4ce6-b5f3-a5fc54aed57f", "value": "T1A905803439FB5029F1B3EF768AD87596DA6FF7733707A45E2050038A4A13A82DD8153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307084, "uuid": "e93a6e10-52d1-4ae9-9fef-bbccdc8bf509", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307084, "uuid": "0c112489-765d-4a89-979a-2cac8ad94df0", "value": "12288:k0tj9x+cxL19nRT2xiCX0FB0CQC6ZfVrPI2sNy5uNTM82NR2QZicbepfacgWqs89:VtjJxL198B/hM78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646307084, "uuid": "453456c0-ab10-449e-bbd6-027dc2d4bd94", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646307084, "uuid": "a014344d-4edc-4e53-8870-da712eedea58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307084, "uuid": "d5e12dba-26e8-4eb9-abdb-8dffdd2936d7", "value": "e6bc19cc048d9932f82fd92cefad6a8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7ed4c3-9b09-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646322555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322555, "uuid": "e3f90a1e-3e6e-48c1-8760-7e390c605217", "comment": "Malware payload (Heodo)", "value": "5bf371497b8e2ac4d36ce8d277885c9a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322555, "uuid": "cf3aa2b9-8e36-4742-b307-c3d78e66ed8e", "comment": "Malware payload (Heodo)", "value": "420922c5465c25dcc0769328a56b6faa0708a6ffcea4bf43dee5e0ccf54492e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322555, "uuid": "3e3ddf32-9900-47ed-9469-00b0086fd613", "comment": "Malware payload (Heodo)", "value": "7cb04adf12b9446a759a1f17d3da828d3d5e62dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322555, "uuid": "50b2396d-d07b-432e-87c2-340370f4b97b", "comment": "Malware payload (Heodo)", "value": "24ba2d643d061ed79de0bedf87d433501c043cac7e409aa12e713bae228a65a644d5d682f45b1eac876207a590d481e6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322555, "uuid": "6f98b7f4-dcd4-4e4d-ae15-a1fed761aff6", "value": "T1BBA48C507B81C0BBC39E31B14556D27962E9A6709F3897C7BBC44A3F6FB41C1993832A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322555, "uuid": "3cf93ba1-cbe5-4b5e-afd6-0e3ce31492b7", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322555, "uuid": "8847058c-374b-42a3-82ae-dc69ab5cdbbc", "value": "6144:y+LHJs45xTU1I/m6WgLGMAPIY0hOGuy1TPQV+bVy8CuwxpOwwuDKBnKDteyX:y6f5tUaLG1iZuyzbVysg1wuKBKDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646322555, "uuid": "99edcb7f-a3ff-4209-8425-af8db1d1894f", "value": 458140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646322555, "uuid": "dceb5933-f5c3-4384-bff8-eb80891be1c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322555, "uuid": "c857c60a-0622-4966-8d2b-b0a321cb8692", "value": "emotet_exe_e4_420922c5465c25dcc0769328a56b6faa0708a6ffcea4bf43dee5e0ccf54492e4_2022-03-03__154910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167154aa-9acb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646295758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295758, "uuid": "62d1ffb3-3474-4741-bfa5-b4f237ab162f", "comment": "Malware payload", "value": "018449d349fc1bc79159e4d4d3d10a98", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295758, "uuid": "588a4bcc-1663-47b4-9806-7e570610a0e8", "comment": "Malware payload", "value": "42bd2632876e3b95c6b76b6e88d24103c02e9986d9ac0707f6978341d21c002d", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295758, "uuid": "deb26f26-0a12-49e8-973c-d16839435925", "comment": "Malware payload", "value": "7bb16f2b645c563bae2a72afe123c2b82f98645d", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295758, "uuid": "a8d62dc1-a698-4fc0-93b7-437a8b7bc6c1", "comment": "Malware payload", "value": "291f3682d9d80b2f6b63409e04597c0960d09e86bd3e389c73136eb7e2527f93cbf00673f208d6011ba45e6cd1f05e6e", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295758, "uuid": "39bae19b-9dc5-4df4-85e7-db997dc5c2d8", "value": "T191139E0BD5016D47C2A3E73DFE3488E15BAA9D13211479CFE1D1B9470B64AEB270EAC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295758, "uuid": "a8c286d4-45b9-4d93-a1d0-ee5989368a5b", "value": "768:U+gaRD4S0JS00SneSnjS0yS03S0IMS0bS02ScxbV+cUs70Nn2srTpxKC6yDsfudU:U+DMVU7N22Tbwy40zVMMAxQXXqpYu1/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295758, "uuid": "d2c5a170-8efd-45d4-8585-cb4e3f8c7d54", "value": 44918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295758, "uuid": "c4527986-467d-4497-a4ab-258f194bd839", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295758, "uuid": "0a601e79-8139-40e2-9042-d77eaf3aa1fc", "value": "New Steel RFQ List,PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dba594-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646297950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297950, "uuid": "0de2248d-5c59-47b4-94fa-11eddeb2803b", "comment": "Malware payload (CoinMiner)", "value": "2314ada26bcd49478dcb6e48833cec68", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297950, "uuid": "c8990bf7-0345-4cb8-a369-e07af6cfa02f", "comment": "Malware payload (CoinMiner)", "value": "436b57eb4ebf6768af469abaabbb1de5ef33ee07a87a82e279f98c9a079a2497", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297950, "uuid": "9b9530e5-007a-4ba1-a7bc-8726a4739b42", "comment": "Malware payload (CoinMiner)", "value": "56a96ad7c487905416948a8383f2d6599af1f74c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297950, "uuid": "4ba2906a-3b94-46d9-ab0c-96e44c83cc55", "comment": "Malware payload (CoinMiner)", "value": "edd4d9d91d358e974481b715620870e73cb7a2dfce051d7837039f19bc975898aca5d719ddc88588afe31584f78f7695", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297950, "uuid": "8d60687c-e71d-4a54-9409-523ac696a794", "value": "T1E016331A61D96871F4B663B538F042A333B1355453ABAFFB429988B91B32CD05639FC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297950, "uuid": "38dded73-72bd-45ad-8b48-f0ec50dfde89", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297950, "uuid": "c8dc2fbb-4042-44aa-99ec-597b44fce6aa", "value": "98304:LaM3xcbKXCunllSI6a8EOHRJb7KwmJHJsQwnso:Lakx4Kdnlwpa/OHDaBJHW9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297950, "uuid": "014bc495-2d0f-4573-9498-670034104b7b", "value": 4165632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297950, "uuid": "cf1326ef-5f76-4715-a47c-a0aca9df2852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297950, "uuid": "ee5221d4-db68-434f-9f38-16ff38179823", "value": "2314ada26bcd49478dcb6e48833cec68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbcc0b0-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300413, "uuid": "56a9c44f-78e7-49ee-aed8-b01a0ce1e1a3", "comment": "Malware payload", "value": "610f0f8caa2928e53a802e4df8670ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300413, "uuid": "7c9bf483-37f4-4f85-9560-74c6aa80bc2c", "comment": "Malware payload", "value": "43983482beac43130dc4718fb5bf3323063efa0f067d90e55a4c47653cd15bb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300413, "uuid": "d1a68b60-7c73-49ba-aa5d-7c518b0e1975", "comment": "Malware payload", "value": "46f3c0be3d1139c223dcbe80220146fb15b607b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300413, "uuid": "7c8a589d-483d-4191-93a2-c43ffe2d01b2", "comment": "Malware payload", "value": "a255e0e43e92a60b0ebe173ba2c1633257d750952626e736bb0f0b954e6c0f544402166255eca4f2bb7c97e01f9facdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300413, "uuid": "996697d9-943c-4bf0-a273-d43bc0a93dcc", "value": "T10BC17211F7E89777D9B60B30ACB353104AB9FA91D963CB5C20CD624FAD267140E61BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300413, "uuid": "a08bf002-4ed6-4c5c-8ec5-eca11da968b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300413, "uuid": "8ba6dc4e-9116-4bcd-9d6c-2572fa39ca8c", "value": "48:64vgkBvi7AoC+4p1VLDgl/u+V/o7yz0/zrMhU899XDQrZHeddu0I2gsEbrSMoitc:2U+4Hx8ZsSHNDQGUsEhdAyzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300413, "uuid": "56cb7a99-a668-4cd8-b472-d267f36d61af", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300413, "uuid": "c3f0ca03-4554-4e68-86ac-c32d91127318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300413, "uuid": "189b1f57-8d80-4d5c-8706-6fe12ce70ae7", "value": "610f0f8caa2928e53a802e4df8670ceb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd712d4-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265650, "uuid": "54d92775-0e1d-4d76-a074-82d414c64297", "comment": "Malware payload (Heodo)", "value": "58e9ff77605daddd345ac27a9167e220", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265650, "uuid": "118e7c3c-0924-4868-a2f7-a86875b75025", "comment": "Malware payload (Heodo)", "value": "44099af23f518b0afbad30da9f29e9f86e062eb0ffbdf51fd83d4cb4b4aecd88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265650, "uuid": "294cf13d-6f11-424b-b5ea-dbca0c558dd9", "comment": "Malware payload (Heodo)", "value": "94bc1396961dbf20771c3efc190fbe79c1d8d361", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265650, "uuid": "d7257089-e61c-4147-866c-e49603d5b640", "comment": "Malware payload (Heodo)", "value": "8acae4b1d6d1b582d00a7ffd5babeada9f780c87377db088e506c557219d71ac3fabd332ae1c410b9dc1e9ea4b71b0e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265650, "uuid": "3c950598-c8e8-403f-b93d-48038dabec72", "value": "T1D3D41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265650, "uuid": "5d97055f-cd56-448b-a05d-cdc318fe2fb1", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265650, "uuid": "53d2aaae-0d9a-41c4-b124-fedc30f34f0c", "value": "12288:DjN/Z2wkRrA9CRDC7ElAjHDsndSyHOrNvEP0Oua:dEHR+CRlyfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265650, "uuid": "09bda909-6dd3-4287-993e-7ccafc19a861", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265650, "uuid": "4c952576-ff54-4b91-8340-bd66b11ad276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265650, "uuid": "222eb6a2-055f-460b-a01d-8e86095fe376", "value": "emotet_exe_e4_44099af23f518b0afbad30da9f29e9f86e062eb0ffbdf51fd83d4cb4b4aecd88_2022-03-03__000044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1985cba-9ab3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646285764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285764, "uuid": "c2983c21-2190-4a71-9961-8158a108956b", "comment": "Malware payload", "value": "5ad870d4c3a58aca0fd81882c2fc3293", "object_relation": "md5", "Tag": [ { "name": "crasher", "colour": "#7E2A91", "exportable": true, "hide_tag": false }, { "name": "EFIlock", "colour": "#BAFBF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285764, "uuid": "63585292-ffd4-4db3-991c-2f1108c3224e", "comment": "Malware payload", "value": "4449b20bd71f7d7e6ef0ded05baf219d29b5b782246750643486510f13354f65", "object_relation": "sha256", "Tag": [ { "name": "crasher", "colour": "#7E2A91", "exportable": true, "hide_tag": false }, { "name": "EFIlock", "colour": "#BAFBF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285764, "uuid": "2cf42dbc-9c55-4018-a037-7ae8649041cd", "comment": "Malware payload", "value": "51a5ed813e1f3e1445b8b227e46bdc92491be23f", "object_relation": "sha1", "Tag": [ { "name": "crasher", "colour": "#7E2A91", "exportable": true, "hide_tag": false }, { "name": "EFIlock", "colour": "#BAFBF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285764, "uuid": "5427dc82-db30-4d31-ae43-2c2636944cdb", "comment": "Malware payload", "value": "b72316791ad3979e3585ad0ebca90dee00ebbed12bec27ed0c917adb19f45d17a0234ed3d10d380a088506c70766fe40", "object_relation": "sha3-384", "Tag": [ { "name": "crasher", "colour": "#7E2A91", "exportable": true, "hide_tag": false }, { "name": "EFIlock", "colour": "#BAFBF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285764, "uuid": "ec3d2032-d189-42e8-833b-bb6e48596016", "value": "T1D9D46E22E2E14437D0732A788D5B52659C3A7F106E3C644A3BF83D489F3A6D13929F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285764, "uuid": "604c74ca-01f8-40b2-b711-47dc1744f6d6", "value": "2998d549b7dd1b89609d98333c2af64a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285764, "uuid": "6431e4d5-d45c-4512-af64-fab5cf7bacf1", "value": "12288:8LkND5t6BvD/B0MSscDZZN2VOaZLKTKVn8TM3u4pjGwv:84zcDJK1ZL6LZLqKd8TM3uiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646285764, "uuid": "f44400a4-741d-4cb3-9be6-88ee173e932b", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646285764, "uuid": "186bc6e0-10f8-4765-9e8d-2b9e5ea3e397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285764, "uuid": "3b34d132-9b51-4b3b-852c-b09a73098116", "value": "uarekill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a0d759-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "98d9c0c1-ca75-46b0-a4c3-d60a358a8d68", "comment": "Malware payload (Heodo)", "value": "6aed6efe4037f3626bed2cfa1d44a2db", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "96d4a2e4-e07f-4fb4-82f0-9436f9cd9191", "comment": "Malware payload (Heodo)", "value": "44b628786f23529936c8dbe304ff42e8636f381cffa022d927c526997d6a0432", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "f521c4f1-ca76-4805-957d-c56bd5919f79", "comment": "Malware payload (Heodo)", "value": "c91dcbffe1380d2d65262208bbcdcefc7e2409e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "cc583fbd-98cb-4402-9f5e-8f2ec4e314a6", "comment": "Malware payload (Heodo)", "value": "498ea3fd5a206466f78ce88818c041e3a0bd8e4e2bee79e2f441cc6bfb8d28b9093920d5c3cc995686c1cbf7a47d183d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "b6a149cf-3176-48a6-98be-6712f1e3ad15", "value": "T137D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "51231279-3383-4735-ab72-8f46d93cfa25", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "e6c44d44-6c8d-4348-b67c-9c31ed7ed58c", "value": "12288:ZxpNJJJ2NHPoczJOOtIhxf3foRXIa5EPwvA:Zx2gczJOFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "ea3a7812-c438-4d69-96cb-bb1e6cb915d6", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "1cde5482-6251-4d62-b117-2083ec1feae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "7dfdc077-44b2-4d09-ac07-491500634be4", "value": "emotet_exe_e5_44b628786f23529936c8dbe304ff42e8636f381cffa022d927c526997d6a0432_2022-03-03__000305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e167a8c-9ae4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646306616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306616, "uuid": "eccb2e1e-ba5a-48f4-8abe-463cccc0e351", "comment": "Malware payload (Formbook)", "value": "be8be5dd7872072f6ca2fc67723226ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306616, "uuid": "689a3e21-df3d-422c-9c8b-e407a099388d", "comment": "Malware payload (Formbook)", "value": "44bd5d877ccf6a64815ff6f6224f7286bd4b10bbaa862470e84e61964c8f4290", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306616, "uuid": "32e48a0b-7065-4a47-b4e7-d2cc42cf0e46", "comment": "Malware payload (Formbook)", "value": "62cead962adc5acbf611f003559a364bd44a9665", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306616, "uuid": "c93015f1-e7db-406c-8ae4-52e9f70ae03e", "comment": "Malware payload (Formbook)", "value": "e9387d2507cbf32d681021d19df869d074a3bf937ddf40a6c25e195f4a9e4ca422f43da05f3b6751cc5c73ab3c274c93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306616, "uuid": "ff6b1750-dcac-4596-a0a2-a54c7ddca269", "value": "T14F65F1C2E14A5403DB7D847DB4935D34676B9E6B183F8212097C9AB81043ABB3F366F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306616, "uuid": "27cac03d-b2c0-404c-8d59-f5d95676b72c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306616, "uuid": "91166504-45b4-4341-a3b5-d5b82d075dcb", "value": "24576:lKWKpodqu3S0BZj1hLTIrJ2linoSXoujt4YqKZD0oqeHIpydM9qLAk:lKXuiGZs0linoSXoujt4YqKZD0teHIpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646306616, "uuid": "b5fa0878-ca78-490d-bdfe-53cdd0ca417b", "value": 1444864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646306616, "uuid": "01bf22b9-b93b-4498-b71b-077efa1818db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306616, "uuid": "5931afc0-1448-4f5e-9f39-0b9d5d380bb0", "value": "be8be5dd7872072f6ca2fc67723226ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6a3d01-9b0b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646323551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323551, "uuid": "1305a6fd-4364-4611-a1cd-a3b22cdf46a5", "comment": "Malware payload (Heodo)", "value": "9d3a7d0eabbc831fa93ff84de3e0c9cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323551, "uuid": "5ede13a5-e5ad-44d1-b920-dc617fcaf1df", "comment": "Malware payload (Heodo)", "value": "45378acd41d91320f89dc1981fef55d54e0b05f75f10fea12e4130cedfaea0ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323551, "uuid": "a5ecea2a-72e7-45e7-b08c-b8d903a13dc5", "comment": "Malware payload (Heodo)", "value": "45fa289c09472b9c3c74425ad452f114bfd99bff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323551, "uuid": "9bb22849-be5f-4d46-8f26-ae3c27fc4d5d", "comment": "Malware payload (Heodo)", "value": "6ac74893476c4d146f54bf4302921f34f21b4a4f4bfd0a140cd1218fe4ad0df04750c7f1371d9e229f99e0c79587ab4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323551, "uuid": "8511d323-7e23-40ce-a473-43c3d7188b53", "value": "T167353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323551, "uuid": "c89ca0bf-51a3-4323-b036-9ac0e99d9aff", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323551, "uuid": "20e2203c-c1d0-4eb1-919f-705f408de5e7", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZW1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZUytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646323551, "uuid": "33bec077-c82d-407d-9fa4-a65b2e34e77d", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646323551, "uuid": "61aa3f4f-c624-423c-a790-125b72f37d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323551, "uuid": "eb018558-6d56-4bfa-a859-1a8c535b46a5", "value": "9d3a7d0eabbc831fa93ff84de3e0c9cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f962b0d-9ab4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646285922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285922, "uuid": "f977c69e-ae38-4d64-ad4b-96e635613565", "comment": "Malware payload", "value": "2a20ba23207ad69130ac2045929281d0", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285922, "uuid": "b86624d5-5d2f-42a6-8f53-c33b2a526296", "comment": "Malware payload", "value": "45582aebaf4b55c2121feaf2663f629635f8072b10e80c64296017fcc36512e7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285922, "uuid": "bd6681e2-b60d-4124-97a9-5ed22050c5ec", "comment": "Malware payload", "value": "3b8c62c5f708f320832ef8b11ebd54d2e9f15e91", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285922, "uuid": "1e01c3dc-dd71-484b-be01-0e91ffb81ffc", "comment": "Malware payload", "value": "9ade871554dc80b483313f94b615fc27dfb615316a26694c9572326dce69809af6182ea7e65d27705747267bab6f2179", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285922, "uuid": "2193e3e6-ed1c-4d94-a708-916034d85bd6", "value": "T1ECD3C99B13286275F108037AC5517A5F7522EC943AB082EE2570BD362FF21A0EFE75B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285922, "uuid": "2dc5d749-a828-4dfb-805c-9547fb5dcb2a", "value": "467ba0d06017fd0ce4592b91f73fc085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285922, "uuid": "4185eb81-0f4c-4094-b7a4-b221b9e80afc", "value": "768:otynbSQ/3qkXGtk56wGNbf2MRByjX9N4yoachLeQNDzJc2F0+C4wKVm15GhW:otqSrM6wGNb+ABMX9dDcl/NDzJ/ZVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646285922, "uuid": "43c15d4f-249d-4a94-9071-08f3d77938d1", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646285922, "uuid": "68f78e87-19b1-455b-a08e-22d140bae4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285922, "uuid": "fc3bb3d6-d02e-4b86-8736-df154e3ef553", "value": "kill64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a3e32f-9adb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646302839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302839, "uuid": "1c342c34-4981-4e11-a9cc-929eda78a43e", "comment": "Malware payload", "value": "25ba40f56602738aa8414a48ae3fbcd3", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302839, "uuid": "2462305b-c79b-4ee2-b366-16b54610f4b2", "comment": "Malware payload", "value": "459837f28ebd3bba1bb04e74ba006dc07d72b58d10d86be2362f5e082a739906", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302839, "uuid": "88444a64-d2da-4f34-84d9-7f7dc0b7bce7", "comment": "Malware payload", "value": "c9ac4ef3b95bfd9d9fd88b655592ebdfcddf19ce", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302839, "uuid": "4925bcd4-4a05-4ee0-a146-9c41854ec102", "comment": "Malware payload", "value": "afb2d61938daccc3552ba69061f1c0e027e69c47b8f5f0b96bc4a84c4978ebe4f35f3af211b7699650c97b6fd7c344b8", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302839, "uuid": "a292b0b3-1e6a-44f2-b155-bd585ba8eca0", "value": "T18543BF47B20E9F53904F5BA4BE0B2D1A2F0A3F8936C83283501F4D4737AA3A6559D5DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302839, "uuid": "17fdc6a0-835f-46fb-b608-62274f715fd6", "value": "1536:4KSJtLNB4JOhNbhyDDORNOOKGd/D17w83SD:BeB4c7bhy2RNOOKc717F3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646302839, "uuid": "bf452d31-70e5-4680-afd6-4c84fbd2eb46", "value": 57655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646302839, "uuid": "1d2afbb5-a95e-442f-9197-01a690e21be7", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302839, "uuid": "4b991d94-a2d8-4ca1-a8ec-f4da3a71e44b", "value": "Urgent Order.pdf.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e3bef1-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295266, "uuid": "6be6794d-f724-47dd-aa23-b6925d582ad8", "comment": "Malware payload (Heodo)", "value": "6eab9faaff73f7bcab36691fec9569c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295266, "uuid": "2a47cfd9-c7b6-409e-b3b4-f50815811cb9", "comment": "Malware payload (Heodo)", "value": "45e1984e03cc46581ea84444b253da0fc9a345ce1a37fbe2e9f15f8c1ab20d7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295266, "uuid": "125f485d-5a38-4761-b187-2e5dffa7adba", "comment": "Malware payload (Heodo)", "value": "b1d538a4dc19a1541a4b283ff71c3d7f4918e407", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295266, "uuid": "382be29f-8406-4f83-854e-439f5ad5b62a", "comment": "Malware payload (Heodo)", "value": "76558f3a2bf539d805096e4c6bcfed88c1589b67490f4ad1c12ba3495aeb9501690ab4f6d95ec7613d463f5da60d2a58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295266, "uuid": "2f7cdce9-302c-43cf-be5c-ddfe7b040847", "value": "T178D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295266, "uuid": "64b34572-bb58-4e9b-8e04-bef9f4b131e4", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295266, "uuid": "cad134e5-e8df-404e-a8f0-dc2c7b273ab8", "value": "12288:ZxpNJJJ2NHPoczJSOtIhxf3foRXIa5EPwvA:Zx2gczJSFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295266, "uuid": "df0beda5-18f4-4553-98c3-b0fffc66d575", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295266, "uuid": "57f0106e-a3f2-4a8a-b0df-72f012197029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295266, "uuid": "ba213cc7-9433-4b75-bf8e-de5f1c6e974e", "value": "6eab9faaff73f7bcab36691fec9569c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3172345d-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646294515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294515, "uuid": "cb30534b-dd3c-4f24-bab3-7aeb72c3c7a4", "comment": "Malware payload (Formbook)", "value": "74ba866282eb9332585ed493840c4030", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294515, "uuid": "7302ceeb-9c9a-42f0-b16f-3a5dd0b17b81", "comment": "Malware payload (Formbook)", "value": "469884179434185e1275b12bc001caaae4281a8d5698e20f57b8f7770cdfd7b1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294515, "uuid": "e3206fab-e185-420c-94d4-ab86bed9c1d7", "comment": "Malware payload (Formbook)", "value": "4fecea9cfd6a9935e7aab9e3bb3de5bc50206f4c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294515, "uuid": "3468c133-47d3-48a5-94ac-ea5f9e7c09bc", "comment": "Malware payload (Formbook)", "value": "e48068e029ab84f00ec55c1d5fe3320de633bebc6eb9bb2571eedb529a12e48c55f59aa641e9673e0379e17789b0dc9a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294515, "uuid": "e3d59219-9179-46dd-b70e-bd9a3756f1ef", "value": "T1C9141290A9281796CCC2A6308E9C8060C773FE392B5CE5DDE79C7DFDBAF89416590A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294515, "uuid": "bbd3f059-f64a-4cff-9629-e367c1f4fed5", "value": "3072:xEmDaCqXn4H4qdjio7kEfQykt+YjRVYn+yzmSwdm03sYtSaeigX5VkXZDOZGwUm:auaC2C40k6fYjRVYn0Sc73sGSaeigXMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294515, "uuid": "047cd4dc-6989-47dc-b36d-45f822f46f45", "value": 190392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294515, "uuid": "3a862c4d-12de-4b16-a90c-557b59d26741", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294515, "uuid": "e5431bcc-3e31-4830-af7c-7c18ed45165b", "value": "FORNAX 2-Eng revised bank account.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fb2bfb-9af4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646313395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313395, "uuid": "6a86149a-de5c-48c9-97bc-8c141f6bf792", "comment": "Malware payload (RedLineStealer)", "value": "b62c8f1b91f0c671f24ed07471d73d44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313395, "uuid": "ef7d32f7-8dfd-412b-aecf-2fae7dc1e344", "comment": "Malware payload (RedLineStealer)", "value": "469c0a099a63bc6a6467242242b944bec651f709b75d30298bda76bc832afb5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313395, "uuid": "dfc4e43f-d774-4f37-8746-428863ea23d2", "comment": "Malware payload (RedLineStealer)", "value": "111129192d19ffe0b60da9cfa8a74aaed5b9bdfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313395, "uuid": "4e3ac9bd-663e-4775-a7d6-da393b3a70ed", "comment": "Malware payload (RedLineStealer)", "value": "ac3acb78430f9540a99705da64dd17fecb55bc3d5e4558bc2c7664659e63942d50c97c7dfe1c58d466634ce72ec49054", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313395, "uuid": "398d2ea7-a6c1-4b4d-9d3c-d3f7fbdce781", "value": "T1892633E432A0108DD83DE97639DD671CD6EA36B77F8AC2929C2099059C5507EFAC48F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313395, "uuid": "9ff859da-a825-483d-b8b1-1f7ee4fb4fcb", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313395, "uuid": "850e2ad6-836a-40fc-8359-b78fb6948d4e", "value": "98304:3oOUbkez5cIVbZBdnIqW5SjFm9GTMCvtsDkEX/AxYPuiiE+CKRHTDYBx:tU1GoZBxIqiGFFMA6FX/AxC+CgHTDYBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646313395, "uuid": "4ecb436b-60be-4ce3-962a-74daeb51e6d8", "value": 4859696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646313395, "uuid": "3c6b11b1-10dc-40d0-b34f-0d218c2eb1fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313395, "uuid": "2808f01f-7a59-4350-9000-1d9902a6ff4e", "value": "b62c8f1b91f0c671f24ed07471d73d44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1109d704-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646294461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294461, "uuid": "6ee42d95-16e7-4ffb-aadc-0c4c6c1f4515", "comment": "Malware payload (Formbook)", "value": "f361a626743f13d204f024e4003d5817", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294461, "uuid": "3636042c-ea0c-43e8-b592-8a976d6fce08", "comment": "Malware payload (Formbook)", "value": "46d56d647f8ebc5fbe506a179439b051923151290809ce51e3a2b75098468d68", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294461, "uuid": "a00f1553-ddad-4834-9db2-558e532440cd", "comment": "Malware payload (Formbook)", "value": "954a377c523bc0f6aa625ae152c0a69ed754d03a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294461, "uuid": "b3e993ac-6968-4f2f-b00c-5e34d1d9011d", "comment": "Malware payload (Formbook)", "value": "0c0f83b5e81f631038adc669c9b9426e5d5735d4fe2e6e97bc0145c1b9845cc3dc2680f0262ae5b178c4809752445f17", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294461, "uuid": "c30dbab4-5b2c-46ce-b627-925aece78acd", "value": "T1DD14121A3F567A81C99155BE7CF640D9224FDC77CC1BC89CA38AF22C4B71A54282A91F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294461, "uuid": "559cc893-b58c-4258-ac83-e7dcae585f42", "value": "3072:g+AP6ephHJ1aJ2s4Zi6JJmGw60Ghnm9L+cJiwWq85p430WjBWsrQHGa+kJhyXW:Fc6Ahp8h4ZOv600Q+c8k9H8HGaRyXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294461, "uuid": "a2787dd1-2380-44f5-98b2-8d57f1e9d39c", "value": 190568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294461, "uuid": "aeb539de-ed8a-4a8c-8133-c65cdfeb488c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294461, "uuid": "1c74c57a-c930-4301-921e-67d34304737e", "value": "SWIFT COPY 0030222.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e458caf4-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646296963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296963, "uuid": "a622651e-f88e-4474-a773-d859ee68aa28", "comment": "Malware payload", "value": "4b341970d3bf16c23f45550f109fa509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296963, "uuid": "9f9f8810-9ae9-4b06-813f-fd92cae52ebe", "comment": "Malware payload", "value": "471edd7506612091e9f8ee99e718fe6a18cc705f109119e66cb9c2c5b400ba1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296963, "uuid": "2c65a74b-5255-4876-a981-f03d75ae2609", "comment": "Malware payload", "value": "288770e8e392116b1c692d31b9005cb600c5f6e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296963, "uuid": "0c897b6f-c948-47a2-8dc6-9ed8960dc753", "comment": "Malware payload", "value": "e737db5e430fb6dc1131d3049eeec90b649bd91ca0766bd206830396d135eec104a3507f0426f3768af992b6bc45817a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296963, "uuid": "baf906f6-8c9f-4e00-82aa-7e7d7df43f5e", "value": "T1149533CAF9E51431DE2DACB5983131690FB53E179DA75E4F384081ADDCBC16CB21B8A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296963, "uuid": "5a4733de-0889-4e90-b605-09d61a2b9997", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296963, "uuid": "6058fd9d-7158-44aa-a455-2f3a7df3e91e", "value": "49152:qD3GYiHySS7q3rcMyYTlp1IQm/qaSrrdOPOcSyGUpqVmZ5Yreu8CJq:qz9y4MyYTlHcRSV0TSyGVW5Yreu8CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296963, "uuid": "2f2f942b-a75d-4df7-bbf2-dcf11a1fdcca", "value": 2061824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296963, "uuid": "8140be37-f1a1-43a4-932e-cf492fc36da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296963, "uuid": "8f49cae9-4471-4add-914b-9bd8458d7144", "value": "4b341970d3bf16c23f45550f109fa509.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9719bd39-9b34-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646341071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341071, "uuid": "e63adf9d-731d-48e4-890d-d3c9a27739d4", "comment": "Malware payload (Heodo)", "value": "dafaea3a9954b97ac7f68b452441a156", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341071, "uuid": "9560f93f-fdf1-4c52-abf7-13b4d443b754", "comment": "Malware payload (Heodo)", "value": "47d78a83be65593d761edfd80c8b3bbd550e397065aa3c1722300dd5f29d5d27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341071, "uuid": "5c442e62-8569-4742-84e0-4ff9b713e4cc", "comment": "Malware payload (Heodo)", "value": "ae454f2de3fda921ab5fd0a7e13a99277840e9db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341071, "uuid": "74148d86-dbd6-4f59-a4e2-f16e9f3b0b0a", "comment": "Malware payload (Heodo)", "value": "1ccf0edd7b5eb7beebac312dd036f2a99afdf3f61ee931da511fed5db7087533cbb8bffacdc1fbc2fb4e6c55f9a976a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341071, "uuid": "104719cf-3058-4082-a6d9-ae6d55345850", "value": "T17FD47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341071, "uuid": "e000ebf4-1224-4eac-8222-8e92f931cdbf", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341071, "uuid": "e63fceca-eb1d-4912-97a1-74566913b092", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLlCjzhmD/bwb1r8Hc:Bg4IqjYTl20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646341071, "uuid": "813a54cf-55cd-4854-af39-2174c479f342", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646341071, "uuid": "893e92be-b3a0-4fc3-8790-1a4477fb3cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341071, "uuid": "2c8fb5d5-9ffe-4c56-84a1-fa6758a352f4", "value": "dafaea3a9954b97ac7f68b452441a156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68651e4c-9ae5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646307063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307063, "uuid": "c909a6c9-c233-44c8-80aa-a1f72976ed15", "comment": "Malware payload (RedLineStealer)", "value": "eb539dcdb61817dada16b890260bf1e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307063, "uuid": "ad5c6f4c-8a92-4493-9252-66cc77df4eea", "comment": "Malware payload (RedLineStealer)", "value": "47e3361c89502610abbb544c85c9ffdf46d466c45ac73452b1acff081e220f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307063, "uuid": "267aa1f9-d26f-4fa1-97b3-36f5604064c9", "comment": "Malware payload (RedLineStealer)", "value": "a354f13f4e61914ff6cde05c9ff80537435a4f09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307063, "uuid": "e2bf9251-558f-4979-b3b0-51e739a3883e", "comment": "Malware payload (RedLineStealer)", "value": "f6666e61b0ef66673d6e69f371facc08720a13bbd6f2d5ba5d627d9d61185934dfad1f8a5ee2bfff55a9b96087fbf1f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307063, "uuid": "80d55e8c-9353-458b-91eb-85030780dc6f", "value": "T1BE857B29F12BFC01C468A776D86497B9208C9DA2F07A1347767C3CB6BDB23EB64C4195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307063, "uuid": "4551f302-3fd1-447f-a245-4be001e45554", "value": "360cfec504e1d44d0f0fc21feef895c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307063, "uuid": "b4993911-faf4-4274-94c8-53edec4a40df", "value": "24576:OAXlx2wVYHWdE1KmcFCvtCbt5qew614JQUEPNj0xwxIZFEPS68xWacZ:OAr2wVYHWdE1Kmc4kbvcsexwGFaS608", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646307063, "uuid": "32b6dbfe-c0ac-4fe4-b7a5-0e09af1a9cbb", "value": 1705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646307063, "uuid": "084c54f9-5162-40c3-95d8-1973c0c0c03f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307063, "uuid": "e833bbb8-3927-481c-bd35-1aa6aabce168", "value": "eb539dcdb61817dada16b890260bf1e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9784c809-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300270, "uuid": "bf35c401-aa68-4dba-83db-e8162f19ff36", "comment": "Malware payload", "value": "75316b40ed6605736b31a4c483b772ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300270, "uuid": "62d26227-5400-4cd9-9cee-72b61ba312ae", "comment": "Malware payload", "value": "48769d84a893bbe5baa8958171287721fb444634cf40a98028c2110c92f5491d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300270, "uuid": "14ba8aa6-5f7c-4e16-a3f2-283b39d60951", "comment": "Malware payload", "value": "cdd50373ad7aef1cae0c2991db7c95b49e75fbae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300270, "uuid": "da42ade4-ffce-4bbd-98e1-9e8874eae044", "comment": "Malware payload", "value": "b21213185d99dd3db5b8f460e1586c3af9a50e83553ee5df237c3ade011fa2a4c42fb091b71329d136a44f5665b436d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300270, "uuid": "d57da253-a6a7-48bc-94f1-b4f4ea693e1d", "value": "T12A53616BD7630C58C9303BFCDEA2D7A50A9C1F8D2C32C7DB49A5FC5070EAA4578499A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300270, "uuid": "d0618dc7-5e28-4d16-8c71-78695be35763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300270, "uuid": "e0050317-b2e4-47cd-8aa4-ff51587d8700", "value": "1536:vKjy9DgPwwsV0iOLdlEbaqEYdszM0N/q:vSYMPwKlnEbFEYF0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300270, "uuid": "baebce7c-200f-4f4e-958f-c7e7f6dbe219", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300270, "uuid": "680ed77e-f764-4a45-b3a4-551988f660d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300270, "uuid": "6908d4f1-8e86-4734-92ca-858b88ae71ad", "value": "75316b40ed6605736b31a4c483b772ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65e2b61-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320991, "uuid": "472d0db6-5a38-4cdf-930f-e800599e991f", "comment": "Malware payload (Heodo)", "value": "1c8da643ebad1c5157f9993af9b7323a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320991, "uuid": "1bd524f2-d992-4db9-9db6-397bd01f23d9", "comment": "Malware payload (Heodo)", "value": "48e3589c730cfac5743b7210c25d30f93984a63b44f96e73b6e62ec3fe60175b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320991, "uuid": "c9d4fe79-8f0b-48ed-8f42-ca58eeda8a9c", "comment": "Malware payload (Heodo)", "value": "f3b97917d0ac17c269629a58a89250071d3e4818", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320991, "uuid": "de75605e-ce3b-4c9a-99c0-ae485c78cffa", "comment": "Malware payload (Heodo)", "value": "48ae7ec1810c26563f8845dbda1494e5d353f75a23d2e979e8283d46836ef5722141577b562954220eacdfc7735b4399", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320991, "uuid": "c0c90f65-d642-474c-9b64-9fc0682253cc", "value": "T11B23E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320991, "uuid": "d7e3e393-a29a-4c64-8dd3-f817873fc399", "value": "768:a/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:a/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320991, "uuid": "6812a4d6-0297-4f34-958a-206ad196b27a", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320991, "uuid": "54b82e0a-3830-4327-9808-2690a24bf292", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320991, "uuid": "c61a3580-5e30-4025-895c-41798c47e981", "value": "OMICS.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff41ae3d-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "bc0454ae-05b7-4486-afcf-ff110bcd4f4a", "comment": "Malware payload (Heodo)", "value": "db9a3a491f4b18844f9d391a0ee8dc4c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "175087f1-4860-4b9b-ad5a-d2821342256b", "comment": "Malware payload (Heodo)", "value": "490057339fbd3ad23125dc19ab1cd471a33c27014bf6936cbb04ff4af3242f72", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "289aa5bc-75ea-4921-b37a-7d2188b95210", "comment": "Malware payload (Heodo)", "value": "aaba7f9b9ec94868e615712806ff6a50766b9403", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "88541dd7-bab8-4913-9cd2-f463648a117b", "comment": "Malware payload (Heodo)", "value": "cf746b368042c2105c77edadf5b434aad46ad8de4699d9553e99be311d49e2697c3863fa8d76e871f87c06ead2c3ef06", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "fa47be10-84b9-413f-92eb-f07ca27ea261", "value": "T123353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "e7b86404-509c-4e96-afa6-72244632a4ab", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "1b749cb5-e6ec-4229-923f-6bfb1f554795", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZ11EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZpytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298726, "uuid": "98694616-1cbb-4e91-91bd-dc3e5cdf7d73", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298726, "uuid": "a5e84c6c-6082-4e50-8797-45bb537a8377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "a3044a52-373c-4acb-9f95-0aa17179845a", "value": "emotet_exe_e5_490057339fbd3ad23125dc19ab1cd471a33c27014bf6936cbb04ff4af3242f72_2022-03-03__091158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068f690e-9acf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646297450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297450, "uuid": "a4198237-7f9a-495e-b26c-7ecf7fd7fe44", "comment": "Malware payload (AgentTesla)", "value": "4a7b51dfbf4ca71b234dece32bddce4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297450, "uuid": "4e7bb397-c6b6-4be2-8776-0b924c53b009", "comment": "Malware payload (AgentTesla)", "value": "4930b77f5a3202d0ddc12d8f34453d347359b0af6f1775d9158e2608d4292b57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297450, "uuid": "75a2fdcd-ab16-42d0-b397-20c5d28bb9c9", "comment": "Malware payload (AgentTesla)", "value": "d168501667b5fd29b34db4c9cdd6e0edb1298687", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297450, "uuid": "7bd3bd87-986a-4821-870a-fcd3de029b3a", "comment": "Malware payload (AgentTesla)", "value": "27499ccf9da2a511f929bdfb81ed6ba931076a0d15ff6fb5a29ce896a60a1046761aada531d0db9b15fa02e9aedb9029", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297450, "uuid": "e67a1937-5ecb-49a0-929f-74fd160139bb", "value": "T1D90533C2314767C01ABE02E397BB34E30DAC7517361E85448DFEF646B1E56A4B292B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297450, "uuid": "26ce3b31-4852-44c1-a39b-18fb0af88e89", "value": "24576:SLQ9250UCHJ31TZ9B/Y4IvgFQXeX/hoI/:eQ96xCHJ3xZPdVX/hr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297450, "uuid": "03b4d565-8cc3-4780-a438-c2f299fe028d", "value": 796702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297450, "uuid": "10a2e4d2-1514-4c19-a3d6-cd20aae3443a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297450, "uuid": "21aff46a-5d36-4407-9b18-9c64311d5088", "value": "PI Payment for darwin 46841310 MT103 Swift receipt receipt.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ce830c-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298151, "uuid": "cbc351a3-f832-4240-9c01-07868c58dc5f", "comment": "Malware payload (RedLineStealer)", "value": "19712fbd964bfb217deabaec600e1f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298151, "uuid": "47d99b37-0a1a-4b61-921a-4a2f9501c21f", "comment": "Malware payload (RedLineStealer)", "value": "497ba6ba4fecc59364baf93ab6e3ea54ed282cbcbdb0d78d3a77b5155d9fb36f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298151, "uuid": "7d99b78b-efaa-4b6a-9ccc-3580a3d53e03", "comment": "Malware payload (RedLineStealer)", "value": "2e4279c9ae42bca9bf06ff3921cae1ab9ecaa8d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298151, "uuid": "f29cd740-a251-46c2-91ef-aa7866106435", "comment": "Malware payload (RedLineStealer)", "value": "528d92cc01f695bf48bf61f7b7fc9ff15ae906eda2e6b137e962ec2f5cd5156651a31fd55a87bc1bcb62c3ec5239a533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298151, "uuid": "f90c9ab4-d7f0-4e23-8fae-926fae6e68b2", "value": "T1ADA51223EBC5B5D6D04970B62B2641F046F8EE64A80D3572F81DBDC952F928D49CA3CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298151, "uuid": "75903b19-b871-4abf-9983-f03b83f0be30", "value": "e7a75da9de1f843da712528d4a86b920", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298151, "uuid": "e75c933f-0c76-4227-9c25-bbeb2f5313fd", "value": "49152:YjoW333QqWQAWj7IxBHMx/dnE+VRVxCAnKuxbxbsI03NCeRBY:goW333QqWRWXIxmDbfxnx4I03NCeRBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298151, "uuid": "2b465a32-9c81-48b9-9cd2-0590252f5d3a", "value": 2089712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298151, "uuid": "3c07d1ba-0fb0-407d-bf63-268732283abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298151, "uuid": "71e00c15-a934-4d46-9215-af5c470830ee", "value": "19712fbd964bfb217deabaec600e1f14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d31545-9aff-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646318066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318066, "uuid": "e07a93c0-2554-4a55-8d16-7b7ce1e15261", "comment": "Malware payload (Formbook)", "value": "c1392a72d7b005ffd6a0b834f0e8b6f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318066, "uuid": "a8cabbf4-bc3c-4c5d-8410-c6cd404b2318", "comment": "Malware payload (Formbook)", "value": "4a0e9c1b5c23074112d8c5845451f43017d09ec024f1d993854e2fd43f8f2814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318066, "uuid": "c87b770a-3cc9-4229-bbdc-b7a152ccb5a4", "comment": "Malware payload (Formbook)", "value": "e50e19353e16b08cbefc4f91206566310e75ef2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318066, "uuid": "adcfe93d-ae66-4111-b646-fb0cd0ce20dc", "comment": "Malware payload (Formbook)", "value": "b0e5e0d33232ea4754f49b41e682aaa8a8ffc5f23d68d47391ee7a85f445999f63fdee3134044d7a0da7586182062f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318066, "uuid": "a95a0c70-014e-4108-9e2c-093ca8a2e8fe", "value": "T17D64128679D28DB7EA936CF4846B37BAE3F609CD5E601E8307A05E7D7CE51074A06342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318066, "uuid": "453bf9f0-7a19-48c7-82e0-eea0e3cc81fc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318066, "uuid": "2daff121-8ada-4a3b-bbb7-83f052defdf2", "value": "6144:rGiWsXgjy35zrIjKUWEiLGq9Sm6pb2pYbvYl+a8ZQccc/CQAjgaHcHF0:Jg25/IjK8iaqC5vYQTZQncCNgm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646318066, "uuid": "afb5050e-9da4-4a08-9f72-e6dc8eb853be", "value": 310122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646318066, "uuid": "2e719fb3-e4d9-4527-8fec-fe624a384149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318066, "uuid": "1ec6d027-d0f7-4664-8f74-566770747251", "value": "March Payment 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e537ab-9adc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646303372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303372, "uuid": "8bb4847d-cf65-4278-b84a-18e872832864", "comment": "Malware payload (Formbook)", "value": "99f094cd812efb67f3846598e5e125b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303372, "uuid": "749327e7-6b80-431d-89d1-b9f07a457849", "comment": "Malware payload (Formbook)", "value": "4a1f4a6adda494107983a13f25aa6b9d297d62980557bb1c892d49028bd688e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303372, "uuid": "6f0a702f-87b6-45bf-8771-6168136b0e47", "comment": "Malware payload (Formbook)", "value": "38b1fd4bab5a764ec9f6313ae2e192166995ab62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303372, "uuid": "328b967c-a786-4a35-be9f-ab38d7dcdca8", "comment": "Malware payload (Formbook)", "value": "6488cb22edf1802ffb19959c2f149abc8259487914281a824b50c9851502b671c86495788326374f75350a966a1cb4fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303372, "uuid": "622d367c-869d-4e28-af99-e52a8aee771b", "value": "T1B515D00439E68034F9768BB0CAC4E7F09B6DF625D549B0F264105E257642BBEC94AEFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303372, "uuid": "9f4e166a-9147-4f9c-8c78-a35fd7f8e64a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303372, "uuid": "28e45330-169f-4cc9-8872-c3e5484ed6df", "value": "12288:0QR/IyTTgMnlCFpWKkX+MokkptLM5c2QAZG1Nqp0kDofRpt8MLpmCv/wl/3:0Kw7euMokkpuS2QoEwpZDofXt8ML4ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646303372, "uuid": "089ba670-b366-469c-960d-bc21806b7e55", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646303372, "uuid": "ee6bb6e7-5e3c-4c41-859c-5e1eb2557510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303372, "uuid": "9d6e38bc-8250-437a-a50c-b49a7a647f32", "value": "Ass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406fe2e2-9b00-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646318592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318592, "uuid": "880fe09f-d71d-4490-88df-b00d5533ff7f", "comment": "Malware payload (RedLineStealer)", "value": "a5f924b4a343a097483cadfec1132c9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318592, "uuid": "1b694716-ca9f-4bb4-b38f-b591113917eb", "comment": "Malware payload (RedLineStealer)", "value": "4a4a54ed6cdfc63d3a4f5795f967ffe6ad2b30e44d1dec885bbe5ca7188170ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318592, "uuid": "e85956e9-4caa-4dec-9552-59d9aa4ce74c", "comment": "Malware payload (RedLineStealer)", "value": "b8f5f1724eb8d9802b485ea39b0aa476ded029f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318592, "uuid": "fa7fd38e-eb23-4763-980d-b22302b4a20d", "comment": "Malware payload (RedLineStealer)", "value": "f21f0d891d84cb6168c48f3ee9418dcc9fb12d95c0428a01ad7ca75f49ad3214d6cd66320fb8c496029a273b8320ca40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318592, "uuid": "63a25e34-5af1-4261-bc61-5ee0640b09c8", "value": "T159B42394319C72DAE0E5AAB69825CC9BC74E371174C34BC1C9D83FAE387C8383D6195A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318592, "uuid": "89d96e9d-2b9c-4d07-a11b-8a9bebdb4900", "value": "04458f7d0d12a5bfd997438503c0380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318592, "uuid": "f2be1656-7276-435f-a72c-7e96fda5bd50", "value": "12288:JZ3Y3IH9OdKDo3Vi3rK/lGRgOUqmq9kR6lhKXhB3a9FsqJKB57d8f6:oIHgQUi7K/cRgOnmq9g6wB36rKX6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646318592, "uuid": "3f2675fc-134e-4934-ae40-179638aba0b0", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646318592, "uuid": "62e371a9-2a10-4440-b299-bf01a91c9c22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318592, "uuid": "a880c17e-2aa5-43a3-8eeb-29ee616674b3", "value": "a5f924b4a343a097483cadfec1132c9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef237f0b-9ace-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646297410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297410, "uuid": "ca487715-8e98-456a-87e0-eaefab6e8205", "comment": "Malware payload (RedLineStealer)", "value": "a8d8af2817dd1628ee3d3135785387b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297410, "uuid": "c53e2cb9-f770-459d-9750-a659623a03bc", "comment": "Malware payload (RedLineStealer)", "value": "4a59190e199b69f65aa69f2f5f1f6b568d49a052868e2c853b7ea1d70c04a953", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297410, "uuid": "77d6b4ad-9f63-48e6-a2a7-50ed91e3790e", "comment": "Malware payload (RedLineStealer)", "value": "ddfc0ab8298de1ff8859d10fe704f01d0dbb0ff6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297410, "uuid": "bcfa6341-8e69-4fa6-9bb5-36445f24263b", "comment": "Malware payload (RedLineStealer)", "value": "f0e72beb64bac670cbe3c86d3546d1e0da68bd2917c4bb8184853b038e2325a3b01abc3d725acb96e16e222c001ccc30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297410, "uuid": "4dff381e-e7f7-42d9-98be-232f01952398", "value": "T149F47C16F3F2C4B2D32A05787C67726454197FC52C289D872AF47E1D7E392C23829E9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297410, "uuid": "5b1b97be-16d3-4ef1-bb8e-1698bcd1e4da", "value": "bb8b994ea7204a3a00105e8b9f8cb8aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297410, "uuid": "92c22216-e59f-45fe-93d5-cbe34d878347", "value": "12288:Pntj1v6o5x1oBghwJ27DKDLu0V9PUECzl5Um8OPyzZFJ+:PnhH1tw2uvukIsOPyzZFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297410, "uuid": "585e5782-28b4-419f-9372-ebf72ae8c7d2", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297410, "uuid": "0cbda6cf-f25f-4d83-ace1-b2ad00ad5f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297410, "uuid": "8b5a9bd7-8bfb-4e32-83bd-ab68e73d0950", "value": "a8d8af2817dd1628ee3d3135785387b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f68b10-9b0b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646323279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323279, "uuid": "eba571e1-d089-441f-90a7-31ab813502cf", "comment": "Malware payload (RedLineStealer)", "value": "1ac2b26a2078834185eea185cb6a96bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323279, "uuid": "21638a0f-8d0c-419c-8952-80fefa0d06dd", "comment": "Malware payload (RedLineStealer)", "value": "4a96be9e70fbdfef2c27ff3eb81cd02c1d5d4486f7fcdd49d82accf3d5bd2c96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323279, "uuid": "aa46475c-9ac9-4b55-984f-6e9d677f5110", "comment": "Malware payload (RedLineStealer)", "value": "2a651b77d4d86853d72a0b2001cfd507b0018bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323279, "uuid": "9a739181-7541-4132-8fc0-3b20fa67cdb0", "comment": "Malware payload (RedLineStealer)", "value": "98627523abbeea53a9b956eb8c0a65c057f123848ea8fb483ce6cd5ed91b4979a8b2ec2b7e2e3fab2898dab52529b68c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323279, "uuid": "b31bab3f-ca71-4d29-98ef-e0ada806b9ae", "value": "T1BC3633CAE3E1BF83C05F4A34C6748257F1AD27108598B49F7683BB0286798972BDD395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323279, "uuid": "07cdb477-a5a2-431c-89f8-9b7484b8843e", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323279, "uuid": "897e3eec-4aea-4c17-bae1-05179472fe83", "value": "98304:0SPG0sTNu6WxZuVulbLTTyV7RmfQAytKU6223fOSv6nItToodVl:fsZWxZBVTq7HA06hOSynI20r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646323279, "uuid": "de1209d7-9149-4226-93d1-d32a920f2bdc", "value": 4993992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646323279, "uuid": "2cd37224-9151-497a-8122-838c5b6fb4bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323279, "uuid": "fe4aedfe-cfa4-4486-9162-95c90cca1b09", "value": "1ac2b26a2078834185eea185cb6a96bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae02085-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646296544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296544, "uuid": "20dcaa52-eed1-43a0-95cb-9a013ec49ae4", "comment": "Malware payload (Loki)", "value": "4777d1b0e8aca1645335868cd3d4e501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296544, "uuid": "d5bace26-4c48-4000-b55d-c1e30ad6efe5", "comment": "Malware payload (Loki)", "value": "4afd92f01081ab0cc7b11a50b9a5bf980f3a7aec5d3daba1952e2887b676cebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296544, "uuid": "7e50bd7c-198b-4d1c-a33e-4d9915d53b65", "comment": "Malware payload (Loki)", "value": "5976363c9f0ca0b9abd5d654766d620cd559368b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296544, "uuid": "ad0d55c6-2999-4918-8d49-9a0f9d707669", "comment": "Malware payload (Loki)", "value": "2b0190e3661c35a1607847e9dbe82dbac8bfcca84d84022b65d1f302f516d26740d1567cb630ba308ff044d9d96cdac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296544, "uuid": "55812570-b47a-4a43-badb-500380d916f6", "value": "T1B4542306AEC16D33F1A36A3942B2373EEF7D86A916B0695363E45FBDDF11054030A791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296544, "uuid": "90e56905-35cc-4d35-8998-2f55ed9ffea4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296544, "uuid": "96fb175a-1c22-48d1-a39b-0ddce0bddf18", "value": "6144:rGijDaVIAwXr1v+hwbTSjgkMbqT0ruKLdG9Gu2Gm7mJCAmL1e5+noKQ:cmXre0T1ZbqTCjLdGgu2G1UhK+oKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296544, "uuid": "50a08de2-8d42-4319-a234-4e62bdb3a195", "value": 303550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296544, "uuid": "8e9c6e3a-3288-4ca4-9afc-33a20df4e011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296544, "uuid": "10f9c986-7b5e-4551-a22e-68091703e709", "value": "4777d1b0e8aca1645335868cd3d4e501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6cceb6-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646296604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296604, "uuid": "94bde003-c699-4ff8-9870-52845a56ce67", "comment": "Malware payload (Formbook)", "value": "0187f138451e403c7c887aae2362bc77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296604, "uuid": "7461fbf5-fd3c-4610-b1ea-3f48328652f2", "comment": "Malware payload (Formbook)", "value": "4b0101745308eec28c38cd2c0b4058c542903099a94b7a5fcb03c11155396987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296604, "uuid": "9d19c6b8-5b67-4902-9731-c08ca3ab5464", "comment": "Malware payload (Formbook)", "value": "f9e960ed84bb90054ceb93715567305cf3db024b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296604, "uuid": "da3ccf00-643f-4777-95cb-56b5d105f546", "comment": "Malware payload (Formbook)", "value": "54bfe31a2257fb6bf62c724136b0965f5cbf1f6458c05010d30d1c85280c082a59b93b31766f5196e590b2d4360f2691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296604, "uuid": "cd630d9c-33c1-4faf-a3a7-816f4be1daf1", "value": "T13955F102E4AA6512D77C5C7C615365336B9B4E7F087F810346B8A25816839FB3E3B6F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296604, "uuid": "5f9a986a-9f12-41cf-8b84-8777d4f8f85c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296604, "uuid": "78544367-bf93-4ae5-9718-4fe2505e7cb7", "value": "24576:pSEZiPQ+LjVIQUDeeD2drnJPXFzxRnLA:pNZX+LjvB82dbNVzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296604, "uuid": "53274b4b-1ad8-41d2-a5b1-61bade1ec408", "value": 1332736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296604, "uuid": "40a1eaa5-b608-4aa0-b361-204b56250641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296604, "uuid": "9da835b5-9dbc-43df-8427-b4f19caa17c7", "value": "0187f138451e403c7c887aae2362bc77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe615667-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265653, "uuid": "fde9a5f3-2fc1-4c2c-9a62-0a09afd6c0c5", "comment": "Malware payload (Heodo)", "value": "0b07717bb04df94a69435779924c9a23", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265653, "uuid": "643cabd7-da3f-4fa8-9382-7b1272dedb04", "comment": "Malware payload (Heodo)", "value": "4b12f9c168ecc4aacacba90bb96922ac3786b128beee4de2bd9172a6513b2c29", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265653, "uuid": "093dbe02-5f39-4ca7-9ac9-8f29ff2acd5c", "comment": "Malware payload (Heodo)", "value": "507e5028cbf27f672cc6407c3472aa3deb662686", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265653, "uuid": "dbe62612-cef3-4f22-9938-d048bce1b926", "comment": "Malware payload (Heodo)", "value": "4114d7e5ea441049ed6c64f09a3e204a34ce2daccdc697751180dae7d773429752c69bc1f44991fd3f1ee89d4664f649", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265653, "uuid": "c533600e-e05a-4088-97fc-9e7eccbdcc67", "value": "T103D41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265653, "uuid": "2aaa75ff-22fe-44e5-b152-7bc55da36063", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265653, "uuid": "87b69d36-b547-4f0e-9031-0618c2b45601", "value": "12288:DjN/Z2wkRrA9CRDCTElAjHDsndSyHOrNvEP0Oua:dEHR+CRpyfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265653, "uuid": "89b4549e-ffc8-47f0-9b97-8eaded3e5497", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265653, "uuid": "1209f61d-4762-4eb0-869e-2f5d3e45bba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265653, "uuid": "f887c5dd-4add-4c95-8908-b5ccaa42dd0c", "value": "emotet_exe_e4_4b12f9c168ecc4aacacba90bb96922ac3786b128beee4de2bd9172a6513b2c29_2022-03-03__000048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06766fbe-9ac1-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646291436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646291436, "uuid": "3af0ef47-052d-483f-bbef-0b6123407929", "comment": "Malware payload (Loki)", "value": "9bac7ee3f588449b67232fd000a43e83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646291436, "uuid": "952240fa-4ec8-4848-b2d5-b502274655d5", "comment": "Malware payload (Loki)", "value": "4b8a84e8275c86c6d94841378fd886732eaf2e4d9b2c9e0c69e0d027ee1b66e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646291436, "uuid": "245799f0-1248-4306-b5f6-046e503116cf", "comment": "Malware payload (Loki)", "value": "91059f19eed2a27eacd284cb24cceee4567285e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646291436, "uuid": "28e982de-4990-4b20-9cb4-276e71c8ffac", "comment": "Malware payload (Loki)", "value": "39f2f382a3ab47eb0b4ea286156538477e7ac9285b0df7cc8c328511e23ff684c2f36be9bf8b9759b9eb30a5557f5c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646291436, "uuid": "4bf08820-1239-4b86-b10a-cb7d79d67986", "value": "T12954231B16D381EFEE931C71187FA7B692FBC78406801E4317F45D889E30ADA2E5A2D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646291436, "uuid": "ed84a31d-7e85-4abf-b531-cc961563a29b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646291436, "uuid": "07987a71-605f-474b-9546-5da5540e6a31", "value": "6144:rGiR3gv4hke89bduRg4IA0UOwNNU68aKY8o+4oQWJMU5uH:hgAIHuOdA0UhNUCKYWQWmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646291436, "uuid": "fa99e2c2-b015-4cd1-9bbe-4169fd31cc03", "value": 301174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646291436, "uuid": "295adb3a-6047-49cb-9707-6bd7cfccf820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646291436, "uuid": "2f89f2d1-c0de-4374-b874-d1dc56768125", "value": "SAM21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f32805-9acf-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646297742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297742, "uuid": "05035db2-c96c-4bba-983f-25bd54a064fd", "comment": "Malware payload (RedLineStealer)", "value": "481b2848e9fc1d51580b6e57a39f7c4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297742, "uuid": "b02b118b-2a7e-4344-8356-e3471e0ce1d5", "comment": "Malware payload (RedLineStealer)", "value": "4c817eeebd3a22a8e69029556c7d86a425718309c4646feb0dcb4b31fda6a693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297742, "uuid": "c5413959-5aab-4102-a6b7-890f64bbd232", "comment": "Malware payload (RedLineStealer)", "value": "ddede117bf672ec4c98320c14fde0fbdb90fc112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297742, "uuid": "b8c509b4-f523-49fd-b877-b830a6778145", "comment": "Malware payload (RedLineStealer)", "value": "c7ddf1cfdc57b71d491f734ab4c8fede6ccb329f1240fc045f1f5ab05705d810c2db52f11626141025d05a8753fa5820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297742, "uuid": "baaf88a1-efcc-450b-83a1-0999c2a3bfc9", "value": "T1F234392833FB8426D2D88B35D5C895458BE8AA53E507FF4A309823D68D137E3E907767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297742, "uuid": "4cd52a5e-d5d1-40dd-a7c4-fdd4af35e728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297742, "uuid": "852052ed-daff-4ed3-bb3a-2c24ea30b4be", "value": "3072:O2w3vtItYL3UWoODPlTonM9x0f6I/78ULTrpl9C1dANs68hJo:AOy3UWoODVoYTIQUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297742, "uuid": "0b92823d-a653-4430-9e09-4134818da764", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297742, "uuid": "9c605739-1c95-41b1-b607-7f3a0a381061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297742, "uuid": "0c8b25c4-c31a-4623-ad32-a7027b1755cd", "value": "481b2848e9fc1d51580b6e57a39f7c4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a65248-9aeb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646309877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309877, "uuid": "c52492e0-821e-4998-b312-87c21b2b1ea8", "comment": "Malware payload", "value": "bd877a41c2ef94cefd219e8a4ab1fbf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309877, "uuid": "e72e0c60-e86c-4a49-b3c2-f5cdbc4362b9", "comment": "Malware payload", "value": "4cd1d67747a482e0b33902ee9e6675749561bc9d2c06a515cc6ba8a74ca2df29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309877, "uuid": "4b2b10c6-c8a8-4540-8b4c-b410b7d16be7", "comment": "Malware payload", "value": "3483dc71829e0e3bf67a5be15ae904c66dcca0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309877, "uuid": "de7c9355-f342-49d3-836a-2645c1e02db3", "comment": "Malware payload", "value": "d16d0f2636b0ba323292c114e1ec9be5291b3a926bd98e6c6585f0641ef1a1368206aa232938a4d8d1741a1c1338b375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309877, "uuid": "a2362daf-1ccb-42be-abdd-5b60515388b3", "value": "T16D048E5111D342BFD851E57099EC8990C6EF7E223A758FDBA20C267ECC396A1037BE16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309877, "uuid": "91116b71-bb5d-496d-82a6-88c789f85772", "value": "1fa4c5e9e8122bdcccc0c9ed2ff9222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309877, "uuid": "eb3e6635-0274-412f-903b-1b17353cb998", "value": "3072:SRejuS+WFrcM47Fb116o3zpZ2twyKpQJ95u6sTNEr5pb2:aejuSDcn7Fb116gvzeRu6F8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646309877, "uuid": "45f44a31-816c-4052-8b82-464340b576b4", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646309877, "uuid": "2a46660f-c37d-4564-aaf0-b7c73a74e9cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309877, "uuid": "92cd4a90-4e2d-4c35-80f8-3e104f47916c", "value": "SecuriteInfo.com.Trojan.GenericKDZ.84573.10299.23519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf255d2-9aca-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646295633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295633, "uuid": "241288f5-b209-4e6a-b480-a2bc2c3498e7", "comment": "Malware payload (RemcosRAT)", "value": "5fde10d09055e621c0c1e1845944c618", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295633, "uuid": "3758a79e-d1df-4bc4-899d-d7e23e05fa43", "comment": "Malware payload (RemcosRAT)", "value": "4db872f497b1912ab8d86d82ee0ff256f8166e4b91b42d5b25717d37a0f3771c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295633, "uuid": "e978b15b-a429-4d90-b1f2-db0e1ff5dbe3", "comment": "Malware payload (RemcosRAT)", "value": "7085477e0ae45feb95f166856b5178db8781434d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295633, "uuid": "f7146cfd-24bb-47d4-a9e6-159fb78af349", "comment": "Malware payload (RemcosRAT)", "value": "a4276bdcaefa5e9665f126a9e7ac0d751522ffde94e6ccadf5fcdbe852a6ea3ab9b4696c618bfa7042d7ffd74354c2a2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295633, "uuid": "83ed3153-9a15-4f90-9e4a-51728b358abd", "value": "T193E52DC04B08CEC8FA56E0C137EA79A5B04E63541C94ADE42DDF7BB21259B09F9DC876", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295633, "uuid": "438702ed-bbb6-4ab1-9ab0-8acce5262d4e", "value": "24576:3pISfx3JftKYkyj8L6iZfGOax/gbCzp1bObsXOuQPU20Ep0alGUB7VcHr7dTPaWl:nJfCXCzpRB7go+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295633, "uuid": "91b57897-f5b6-4a95-aab9-18fabb78db42", "value": 3153930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295633, "uuid": "d58b9c4d-4bdb-4f3f-bde5-c85f72b6f278", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295633, "uuid": "baa521b6-abad-4c11-af7b-2a540e8efc2d", "value": "Stephanie Akira CV.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b0f6dc-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298341, "uuid": "9f488202-ef3e-4c7c-85ff-4dfa91839801", "comment": "Malware payload (RedLineStealer)", "value": "640a4062e2342bec319aba59ca0173bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298341, "uuid": "1701df63-b4db-449c-841d-97ebde16d3d5", "comment": "Malware payload (RedLineStealer)", "value": "4dff3b9f6ec800110b9744c9b0cfdfc3bc805dd9a44e5d8a41f6e1a89f636173", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298341, "uuid": "13eff132-c510-4038-9dc0-e8e2d7e4540d", "comment": "Malware payload (RedLineStealer)", "value": "251aebefc6a7c9349329eae12851b4b7ba3b7865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298341, "uuid": "e135d1ff-d16d-4c9f-8f55-a79355f6bb0c", "comment": "Malware payload (RedLineStealer)", "value": "2168272261305ef9ab66c28884050af9b29e93d8b98cb477fda6a3c2633598eb39fe0bb81805554c200e6694b0461edc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298341, "uuid": "26396f21-40ed-4c12-94da-ff5b00d61789", "value": "T174C423D7BBD87E4BD90F0D747A60AA37EDF06292B7C4908391708190AB503E7BB9411E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298341, "uuid": "bc95547a-e3cd-4e46-831e-ffee8cbfadbe", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298341, "uuid": "c0d90f02-a2af-4c2f-8515-33c826a99ce1", "value": "12288:9MH+lYTHo2Ko5uKkTYYUXchM00DQS03ULaHNqrxlKIQNoYpczQ+yIA2K+lN:90+lYU2h5urUs2dkEaHNYK3szQ3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298341, "uuid": "a551d852-b032-464e-a3a6-c7ce7097e144", "value": 564896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298341, "uuid": "4a80a52b-bbb9-443c-97dd-a333850b3d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298341, "uuid": "5eabf8bf-d6f3-4483-8d08-e4dd084640f5", "value": "640a4062e2342bec319aba59ca0173bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426c2444-9aa1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646277793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277793, "uuid": "0a438784-2989-47b5-bb86-3b5271bbea63", "comment": "Malware payload (AgentTesla)", "value": "791986c09e471f2c53352a0344523162", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277793, "uuid": "c4edf831-2ff4-411f-9a8c-af0dd1b5903d", "comment": "Malware payload (AgentTesla)", "value": "4e0f3a2f46f7425b2d46b6eaa6219296bfd89a1747e5a890c406337f8a24ed32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277793, "uuid": "8b5cc171-7c74-4f02-b7ee-3e8cb024f1b4", "comment": "Malware payload (AgentTesla)", "value": "f7a770cb8ff2d63de861d7ba0117e2e15d118174", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277793, "uuid": "ba222400-296b-4d8c-a25b-e3624dbcf7cb", "comment": "Malware payload (AgentTesla)", "value": "6de6ec0c766a599448fa800fec0a431494d83a505869086e678ebaf1450bf96c443fe5c24bd950c92b9986e9b595330b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277793, "uuid": "1852e0fd-82dc-4c9e-b060-0423c913b4b5", "value": "T13E52621137BCC2BBCB6A0272D82293F036E3AD95C85E89AF68C43E1BBC35611555C67D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277793, "uuid": "f540e479-fc8b-4deb-bc58-39d6ef2b548e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277793, "uuid": "a6e201e8-c42d-4ff4-a61d-9558cbe29b7a", "value": "192:MN74K/jwtbRQnzxecbwxT2r6kKEses/zyR6ZS8PbqsM:MB49tbqnzxe9TTkILSKbqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646277793, "uuid": "d46dc5c6-3e6a-4aac-b37e-7c6d3be46dbe", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646277793, "uuid": "699153ab-c8b8-4406-a722-4b3955267ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277793, "uuid": "eff5b3e3-c42a-468c-90df-7ac1cfd5e47a", "value": "Vsmoinpav.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f10df9-9b0b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646323572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323572, "uuid": "fcd5294d-46fb-4218-9889-c0f9382b4269", "comment": "Malware payload (Heodo)", "value": "311c3846bc308b9df997ef77657755ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323572, "uuid": "b70bf252-c2bc-4c7a-9942-e87d369d6512", "comment": "Malware payload (Heodo)", "value": "4ebb3a8eaf7ea56ec740d1d6027dd57858ca7647a3256be64d905df152864666", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323572, "uuid": "5cd07749-4d46-4277-bba8-b080a79b0512", "comment": "Malware payload (Heodo)", "value": "7f4382fc41974b498ef5c8a5e331368138faede7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323572, "uuid": "7b117942-13d6-406b-b694-46264fa74db0", "comment": "Malware payload (Heodo)", "value": "777a97d7e5babd4bc840817dc91b19d0ef6a33a9f35bedf4e9acf07f8fd5a6ea3969681edb9c5090d1cafad7e42594e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323572, "uuid": "760f96f0-9eeb-416e-8aa7-8ad9668a4729", "value": "T1B6353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323572, "uuid": "6ea70e0f-05ce-46d7-b41e-3fcb8c23c441", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323572, "uuid": "057ca04c-359c-4baa-9de0-d4c9f34479b3", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZx1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZFytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646323572, "uuid": "85e03de4-1a1c-4dd4-8f82-861fdfcab3e3", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646323572, "uuid": "ec7d3364-7381-443b-9d19-41257c74079b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323572, "uuid": "3fa34259-b326-4b0b-9421-c70b3ff88aad", "value": "311c3846bc308b9df997ef77657755ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522bb4be-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "bd61d794-5129-4001-803d-d0ce2205d1e6", "comment": "Malware payload (Heodo)", "value": "a672b64af54a055a2700040204b991f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "ab20dcb9-682f-42b9-b28f-caa775cfeb3e", "comment": "Malware payload (Heodo)", "value": "4ee284088e683a2bc4f7b4d334a9d6e4f0ef6c1f8c224c7cf9c515bf5170854a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "f44d5d3f-8715-45ec-9785-cf49a72cf54b", "comment": "Malware payload (Heodo)", "value": "c8f7fca315e52c804a33e04f06504ccb2f3d6dad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "48442eae-1d8c-49f4-830e-815d401d0e82", "comment": "Malware payload (Heodo)", "value": "22ec9202fb923d027d6c5b28bff0e8d47523d3d1c434ecbe9fd76c527a2c60f2925f209b337d7069706efc316fa717e7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "f76d6834-60dd-40ed-8447-1239cb40e920", "value": "T1BFD41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "3546db2d-b9e4-4985-ace6-e43e25c21b71", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "fa034681-384a-4c04-b388-ecff5621edc6", "value": "12288:ZxpNJJJ2NHPoczJiOtIhxf3foRXIa5EPwvA:Zx2gczJiFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265794, "uuid": "5777a8c3-dae9-451f-8114-85fa37616949", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265794, "uuid": "46ccbc7b-c774-43f7-9b41-304e458c72c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "4e421b03-1c42-4de3-ac7f-2844694a6427", "value": "emotet_exe_e5_4ee284088e683a2bc4f7b4d334a9d6e4f0ef6c1f8c224c7cf9c515bf5170854a_2022-03-03__000305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5a4261-9acf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646297733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297733, "uuid": "e0bf6db2-e5a1-445a-b3e6-dc57abbf3c82", "comment": "Malware payload", "value": "1e3dba0969fd9c1d692a23a8ec589ae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297733, "uuid": "3e9578fe-db14-486c-8144-777fdabd4444", "comment": "Malware payload", "value": "4f42851b11bb67d7fd25a2fb889938b494c2bb47eaea029140472fad07ddd93d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297733, "uuid": "efbe23dd-7be6-415f-aa2c-415206051eb7", "comment": "Malware payload", "value": "95a5b0d1807ae68e149712b4c89ecbb800a8660b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297733, "uuid": "b663e8ed-35b1-4457-ac5e-4fe0a547d276", "comment": "Malware payload", "value": "4286b110647fee147087f49e40cd7360470b0417369cb3b8478acb424c7b784cf82cf771b64cac582a47ffb90386edb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297733, "uuid": "0a0ec1a6-b144-4974-88aa-558e49b2fa87", "value": "T19A6512A2B555CB42CD745BF92A33082043EF9E3B143AC32D5CC676C2A7B7B18159AE17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297733, "uuid": "e2c0a417-2bde-43ac-9c29-5d2997652eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297733, "uuid": "2ab75b0a-becd-4dbc-9b57-3d9dd20c511a", "value": "24576:cuUGCIkpvWZgOQA06Xx5qZkX/UfybBx3CciBTiOb9hAPuzRugpnrSssUy/eyO:RUdBWu1uXjqZ+EgB9/LOxyPuFugpnrpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297733, "uuid": "8e569f53-9b02-45f0-8989-9ce328411a50", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297733, "uuid": "952ed540-9fe9-473c-a632-6011e9bd0ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297733, "uuid": "cc1a3ea7-6d44-4f99-8186-58ac260782c5", "value": "1e3dba0969fd9c1d692a23a8ec589ae5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d4adfd-9b28-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646335883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335883, "uuid": "44ce431e-38bb-40ec-8a79-a6c684e73ff9", "comment": "Malware payload (Heodo)", "value": "365c5728281ef0b2cda2e34df0274f43", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335883, "uuid": "f447ddaf-330b-42b8-b6ae-dc9a69bbed80", "comment": "Malware payload (Heodo)", "value": "4f4fdbf238a0d98b1bbc8dc60ea2f3a9df38e52ad7e312dd9a07ff02b5cadec8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335883, "uuid": "2ab95316-5f8d-4d35-b325-e5ce01521d08", "comment": "Malware payload (Heodo)", "value": "83064021144abde06345b883a8f5e939829f9128", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335883, "uuid": "8a5ad7b7-8b14-4248-92bf-9331bcf6ad31", "comment": "Malware payload (Heodo)", "value": "fc939c6658653bd2dc40007b19df9ade888ba48c508a5f47d1b38625d79a019e3e69985dd848419133ec4a0a479c9f50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335883, "uuid": "f9e44b7c-7ed0-4c27-8e3d-74c858b55c7c", "value": "T10ED47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335883, "uuid": "c625c2f5-56cf-4c88-bdcc-1f2994d8a8fc", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335883, "uuid": "c3e334de-3ed6-497e-b69f-003620226e4d", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLTCjzhmD/bwb1r8Hc:Bg4IqjYTT20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646335883, "uuid": "7bf2ff46-c39c-4f55-9cd9-8a3b7ecc5ed6", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646335883, "uuid": "cb049d2c-74db-465c-b84f-9e05bec476f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335883, "uuid": "9d7e18b7-a7cd-4dcf-9384-33f4aefbb4fc", "value": "emotet_exe_e4_4f4fdbf238a0d98b1bbc8dc60ea2f3a9df38e52ad7e312dd9a07ff02b5cadec8_2022-03-03__193117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131f749a-9af3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646312933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312933, "uuid": "565e16d6-3acf-4a63-8fba-68d8045f6a0f", "comment": "Malware payload (RedLineStealer)", "value": "3e42cc113c8a356dc4524a4dbd334df7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312933, "uuid": "cc00a508-87f7-4b58-808e-b6ad5ebce485", "comment": "Malware payload (RedLineStealer)", "value": "501a8b0b50cf89aa7b50e46e51f408398c4e5fec6bfa995e62b19c299e3d0a43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312933, "uuid": "ecab2388-ee17-4d31-8051-b361a654265c", "comment": "Malware payload (RedLineStealer)", "value": "30f7cdebf5150566e5384c0097a9df3afa733c65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312933, "uuid": "b36660db-fc26-4992-b87e-a52ff6de2731", "comment": "Malware payload (RedLineStealer)", "value": "e9a816bb4be9c2b372a40d9e2ef115f092ecb3ce47c33f8f5b903dd15c9c76dcad4d30d220f61e5f740582b2f2d368fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312933, "uuid": "7344cc19-9dc1-41b8-8607-665c4e9d707b", "value": "T1D4163373A043F57DDCC59EF677020BAAE702A1188C74C679A3D6925C7CE8A08C736A5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312933, "uuid": "38c41d56-7e05-490c-b803-38de2f51bba4", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312933, "uuid": "3488dda0-c7c7-414c-9ab4-0c8423bc78d2", "value": "49152:kfsETPLSniexw5J6iT8yxETj1cofo7zauI+VRuxOvtDmrgSMflAgkaBfW2thTzXC:kBunieQ63UEaJgEfNjkaBfHnuetC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646312933, "uuid": "f8308731-30ed-4fd5-a0cf-24ab381c4b74", "value": 4134552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646312933, "uuid": "5055fdb4-f2fd-419d-b028-960cbcd0bf54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312933, "uuid": "8452499a-533c-4aec-8d16-44bfec1995b4", "value": "3e42cc113c8a356dc4524a4dbd334df7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5034e160-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646298862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298862, "uuid": "7c201c30-d044-433b-ae74-26490111092b", "comment": "Malware payload (SnakeKeylogger)", "value": "7513d20a873aff1600bf429bdea78be1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298862, "uuid": "baa211d9-7c3e-4e75-abe3-70b500154419", "comment": "Malware payload (SnakeKeylogger)", "value": "505c69b0024e0cc4c6ceaaee5ee4b4d7dfb1f08677788d069a436f76f4d4b296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298862, "uuid": "2368c5b6-1e77-4c93-b8e1-f71bbeb0fdc0", "comment": "Malware payload (SnakeKeylogger)", "value": "4ad36fd9e94b68c8162d929e7afe44959e3ce034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298862, "uuid": "4094afac-241e-417f-ac44-087c3c655b02", "comment": "Malware payload (SnakeKeylogger)", "value": "1e8d15660ef9f679244b55842c65e2f72b987b150b227aba22d9504d75de08d75cf12d9369f828ec7e83f574a150200f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298862, "uuid": "9e2327b7-2f6c-4fac-a8d5-9e9596371aea", "value": "T1A905CF0439E69038E97A9BF1CAC4E7F08B2DF225E549B0F664005E157A42B7DC949EFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298862, "uuid": "f2508a1f-ada5-488b-8074-e4c7a8638379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298862, "uuid": "70c40661-551b-4df6-be5f-7111412ad3c6", "value": "12288:zUR/IzTykSx8YDTl9R5fzZTkiwGfl/Dgu2PQjAe1PNvJT9Udf6fV6OKyUv3wVqK:zf2Vx8Y/pTfpgu0GAe1PNwiKL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298862, "uuid": "629c23b9-6188-49c7-8d7c-ebbefa2e4189", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298862, "uuid": "421c8f9a-401c-4483-9438-d42c637d0bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298862, "uuid": "2bc8da17-fc75-419c-9815-27d3705ee928", "value": "RFQ AIPROPVCE008A0322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003b2485-9aca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295291, "uuid": "1f211184-e644-46a7-9a62-871999fec5e4", "comment": "Malware payload (Heodo)", "value": "9e2cf3640d38adcd31ae9a2737dea790", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295291, "uuid": "aaa33eb8-0892-4b6f-a312-c42cb8b929b9", "comment": "Malware payload (Heodo)", "value": "5074c190a12f978eded91ec68b88f93a0fdbc5c78a1bd59d5914fef82c809357", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295291, "uuid": "ac57acbf-9b07-4b8d-bd60-6966305d7250", "comment": "Malware payload (Heodo)", "value": "c4815fdce2e4a088d5bd3533f495f9ae9b42f18e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295291, "uuid": "8bac8547-ff1b-404b-a900-faef8feb6bc0", "comment": "Malware payload (Heodo)", "value": "faa61f471125ea231b1ea08f45e2b2f780dc30b39fe51d3b15cd8195e03393db91150ce05de0b536c8ee9f2b5734c420", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295291, "uuid": "2d03350c-ebca-411c-96b2-9b9d840a7b2e", "value": "T129D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295291, "uuid": "7e29ab89-a559-4003-b192-b38fa8631737", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295291, "uuid": "856fa824-44ab-4409-ba22-c89c2ac222da", "value": "12288:ZxpNJJJ2NHPoczJKOtIhxf3foRXIa5EPwvA:Zx2gczJKFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295291, "uuid": "7a9244af-b73f-4e66-b88b-b9953cb26d54", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295291, "uuid": "ddefecd3-d354-406a-bcd2-b6494bf34b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295291, "uuid": "b7575b93-9790-4df9-9d31-539cc06e8869", "value": "9e2cf3640d38adcd31ae9a2737dea790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8d9e94-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646294643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294643, "uuid": "364d191b-46af-42e3-ae3d-a5ffba72be9f", "comment": "Malware payload (AgentTesla)", "value": "23d7d00571d1b50566bad0fcad0e16ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294643, "uuid": "bef8af88-4157-423f-8afb-1562a51040da", "comment": "Malware payload (AgentTesla)", "value": "509ff55f15f3e4834e5ab181ff65060c3e08ef38a69afac87efbfd8e8847a300", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294643, "uuid": "084223a8-90d9-4a5e-85be-8d762ded130e", "comment": "Malware payload (AgentTesla)", "value": "b98079ec0d1671f7077289e789f9a15b90af3de8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294643, "uuid": "f3423890-a1b7-4dae-af34-1b4132c7d3c1", "comment": "Malware payload (AgentTesla)", "value": "5a1ad69aed69400b825c2e7325bc0edfb4c53a975c74c6c80731ee46e6925c2ce871341f74facf892be1ad4f6ea53265", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294643, "uuid": "7559f456-c11e-4d0b-a1e7-4a1950bd45ed", "value": "T16814122E717F81F6F9DA07B8D5076F670555FC346359DC02AA823A2F9DB12224F28C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294643, "uuid": "083d9753-bdc3-4a91-97f8-5fa1d2d7b5d2", "value": "3072:Cm0buE5Vt2llwbnzeLNM72/Ot9dTZnaAfARtPRgO7qdmo7o/Xxn1DlMNSAu6ytgI:/0burlwDz8C72/k/aAfot5f71o0/npM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294643, "uuid": "4e32e324-7037-4cb2-8719-ad9c3351c1d7", "value": 191272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294643, "uuid": "908bc1d1-0d5b-4137-9543-cabef5a1d821", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294643, "uuid": "8504ce48-9080-4399-94a8-049bb67f8eee", "value": "Arya 400 shipment order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13622f04-9aac-11ec-9275-42010a9c0029", "comment": "Malware payload (TeamBot)", "timestamp": 1646282439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646282439, "uuid": "999857d9-6d37-4de5-86f9-48be4cfd1cf8", "comment": "Malware payload (TeamBot)", "value": "1658cd3a227da42a0a3a4f10e2fe054f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646282439, "uuid": "064ad2c3-8328-4948-a5c4-6b206d1c1a3b", "comment": "Malware payload (TeamBot)", "value": "51208f12a5824a796506c47a67bae3e8f99c5c56d13bf44b388e686185211819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646282439, "uuid": "138663eb-14e1-4681-b9c2-54cdd31c2b65", "comment": "Malware payload (TeamBot)", "value": "02cf01229c89fdb1f618f8485da5062c3bf7a400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646282439, "uuid": "20732343-4a6b-4ae9-9b87-8a10c5b76330", "comment": "Malware payload (TeamBot)", "value": "c5810ff873334c98740468feb31b5752a52293cfb74c40d70dfb5c4d8886703d208bde29c4560439343536144ef8079b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646282439, "uuid": "867a9ac2-931b-4ee8-9b14-1190c90f963b", "value": "T1BC24BE1677C0D472C49715348078C6F46B7AF83256A4898FB7A83B6E2F303E2977934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646282439, "uuid": "9ff25d59-a605-4f5d-857f-3903f918639c", "value": "acb91f91490aac8ffe4a6888d08bb763", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646282439, "uuid": "2372b162-63f5-4f0a-addf-f16e423e1e64", "value": "3072:6/qRDRqOyfkrgCxASiktWs35uwBEmr/A:8ODrgCxLiktWdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646282439, "uuid": "277e4b3e-b7d8-424e-a9b4-33d60c64f9dd", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646282439, "uuid": "65fba596-3d4e-4537-a383-adfa13c3cf2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646282439, "uuid": "af993865-7a17-4130-8e55-6038aa779350", "value": "1658cd3a227da42a0a3a4f10e2fe054f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b9bff4-9b16-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646328020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646328020, "uuid": "90510000-c316-438e-962a-fbad988913d9", "comment": "Malware payload (Formbook)", "value": "bb65278dd77988f8a7bad219b524384c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646328020, "uuid": "bcc279e5-3b11-4af0-9b2d-54ef9f33965a", "comment": "Malware payload (Formbook)", "value": "517e912e9e37db6b6959f4e900cfa596138325a4a6f56d670c16934bdcbbc725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646328020, "uuid": "e745adda-8424-452d-a145-8088afd720c1", "comment": "Malware payload (Formbook)", "value": "bc1add2831c0eebbbeed5d8c779ebd1299af0bae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646328020, "uuid": "fca40e42-4b61-4d76-815b-31e949843e1d", "comment": "Malware payload (Formbook)", "value": "691bc2ae69465bd546cf0f239ffaa97c10e8a884236440a588217000c25f2aabbd24d6be5af6eba1a144ef23b7e448de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646328020, "uuid": "2cfad519-f725-4b62-a50e-406928bd6f25", "value": "T1A65412A9B9D1CD7FE98A45755F3767B9C7F3811830F06A0E8F243FB21852137051A262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646328020, "uuid": "cafc3d0f-c6d0-4793-9de2-b6bb691b760e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646328020, "uuid": "ac15d5f6-a2af-4e15-b768-3853bf5e950d", "value": "6144:rGix+MrLKwPYZgX3oddcC3Q2ySbMtoVVVp3e1kS50nL6FG:9drLKwPggX3LBMMC7YkS5Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646328020, "uuid": "d18b0560-f122-4216-bb22-a72f1a829420", "value": 304011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646328020, "uuid": "2c7cea6c-9013-408e-a96d-7700b35b15f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646328020, "uuid": "9e67ff7b-dea4-45fe-bba9-b1d9623c734b", "value": "vbc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce092cc1-9aca-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646295637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295637, "uuid": "eea8ac5b-ad7e-44a5-ab5b-f1b795cd4398", "comment": "Malware payload", "value": "1fc1810e30009684cae20a41b82627b5", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295637, "uuid": "c581cfc8-19ee-4e09-a945-ea1b7788586f", "comment": "Malware payload", "value": "51983903b7036d7f69f56167fef1d8004d6d93b9d7cdc4f71394aa62c5d39900", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295637, "uuid": "77900b55-2f16-47ad-a30b-394eaf962c7e", "comment": "Malware payload", "value": "04adc3eb773d6ee3b5d5914706e8e19b6944a859", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295637, "uuid": "31d653ed-8adb-4e65-8568-747b0f73c261", "comment": "Malware payload", "value": "d44548202572fcfe5a43cf1414104246d9cfb5d058ed95a29248969625f48ce59d8cba573312ab629e27f71cc6be50ac", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295637, "uuid": "5c7670f0-45f2-449b-bd58-543ffcb59a9a", "value": "T1E713BF18C501A009C3B3A93DDC38C8E15C6BDD57212449DFE5DABA4B0BA4EEB275EBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295637, "uuid": "fc28e96c-b973-4b50-a158-da182cfd6025", "value": "768:X+pRD4S0JS00SneSnjS0yS03S0IMS0bS02ScxbV+cUs70Nn2srTpxKC6yDsfudH8:X+3MVU7N22Tbwy40zVMMA6ZnE61/K8Nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295637, "uuid": "e974ca19-0481-4fa0-b63e-7e4bd0d53839", "value": 43622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295637, "uuid": "b128a70f-ad73-40fa-8dc5-cff113aabcd2", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295637, "uuid": "cc990d5f-6586-428c-bb94-7627bbbf16a0", "value": "New Order List,PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b9eafd-9aa2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646278198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278198, "uuid": "0f916b30-e52b-42cb-9f9e-7769aaae252c", "comment": "Malware payload (Heodo)", "value": "6703d7b5a0865cec54d83ae57298e2b9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278198, "uuid": "25252bf2-ba87-44ad-aaa8-47a82caf4924", "comment": "Malware payload (Heodo)", "value": "51ce7b0d5d33da9fd74671026151e34c6955fc168687f7ad1f76ed57d1b508b4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278198, "uuid": "10724220-10b9-49fd-9776-43bb09d39a81", "comment": "Malware payload (Heodo)", "value": "8a8419fdb5b51c86c725ab540fd38844a9aeddd5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646278198, "uuid": "8d960da2-614d-432c-a0ce-ce38fe145e41", "comment": "Malware payload (Heodo)", "value": "82310a40b21940124287c0559c057c4ed2995c9c92ab2ad74a277a6486aaf8eb8b50b64178c3b93657f88c657bd4064a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278198, "uuid": "23c99bbc-9af6-47f4-b84a-3775308cff8a", "value": "T1B423E02AC5207828DB3A4C35820469D2721A7D05DDD5FB5A3145FB4C3B86BFB53AF88D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278198, "uuid": "8bb8af02-168d-4b24-b5d0-1d23b56ba198", "value": "768:n1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:n1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646278198, "uuid": "83245a86-7844-48bc-b224-dfaa92f70324", "value": 47653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646278198, "uuid": "32354166-834d-4839-a32e-dbf3c4ba9abf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646278198, "uuid": "d687e571-6399-44f6-8fb8-92fba0c54542", "value": "10077798709532959316917.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4702c1af-9acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295840, "uuid": "80faf02a-51be-4514-9564-654c44dd8538", "comment": "Malware payload (Heodo)", "value": "2d6fe0d42386939a7c2f8451e58723a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295840, "uuid": "84a33e17-a891-447c-a33c-7407dc98a05e", "comment": "Malware payload (Heodo)", "value": "51dcebc89633ebe18336e56b70f07b0792b1e7c5e36701ed7d80ddce1934f0d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295840, "uuid": "2cfa3191-7ba4-4da8-a982-724649366193", "comment": "Malware payload (Heodo)", "value": "8a34712ebe9331b2aa342a079ad9d4e65bf4b8b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295840, "uuid": "6c373ae7-8d1b-4bce-a79c-f1f52b3ccaa2", "comment": "Malware payload (Heodo)", "value": "913c37acb260fff370565a2ca1dae17b9368c23b550b9f435fdfa6fcd0c0b4b9c3e27889a5d3fc9384f6360e44aee507", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295840, "uuid": "7848d17a-b8fa-4bf0-85be-bd85e16cdbd8", "value": "T1A6D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295840, "uuid": "0af0c5d6-56f2-4f3f-a39e-3c5f6c74c530", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295840, "uuid": "9e1317bb-7075-4e6d-b521-4578178a7e4b", "value": "12288:ZxpNJJJ2NHPoczJQOtIhxf3foRXIa5EPwvA:Zx2gczJQFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295840, "uuid": "166051ec-f064-4547-ab7b-e00836a38681", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295840, "uuid": "5bca0c08-1610-4d43-803e-7eeabac01f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295840, "uuid": "972b8c8d-4f38-4d4a-8644-10d5aedfb2f7", "value": "2d6fe0d42386939a7c2f8451e58723a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b4d684-9aca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295301, "uuid": "fe2ace5a-360b-4c2a-ba21-4f7c7a262838", "comment": "Malware payload (Heodo)", "value": "01353ec1dc82f8da05121c0e4f5c6f39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295301, "uuid": "6f58feca-e994-43c0-87fe-76f975999778", "comment": "Malware payload (Heodo)", "value": "525e3568558f436045290a6ee66d762fd0bee6957ea13ba47877225ce4fee97e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295301, "uuid": "4c4e433d-1daa-4aa2-add6-a3189a804dd5", "comment": "Malware payload (Heodo)", "value": "64e963c78f939fd642d6c0cfc546f9f024fe0268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295301, "uuid": "0c26f024-3f25-4d4a-9321-1678dfb0c9a6", "comment": "Malware payload (Heodo)", "value": "3b6619e4d88119e3a7477e0a760993cc3caf6860f72c6385288f0bc036845437ebc5304beda070293c5d7ffcf72537e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295301, "uuid": "2f0768f5-47b5-484b-8bcb-e550218242be", "value": "T186D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295301, "uuid": "9485e06a-8f92-4746-891d-af8eea306212", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295301, "uuid": "c3c4bb88-ef80-423a-a52d-f31461d5ad12", "value": "12288:ZxpNJJJ2NHPoczJ/OtIhxf3foRXIa5EPwvA:Zx2gczJ/Ff3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295301, "uuid": "f50eec79-3661-47f3-bdea-14a5d41e3e7e", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295301, "uuid": "bc27a3dd-2c46-4a45-8757-3fdbf0c0a6cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295301, "uuid": "fdf7e00f-3b43-4dc0-a431-eb70d40f05e4", "value": "01353ec1dc82f8da05121c0e4f5c6f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d476fca2-9afe-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646317981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646317981, "uuid": "120e752f-928f-48c4-a06b-27e554f89513", "comment": "Malware payload (AgentTesla)", "value": "8aac31d2f10ccafc36d605a9c414a0fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646317981, "uuid": "0bac12a7-d81b-4cf0-8171-17b767051cfa", "comment": "Malware payload (AgentTesla)", "value": "52a174adf98c963af2ab985dde25f97e68657355d6bac68c55b8fc0dff84412a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646317981, "uuid": "c2cb3ae1-7248-43a2-a9f0-f4ad57ddf739", "comment": "Malware payload (AgentTesla)", "value": "5fa22fd318378e867455b46365d9600bd226989d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646317981, "uuid": "19ece5a7-8f61-48de-a74b-6d4b3c8800c1", "comment": "Malware payload (AgentTesla)", "value": "840c52fa3df68d00110f3f64dc35a37b9a263ebda240feb26d286ae364a5911243433fa61e109cf804fba95d68c080ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646317981, "uuid": "13102552-10c1-4bf9-bc61-3b516811a499", "value": "T1AE522B512394C677DAA405716C2392105BF6BEADCCA7EA0FA0EDB07FDD723A10593A34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646317981, "uuid": "3054ca8e-f12f-43b5-b82e-69605606c633", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646317981, "uuid": "ebf205c6-9621-4cd5-b8d0-cdd563cc56ee", "value": "192:j/ESVoZtbRZnzUeowxnqskJsNVd9kLzX9jt:bESVKtbbnzUeHqsIX9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646317981, "uuid": "7530e0c8-01fa-45c6-9344-c6692e88e0e5", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646317981, "uuid": "72caae88-fccf-488b-9032-0f91c872199d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646317981, "uuid": "e6a5bede-f882-4da9-a6b0-d333c85b9564", "value": "Sxzyz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981718a1-9b00-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646318739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318739, "uuid": "fbb27e3e-5e0e-420b-8c1a-aeab3a90a3e1", "comment": "Malware payload (RemcosRAT)", "value": "92281fa97feeb2f297f3171707c10a2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318739, "uuid": "55c5ae15-45c6-48d0-b8be-599484232f0a", "comment": "Malware payload (RemcosRAT)", "value": "537288ba6b141a9e76bbd1f77348494c4b3b82bb0c1f0c08afeeb544ccea85e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318739, "uuid": "22e92467-05ba-401a-a1c5-298e052fc130", "comment": "Malware payload (RemcosRAT)", "value": "8b6bcaaf2348508a6f1317cb783692e9f01c5634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318739, "uuid": "27a5876d-2e7b-4f48-b49c-b682e9d4cce5", "comment": "Malware payload (RemcosRAT)", "value": "838831b31ca5983bb4dc8386c39e25855ff1212ec20de6eee57dd8851983c8bc4ad5433a682bcc25d19086c15e4d2347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318739, "uuid": "47d067bc-f884-4725-b7f3-8fdf3451da99", "value": "T14373A0A1BE84F66AC1262C32DB12DAF5C127BD27C97099537CC87F5F7933642910172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318739, "uuid": "a2ca10e6-8786-491d-9b65-7d93a9d25478", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318739, "uuid": "c36b1dfa-394b-4420-acc4-9d081b813592", "value": "1536:mbU7oQU+iopiA+bHq0R4Co0s7yj7c0q1m:mbrYzCo8/c0q1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646318739, "uuid": "8524da4d-f8e3-44a7-a6da-fa19058697c5", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646318739, "uuid": "7d4e0e79-83b3-4ed5-9a97-7bb1263c43e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318739, "uuid": "5608df4c-bb36-4edd-9937-2dc2a9942c46", "value": "HRC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cc6ea0-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "3d5864e1-e14e-4970-9f4a-5d38e4fa90a2", "comment": "Malware payload (Heodo)", "value": "3b2212b620bbf207c2a6c301dc23f27f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "b7f85509-2a7d-48e4-bd42-11b0ed0bfae7", "comment": "Malware payload (Heodo)", "value": "53d4a3b88ced0c115bdde9167c634976ff638aca798bf4f050b540aefdee9f6d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "89d32d7f-c6d4-4ebf-afaa-f3cdd877b0e2", "comment": "Malware payload (Heodo)", "value": "5bed2c159f54de47510b976c744335ef6706e031", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "64164cf6-cbdb-4ae7-8950-8eca69d00f06", "comment": "Malware payload (Heodo)", "value": "954eb9e889014a206943e442d47a67f3bf7e1caab2908cbc1acfc6c69d67529aefb861e53637e03ea1b196287cdb8197", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "bb61d34f-8200-4869-a553-aa5b709969d8", "value": "T118D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "5cb78920-d00d-459c-b816-c66001c9c19e", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "83e3fc7e-ead0-4511-b1f9-5e7c49eb7462", "value": "12288:ZxpNJJJ2NHPoczJZOtIhxf3foRXIa5EPwvA:Zx2gczJZFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265795, "uuid": "be68082f-346d-45df-9fdb-a70a91fd72d6", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265795, "uuid": "d7f5917f-fdc1-4c08-add2-2befa5967162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "89daf3da-5cd0-40b2-be9c-950e6b2fbe8d", "value": "emotet_exe_e5_53d4a3b88ced0c115bdde9167c634976ff638aca798bf4f050b540aefdee9f6d_2022-03-03__000304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d5771f-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646301042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301042, "uuid": "96883a9a-ba1b-4d7c-8d7a-89fdf4e2dc8f", "comment": "Malware payload (RedLineStealer)", "value": "91bd2ab982495b36c2e786b20bd640b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301042, "uuid": "f482be58-30a1-4c3a-905b-784a0f4cafc7", "comment": "Malware payload (RedLineStealer)", "value": "54d46ba835ad2e2440f589a17ebfd4720649157b21efd713782d045d4dcb6e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301042, "uuid": "939604bb-3a6e-4bcd-979a-4a8525bd8dde", "comment": "Malware payload (RedLineStealer)", "value": "51b98e468dd0bccb696813359c133c6edd7e1b7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301042, "uuid": "af870af5-3dee-4def-b582-35a448e065b4", "comment": "Malware payload (RedLineStealer)", "value": "30bf362878eb0d7ea65d31e5960dcb5bc409a5939585e08f6504a3fedbb60bf3960bf8407626f97a3673af38dc6b37c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301042, "uuid": "c6ab3ea6-6d3d-4d9a-913a-15244cea23ee", "value": "T1021633C583640006E248773C737B9757B0DA44E4C9FB396F4A3B0292A15B9E0B9FA5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301042, "uuid": "2a073453-c959-4cd4-9574-00ab41820fac", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301042, "uuid": "bd6a57cf-6e20-4320-b6ee-3380ac5ac475", "value": "98304:qi+QwDfsrz5MCOvs5rfgMmdRqR+GO/Po0Ht:qi+QwDUrdMCIWLJ4G+GOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301042, "uuid": "7f896d7b-947a-4610-b708-8ced3e44b3a2", "value": 4086584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301042, "uuid": "2335595d-2df7-4137-9642-8f0001884c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301042, "uuid": "430f014f-d6c5-4bd6-b2e5-08543872d907", "value": "91bd2ab982495b36c2e786b20bd640b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f992231-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646294619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294619, "uuid": "15bb1532-0819-40c9-b8f9-160b60ccd523", "comment": "Malware payload (AgentTesla)", "value": "457f5f107d7f9bbccdba165478fa9360", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294619, "uuid": "b53b2690-9e83-4533-bde7-e4347a498e5d", "comment": "Malware payload (AgentTesla)", "value": "54d5e83a56169178a2b654c6895edb12d8a1ec71ef7d6b1fa159ecbd3c080f8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294619, "uuid": "37061522-032b-4e9e-83a9-c09f3d0344d6", "comment": "Malware payload (AgentTesla)", "value": "48b3db16b3288f2ca60c8a8952b9e0f48c5e3a50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294619, "uuid": "0bd5767a-198f-42f1-84d0-438b11334c83", "comment": "Malware payload (AgentTesla)", "value": "abc93a3c264d69d562dc883ec8bac72e3e53b9a4efd19f5d7da380aacc496a9df9b59922bd764780b5b2539718a63f11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294619, "uuid": "89bdec48-541c-4254-b887-0dcef7d66744", "value": "T17D1412E0BE9B4410D607AE30CB34B3B94568EDF64CD894566E583B7A0E39884DD1AF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294619, "uuid": "9ffdca6c-a438-43ba-9889-e97b3bc54fc5", "value": "3072:KNx3MJPjyfeQMoxdcp0idDaX2IFlkg3NgqwH4uay7FxYRULGuOqdc1xldRedK:6RMJPiSK6Bd6XkogrYCRSyyuduEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294619, "uuid": "2596980a-01ad-498a-aa96-a1a3b1b45632", "value": 190968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294619, "uuid": "796f6ea3-7e5b-4eee-b96d-14892410a067", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294619, "uuid": "3b208fb0-5223-4ca4-ab1b-c46a2ef515d2", "value": "Order_PC48944.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798e875c-9a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646268866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "27bc713a-5782-4ed5-b475-414215a11319", "comment": "Malware payload (Heodo)", "value": "ab300684aade782aac88913a56ac1dd9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "cc55661a-6030-47b4-bacd-15907b55c156", "comment": "Malware payload (Heodo)", "value": "54fd97303e6d2426a12c6056bd6bf45f82aab218a72d3d6d3e0e2bf86c52951e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "16ce768c-0fbc-415f-98ca-9e83ed270675", "comment": "Malware payload (Heodo)", "value": "bf061826ca04e0129b4aef3c9bf697f1087ca828", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "f1537d61-db9a-45a0-8018-5dcb3c175783", "comment": "Malware payload (Heodo)", "value": "8869342a6279fa39c84fc8140ecf63dcb60554cb3d975da80c4eaf58e406fd584fab72eea7792b138e2964e884e462db", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "9838fd25-8967-4437-8023-5a5775d40218", "value": "T1C0D41B017498F0B3E38918B04A858AFB724B5DB296117073F2ED378CA7725F15CE766A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "6bb58d65-63d1-4adb-b1f7-6bf85e04b69c", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "fedaa94f-d638-4c1c-84b5-34474f6361df", "value": "12288:pao0Se86lloPxHHVVIjqxEqRVoQmiIII999tLLLdAkkJoFLZZWbClgluPcRBATfX:AqxETMJ777u3OmONFqNJtN1v96TOAnr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646268866, "uuid": "9f422d76-6235-47d3-93dd-c4be0e2746ec", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646268866, "uuid": "c56d1252-5806-40ce-a5b8-e8d8f99dc73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "08f0007e-54d7-4470-a6df-4c887cabf4ce", "value": "emotet_exe_e4_54fd97303e6d2426a12c6056bd6bf45f82aab218a72d3d6d3e0e2bf86c52951e_2022-03-03__005422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19e4b80-9abc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646289603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289603, "uuid": "e5dde26a-4f3f-4c56-96f7-c317540006ac", "comment": "Malware payload (Formbook)", "value": "bc6bfb8cae51c32c68a94445cb10b650", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289603, "uuid": "d2f10bf9-89c9-47d5-9699-7ec49dd6826b", "comment": "Malware payload (Formbook)", "value": "5569ef7bd0b5ba0abd83ec5ea475adc163cf087b143848d5911f3e450564442c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289603, "uuid": "de8c7080-5c0c-4872-9c1b-dce079ba7bd5", "comment": "Malware payload (Formbook)", "value": "a3fda9e4912cfd159c0e17a35fe5b7a453834a68", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289603, "uuid": "8da5cfe8-97c8-41fd-8a4f-6bb5594fd0cf", "comment": "Malware payload (Formbook)", "value": "ee44d3e7ecf937201593a147d8d5ecc997b00da7d2e909d101b1535738ed311e598aa817aba7fafa4af794c6b22fbafc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289603, "uuid": "10c36378-40c2-45e3-bf8f-a908dfa64d80", "value": "T158B4239353AC7750D8693DDCD9781D8C1CDA8BD87470F6DF22B8EBBB6102AD68681831", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289603, "uuid": "fc283594-5370-4611-bd5f-a12f207bc499", "value": "12288:AfIZluf5i9TT1xlOcWgz9TwUvds5F/6YV3i3Rl8RK3lVZLTq:KqskB1xlOLgz9TllsSBl8RKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289603, "uuid": "84dc76cb-44b1-4f0b-bb74-7adf3410ebb8", "value": 511888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289603, "uuid": "e57f5d3a-e7c0-4a16-9efb-08b24895e762", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289603, "uuid": "8ab90d09-b78b-417c-9697-28ea31ee2e7d", "value": "TELEX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9e49c8-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646295235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295235, "uuid": "17678dd0-6db2-490b-96ac-9cdd47f574ef", "comment": "Malware payload", "value": "17a6e025e141734a2310f6fb35579eb8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295235, "uuid": "7e0e3cda-3877-45e0-b0fe-9278f469c20d", "comment": "Malware payload", "value": "567b0a40989beda8bbd1c3caddfd2b05cf61ea297f3b38574bcd80aa16688bef", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295235, "uuid": "ecae73d0-fb96-4356-8398-f98038d89784", "comment": "Malware payload", "value": "e99a89e04c962859878c1d20693e2266d30b480f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295235, "uuid": "721dd66d-c0b6-46de-8ef8-88e4ca2999f2", "comment": "Malware payload", "value": "232ddda2d6e762cef5a1997c0840ccd02b932ffa94d18414e8802b24f09846dc8c76fee3383c6dc01ae39d29f8e16fc7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295235, "uuid": "5c264a41-d3c6-4eea-88fe-9edebe5250e4", "value": "T195164A1EB244653AC4EA9B3A4D37A358993F7A632926CC5B57F0088CCF375412A3F647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295235, "uuid": "5701b2da-4c3e-4733-a9f8-4e5babd38f4a", "value": "49152:zchOYaEAxt4TR0WDhARyhqyVIS1upYaQ3B2yPjIRzsWGMZDkOsTvT380iI1:qOYNAxKi7iI0MZD3sc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295235, "uuid": "7a262759-7ef1-495e-9af2-926130dfd083", "value": 4188672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295235, "uuid": "601ca934-c5b7-432b-b83c-008033b13303", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295235, "uuid": "388229ca-1d47-4127-ae27-cc2c1b040cdc", "value": "ArchEndesfact0303.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695c4744-9b49-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646350014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646350014, "uuid": "4edbc571-51f4-49c4-b86d-03454f63f5fb", "comment": "Malware payload (njrat)", "value": "b506b457fb827f8b089e56b975c5eb6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646350014, "uuid": "92844af2-deb9-4daa-9dab-b0e5e39389e9", "comment": "Malware payload (njrat)", "value": "570456035fc5de7b0f92dd8e8018793aed967acddb5a5fe36c5a33e2801d2fdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646350014, "uuid": "b958c4b4-c693-4a75-b619-e4c8e5cfa03f", "comment": "Malware payload (njrat)", "value": "c1233c89d6899825bbf23cc2c9a7fb1135c8faf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646350014, "uuid": "62e07451-fcbc-4d6f-9809-b08cda7ea36c", "comment": "Malware payload (njrat)", "value": "f5aa259db816d8b2f84c50b3376797e567b0b67377470db6dae31db1c5a0f82e3bc08c21f49ad4f0cfa530d1bfcc5d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646350014, "uuid": "4d1d1264-d465-47d4-a74b-0c00133f89de", "value": "T1C154E00AD7D822BCC17E037645E8C16017FD8606DA53D35F7EE502B47A7BB68D283A86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646350014, "uuid": "94516fb0-9032-4c7a-871d-0f03d78fb6f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646350014, "uuid": "52e30e19-e7bb-47fe-88ab-573b2abf8223", "value": "6144:4pQU50m1qwEcveoLXs7kHd9wyHj6N1+aFyar:1U5znbveSXs7k9K0k+awm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646350014, "uuid": "8892c5f8-94d6-4c19-ac9f-0a9dbb1277da", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646350014, "uuid": "d3698713-69d9-4f54-81b3-37631c1adcf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646350014, "uuid": "5db514a7-b9ca-4d78-a256-f80751376971", "value": "ref#345673456-inv45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb5437b-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300387, "uuid": "d8570cee-51c7-4af6-9ecb-60e8d4cfd969", "comment": "Malware payload", "value": "695b5ba144d09b972e940abfad58ff09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300387, "uuid": "adfa3f72-a3d9-4a42-940f-4f136e72947c", "comment": "Malware payload", "value": "57e8fc9e724f9a78b7d6d7c2f640ea8842bdbd7dcd1480b9463237bd70de2725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300387, "uuid": "81ed2105-ddd4-47de-b6f5-fc438add1213", "comment": "Malware payload", "value": "05430322d0e0f3b9d14ee71f17ab11d15040ec45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300387, "uuid": "ce4ebcc2-4f99-4cb6-9eb3-8ec8ad4dfc5c", "comment": "Malware payload", "value": "a21c40a988c683c718f7f4d3eeee694b4d4ba8fa08a815e45c5016328f078e396a74eb30e80eef244457fbcee78fd7d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300387, "uuid": "cfeeab32-b54f-4945-8d9c-86664cb3e5e7", "value": "T126E501FD6140339CC41E8C345523FD05E2B5952E0AE9D9EA7ADB7BC03FAE501EA06B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300387, "uuid": "b2aeec35-8476-489c-b4fe-a4d02b017c16", "value": "629d572bad2dcff0fc429ecaf29f92a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300387, "uuid": "0b39a8d6-2b05-4bed-b495-9f2d9164016f", "value": "49152:EYNmK8vSVzaNh1+iYv5ek4Uy70wmDJO67zRebQf/vydQkOlvi1wtBUYjW9236kx1:E+mAQ1+352Uy3967zRebYXyw/og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300387, "uuid": "7e0113a5-16e9-42f5-b463-46d3fe78cb21", "value": 3268608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300387, "uuid": "a85be173-0611-4be4-89ca-2a43778ba0ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300387, "uuid": "97d86d8a-3833-4767-a2be-1d295420c923", "value": "695b5ba144d09b972e940abfad58ff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f11c12b-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646294538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294538, "uuid": "00f75fd0-98ef-4955-bb95-7bafde897877", "comment": "Malware payload", "value": "96fa4f1630411b302c3d7c935163e02d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294538, "uuid": "2cd06d43-e99e-4719-9ff9-4aecfb3fc9d0", "comment": "Malware payload", "value": "58b2ecef718ad6d1b020ed03a1ad3be20687e3639b9481ae2ac09dbe16399a20", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294538, "uuid": "60a6bc8c-c638-4468-97c9-d6ab7096bede", "comment": "Malware payload", "value": "01853f59d46626a8b33aee4599fbca23f77d919a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294538, "uuid": "f11a4a98-f046-4995-bf27-efdd50f7fef2", "comment": "Malware payload", "value": "e20575a6d01150a8846f57987714a22a3a60a30e43422938ff95be57c397c7b7373684b6e209a9a93fa167912ed76370", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294538, "uuid": "426c76d3-abd6-425c-8508-f55d84e4b87e", "value": "T12814027B7D569B29E924E9397818B4D5CB30DE2E4E6AEC5233C0364A307A8611D1FF1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294538, "uuid": "c37d9d72-213e-4810-8e36-de43f6942509", "value": "3072:WGoMY7vlZZ+GNSheeh5TA8XfLeXapd7hztbQCdYO6pjR79VLEUZd:WMY7vd+kOh5TADe7hztzYfz5V3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294538, "uuid": "323b354f-7605-48c8-bb35-542c3e21ea5a", "value": 190472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294538, "uuid": "2bc6c733-3253-4d58-b1a9-5c27a1df775b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294538, "uuid": "e741b985-2305-45c2-8990-6d2ebea1dad3", "value": "SPARE PARTS PROVISION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5da034-9b3a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646343471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343471, "uuid": "8f46b458-b939-46a9-a537-41aa1ad8245c", "comment": "Malware payload (Loki)", "value": "8f2bb42643cb14591f045c7845c5dcc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343471, "uuid": "6eb91909-7799-4416-b3d7-681d1f946744", "comment": "Malware payload (Loki)", "value": "58e6bf305c484d04531080d5b13aa8313671a69494f8cff4ab1782c4c048af8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343471, "uuid": "3331cebb-98b6-44e6-b2aa-9297eb1c9795", "comment": "Malware payload (Loki)", "value": "adcaef008779d6a4da1f061643822fca53fbb001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343471, "uuid": "b1280d9c-815a-457d-9677-8781dc3196a3", "comment": "Malware payload (Loki)", "value": "54a3bbed67ef6b38835dd8976a7313cbc658a14fc278add02ed54079516fbfc9f4cc50d9f88838553f243a7ac796c18f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343471, "uuid": "6bc3d955-19e6-4be6-b884-6b8558dd6f0b", "value": "T1E305CF0438E78034E93A9BB0DAC4EBF09B7DF215E549A0F654105F257642BBE8949EFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343471, "uuid": "d66b37eb-7547-4b72-89bd-5229b90f6c7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343471, "uuid": "7175edc5-440c-4521-a7bd-b5c5f2f5e0d7", "value": "24576:QylW32CDN8txXqCZapdG4eTgCaosQHox:rW35B46p84ugCrsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646343471, "uuid": "4f0ac2d1-40e9-4cb6-8fce-42940369d03a", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646343471, "uuid": "127ee588-36a0-4117-8b0f-b6b06c1d8631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343471, "uuid": "940afee3-bfbf-4004-8f2e-1234b0444df9", "value": "Purchase inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27116ae3-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646300511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300511, "uuid": "58040c68-81db-4788-8148-436ca1e54941", "comment": "Malware payload (RedLineStealer)", "value": "85413c4147c9048062901ffbb2a2da65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300511, "uuid": "3f5ac63f-e16d-4f6f-a610-205b3ac0ed9b", "comment": "Malware payload (RedLineStealer)", "value": "59131e55898be4de6efa846f46a69f71e7ab941e6b0e3f6fc01b80693d68ea44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300511, "uuid": "0d22710a-ca22-4bd1-9b3d-c4b5ad1b600a", "comment": "Malware payload (RedLineStealer)", "value": "0c062ffc56d61ef0cd0832f6c6e009bbdf748e90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300511, "uuid": "cdf4cb8b-4edd-42b3-a419-f36bf8e469ed", "comment": "Malware payload (RedLineStealer)", "value": "75a49d36e9eab0117abb9f2e315df673076ef8cf280c8b8a4dca05ca3d1e8b6768dfa34413eca94c29d9a7bc48401370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300511, "uuid": "8015b149-a1f4-446f-83a1-83e98bb33a6f", "value": "T1C4C4236B2380FD4DC28D8976FA75135BF46B07AFB7A07563A5FE408392041C2E6A42F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300511, "uuid": "87b882ce-5466-4612-a213-dbafd7fbb439", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300511, "uuid": "e4bbf6cb-4f89-46cc-91ca-6ea9e6a34fd3", "value": "12288:xKQ1QfOi1uckCICdGv+RN3DQS03ULaHNqrxlKIQNo7cd/BlZk8gn9:sQ1QfOWucGOfZkEaHNYK3qcd5lgn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300511, "uuid": "25b6ab32-8eb1-461c-a92a-b4681d8c9ead", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300511, "uuid": "96972f76-69dd-4ab9-8caf-a35ad1a60db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300511, "uuid": "c4c2a804-1934-46ba-848b-721701750960", "value": "85413c4147c9048062901ffbb2a2da65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8172d6ef-9abc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646289495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289495, "uuid": "ac064c60-d2ba-434d-8abb-d1ed685d686d", "comment": "Malware payload", "value": "e1e34e0c24391c0dce4ab3516c9689f5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289495, "uuid": "c2fd203b-171b-4c78-bb9e-b89cb07d0888", "comment": "Malware payload", "value": "5989d4cee0c3d6afe67258a44cfd2edc6d1909a56f565607b53a13cc12306e41", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289495, "uuid": "e33d0e31-c7b4-4054-96b2-25b112cf5820", "comment": "Malware payload", "value": "033741bbb9d0138ace1cd44d8d871d633ab369db", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289495, "uuid": "b6149c8a-633f-4f2c-8abd-88b43b0f5328", "comment": "Malware payload", "value": "0d1fd90e285ef7f51b5616c4c7f1794be33978d4f03afbf32f2963547a6595ec57e213aa72ebc8758648a8defd9899d0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289495, "uuid": "a0ae93a7-e486-4b04-a399-c2d61c0d2528", "value": "T13B225B7DE1088BECC79D91F5A60A36C8110E7D5063C9E6EB35BC731507870BF961A168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289495, "uuid": "e63aff8b-2cba-4185-9c14-ada98f5a82fc", "value": "192:Q/0WVlerdwr0GsiVFpTrrvOMutvHjcl9CIzAi+KCco:xQ2dEfs/vDQ9dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289495, "uuid": "9d52f093-c64f-4a14-a6fe-4bca3b010ce5", "value": 9918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289495, "uuid": "948720f8-1c1d-455a-9b00-ea38ded7f7b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289495, "uuid": "668ec633-2924-425c-9d52-65de715f335d", "value": "items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b57c79c-9b28-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646335871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335871, "uuid": "4e87081d-98e5-4867-b7bd-abe5beb74b9a", "comment": "Malware payload (AgentTesla)", "value": "ef2d904f700573889c02570b4370d0ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335871, "uuid": "686a069f-bde5-4928-8272-99ab84530462", "comment": "Malware payload (AgentTesla)", "value": "59a94c5400460b926b467837c775df74c3f2de74825fe96601e50eba5e3a9de0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335871, "uuid": "4acf4759-cd20-43b4-bce0-bcad8122b01a", "comment": "Malware payload (AgentTesla)", "value": "875dc2cd598cb8113b3563083d05c0c53100850d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335871, "uuid": "6ac5528d-1260-4bc6-9fda-aee095ad0411", "comment": "Malware payload (AgentTesla)", "value": "47ddb2a5945e722538382c563d5fe15fd6b95582efb3746a161348e170f9d0e2df7649c3eb929155f36f91d248c912f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335871, "uuid": "2a01ac57-fe7b-4a91-9f39-f5b7a5abef11", "value": "T15B55F102D0AA6442D77C85BC6193E430671B9E7B187F41018678E2891AF39FB1E7B7F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335871, "uuid": "a8f55a25-46de-44bd-a0a9-aee14070c68c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335871, "uuid": "1e1117e8-2dc3-4ed6-94ea-cf2d6066b34b", "value": "24576:x0IUj1CRly+kyjK+/JB7+7OoojXRspmIaLil/RhzLAyH:xVUh6y+kEf7+7OFjXW9aLil//PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646335871, "uuid": "c39e94d1-6dc3-4dfc-ac29-a72853520a54", "value": 1305440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646335871, "uuid": "2cda8e15-f8db-4ed5-a849-f6021e69513c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335871, "uuid": "3319af29-bbae-4348-baba-daf6c70e5dca", "value": "PO2022030311009283_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25c4404-9b3b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646344123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344123, "uuid": "d9a5a47a-54aa-4783-802f-a7ee70cb6687", "comment": "Malware payload (Heodo)", "value": "0f87709cf760ad8b968dbbfed59d2bc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344123, "uuid": "afa177e6-65f4-4a48-8ad5-794aeb13605a", "comment": "Malware payload (Heodo)", "value": "59b9cc15bfa84199af12f96aef0341bbe16066f519b1ea7c34fb6766b59d5c84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344123, "uuid": "4ab4f7f0-f724-4a2c-ac2b-e80ddaaaa9a9", "comment": "Malware payload (Heodo)", "value": "0185312b6c83b28421d3ae2d746aec3cac7f1c8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344123, "uuid": "ee5f8e0b-6621-4d93-893a-8c6eca030880", "comment": "Malware payload (Heodo)", "value": "6eda95f330704a628715a1b67af7d7f93d0cde46761090119c6d1b42dc3efbcc36cb1eaaf4d91347c15b877a5fdfeb01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344123, "uuid": "963d1e76-ef87-44fc-993e-58acb7a2f6fe", "value": "T190D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344123, "uuid": "445472c2-29ed-49aa-90ba-3767865bf9b3", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344123, "uuid": "35fdf2dc-21ee-4a14-895d-c7bbffdf525e", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLRCjzhmD/bwb1r8Hc:Bg4IqjYTR20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646344123, "uuid": "bf22ee93-b729-40de-a937-ad09d0d13496", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646344123, "uuid": "57073af7-f45c-4b5f-80b8-572dc0fc8750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344123, "uuid": "a7e9bdf0-7bc8-4f7c-bd87-2f6e759b6a16", "value": "0f87709cf760ad8b968dbbfed59d2bc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3097eb-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646298855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298855, "uuid": "fe2c8e9c-3436-46c8-a75e-65e322554c9d", "comment": "Malware payload (RemcosRAT)", "value": "256d11131617643f9e9f882d986a290d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298855, "uuid": "b7f95fff-3d36-441f-8ccb-7b0f89a6ea64", "comment": "Malware payload (RemcosRAT)", "value": "5a288a8a3fd0158f2d9e11713cc4eaf951e12e4f196fcea95d74a14fc37d16d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298855, "uuid": "8b803214-97f5-41f3-93bc-5aefd877aed3", "comment": "Malware payload (RemcosRAT)", "value": "3ee046165a2cbb8763988470c8a51fd02f39d331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298855, "uuid": "17f617da-c1ad-4710-80e6-94e0d6fe07c5", "comment": "Malware payload (RemcosRAT)", "value": "f3748a18eb5b85ce500852cb400075763ba03a6dad06a0fb3e69972ef792174e8e8073b6d9ebbff83781fa1e57421559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298855, "uuid": "723c4fad-e50c-4ccd-8558-e06dd0eae3e5", "value": "T159F47C16F7F2C872D32A45787C2B67A458197FC02D2858562EF47D0D6E392C2386DE8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298855, "uuid": "d660a6db-ad9a-46d2-a7c5-563de34c3dc3", "value": "bb8b994ea7204a3a00105e8b9f8cb8aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298855, "uuid": "0d25f8d4-0af0-40ab-8290-c0bd416905a0", "value": "12288:Pntj1v6o5x1oBghwJ27DKDLu0V9PUECzloUm8OPyzZFJ+:PnhH1tw2uvukIlOPyzZFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298855, "uuid": "5a4eb05a-dd43-4172-befb-043c6cc7448c", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298855, "uuid": "f82fa5f7-d9b9-4e8e-81c3-f918abddb108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298855, "uuid": "9d40cb32-e06c-4bd7-98c7-39df97b4a408", "value": "Masterpack RFQ 56762565ETD-APLRIL22,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a4aac1-9a94-11ec-9275-42010a9c0029", "comment": "Malware payload (LockBit)", "timestamp": 1646272455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272455, "uuid": "a0dc8eaf-7f5d-4b3d-a909-e804dce89e2f", "comment": "Malware payload (LockBit)", "value": "c7bc5563e36f151af0ecec8fb07abbd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272455, "uuid": "2b72047e-af54-4ce9-b5c6-ea1eb97c0f1f", "comment": "Malware payload (LockBit)", "value": "5a67b802ccb3ff343066d6f285b8c933dbd9b43da1e7592f512d54d6e517b5ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272455, "uuid": "8bdbf92a-0304-4e57-85d7-f44e9db53974", "comment": "Malware payload (LockBit)", "value": "5661ca313c7a591520018338a26d524e9c48ae84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272455, "uuid": "dce6a07a-c1d4-40ba-b609-87fffc79357b", "comment": "Malware payload (LockBit)", "value": "8b2047440e1a2e0410edef1bce6067eacbdf48871f8e09e2cfc740f05f3e488056da64b67a422c31853b03409fbc68b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272455, "uuid": "d6b3b1d2-c103-443a-a029-98049d06b532", "value": "T1F2253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272455, "uuid": "c7c3cc74-683e-461c-889d-39d2d722fd64", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272455, "uuid": "1a12147c-6aa3-4ce0-85c6-ce0fbf3fa0c4", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdrF:Ujrc2So1Ff+B3k796F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646272455, "uuid": "ff97b68f-b42a-491b-baab-3787722b8538", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646272455, "uuid": "ee0ed681-68c7-452d-8d09-3e0de558ee23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272455, "uuid": "164382e8-013f-41b7-8482-f0f099107355", "value": "LockBit_36AAC20B0297A5C3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffe9ec2-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "a31c8d9e-e6fc-458c-9928-4fea64a68c45", "comment": "Malware payload (Heodo)", "value": "34180c7107c57e9130d2327e8c41325f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "825fed3f-320e-446c-90e5-2266bfe62292", "comment": "Malware payload (Heodo)", "value": "5a753a78970ced912be1d7adb1496b31224029eec66b01a37f349f2a78e761dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "78717666-df06-47a1-b2c8-19721c8be018", "comment": "Malware payload (Heodo)", "value": "d64a6c75cf4838e949b90585eb06372ab975bcdc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "8b2cae22-5849-4a27-99ab-4f1df153d2cc", "comment": "Malware payload (Heodo)", "value": "f74baaa8faddf8454ea1fe2ca83fe0a055a7574aa361290de8dfd717d2f1294316c7dff5ac1c8311e54a71bf5c4ef5a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "92063d30-968b-4bb0-b823-d69149d84738", "value": "T116353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "6c03f80c-7b9d-4520-aff3-6910be3522f9", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "cb3be938-9c0c-4bd3-b276-49ddddf2116e", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZy1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZgytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298727, "uuid": "ac6d5086-57ed-4dd0-b168-0accd497a8f5", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298727, "uuid": "08f34967-8395-49b1-9138-c04d6828577a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "904ee328-1cb8-4c19-a6e5-a722a0e22a49", "value": "emotet_exe_e5_5a753a78970ced912be1d7adb1496b31224029eec66b01a37f349f2a78e761dd_2022-03-03__091159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e8a07a-9ae4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646306629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306629, "uuid": "e429f61a-adaa-419b-85f0-c24ede3e51fe", "comment": "Malware payload (Mirai)", "value": "c0229199c96c71c0dcb25f0341e7d660", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306629, "uuid": "d38c0038-cdef-42b6-8c5c-0327a67662d9", "comment": "Malware payload (Mirai)", "value": "5a8e14030a2a58049460440e0cda8e76042d8aa928be8a6ee98cd8cfb61ed765", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306629, "uuid": "abf7c030-fdbc-43de-9791-1263e9495b7a", "comment": "Malware payload (Mirai)", "value": "9f5352168ff989c3c5581ded1d7facf13b8ea314", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306629, "uuid": "16837cbc-6863-496c-a421-ac62b21fb13f", "comment": "Malware payload (Mirai)", "value": "7b0c6f1e461a39c3a60feaab2f9d1d232ecb7a29dd0ca6f096473833607ae9afffed18de52fc7bfbe7824f4da09761f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306629, "uuid": "bbd55761-5734-4d94-858e-7008ffa65fc2", "value": "T1C5630782BC80E626C7C01677FA6F508E3315A7D9E0EA32429D155FA07ACFC1B0D6B756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306629, "uuid": "d165b2d5-a811-459e-99e6-32b83e83f920", "value": "1536:7VR4Aty0N0oNG6spXpxZB8t46SbCj96JXoP:7VRbg0snL849bk6JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646306629, "uuid": "9f5f3832-e297-4d25-9f91-4142fc7e3c62", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646306629, "uuid": "e4b96cfb-125d-4f8c-8e2a-b489e0a7437d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306629, "uuid": "0cca956b-cc57-4133-8b8f-91bd3b1d9dbd", "value": "c0229199c96c71c0dcb25f0341e7d660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edc181e-9b4d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646351661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646351661, "uuid": "b3322f08-710a-4093-8f04-5a9363010d55", "comment": "Malware payload", "value": "118b643371e7b3fbf7d62fdb47744086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646351661, "uuid": "e4dc77ad-d360-439d-99eb-649b6d0a9ba6", "comment": "Malware payload", "value": "5ae27a46c31848af1ba1d03aeda7075f60e043fc79f4e3199bf6ff55ec976817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646351661, "uuid": "f66746e3-75f4-434a-bc2b-5b906e8822e1", "comment": "Malware payload", "value": "7c8cb40859aad25f4d70a153d0c080f5d1133266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646351661, "uuid": "36ce08ec-7168-4e13-b095-0c7447022730", "comment": "Malware payload", "value": "d9ac8c57ad527f23b6c0b3cf9679eb1fd277a8d6d48af23b1a5db29f483e7835dce915ebf7324e3cdb15865e8dfdbe29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646351661, "uuid": "7aa5f460-4bbb-4c12-8c30-f03a78b2aa2c", "value": "T1CA15D00439E68034E97697B1CAC4E7F19B3EF725E148A0F264105E157646BBEC84AEFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646351661, "uuid": "36a28668-3c72-472c-9a6a-d8e4f2ab3a00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646351661, "uuid": "b8fbcc09-6fd8-4163-9041-b404866b88aa", "value": "24576:dDk+QXpe7MPIf+2iJBfvbI7d1GU8Un8y:KXpe4PO+hk73vnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646351661, "uuid": "f5f8d1d0-b02e-4906-b037-f2222431aa1a", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646351661, "uuid": "84a27a0c-28c0-45c8-8a9c-8b52f6285385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646351661, "uuid": "a613deac-56e2-4673-ab24-3aff895bf07a", "value": "Over Due Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dd2982-9aa8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646280963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280963, "uuid": "2576c81a-458b-487c-b1d4-34fed60edd42", "comment": "Malware payload (Heodo)", "value": "6b71726c5e4e25b489996cd94a660762", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280963, "uuid": "0dd9985c-b9ae-4c36-83f3-134a7b3725d5", "comment": "Malware payload (Heodo)", "value": "5bfde6284ca1f7a171e9be8cf7f47cd1a01206cf554bc3616fd77a05c8e1fc48", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280963, "uuid": "04726234-0ebe-4a55-8604-38009c177081", "comment": "Malware payload (Heodo)", "value": "ff837410fb2235438201403f5dfab0006f096d33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280963, "uuid": "cdadaf68-7cff-430f-a433-e19d3abfff63", "comment": "Malware payload (Heodo)", "value": "a659cf93574afc605166580ebae469980378abb426a8f7345f905aa8f3f0800e62a4f5a1e8cc6825b412cb3481eca789", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280963, "uuid": "664a14e6-a745-4073-8f21-dde8e2c41373", "value": "T16625AE223AC5C07BD2BF16364506AB6E62F5FD304B359AD76BD02BAD6E345C28735302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280963, "uuid": "861d12d6-2c4c-4e81-b678-da41381da7ca", "value": "c43d7d6aae03def404d4e73d7d3f62eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280963, "uuid": "7fca866a-644d-435c-9d4f-ab3a4b213bbc", "value": "12288:3EfTTMN0tPXuuddE6R4eehQv1mR4z+ZFnQ2v02gesq3MOeqxyo8:3EfTfvuaR4rhQdmuqY3HcMOeWyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646280963, "uuid": "7dc55a32-a168-4a67-90a7-9e3ed2e00974", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646280963, "uuid": "ae36b900-baf6-4338-a221-d2ca9596d0c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280963, "uuid": "6e9f36ec-b71c-4d44-aa88-fcfec553821f", "value": "emotet_exe_e4_5bfde6284ca1f7a171e9be8cf7f47cd1a01206cf554bc3616fd77a05c8e1fc48_2022-03-03__041558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaf9bcb-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646301080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301080, "uuid": "b6eed235-7be4-47d1-9dfa-b3dc20152cfa", "comment": "Malware payload (Loki)", "value": "67d836328136278762f115d81ce17990", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301080, "uuid": "7ccf024c-90f1-40f5-acd0-c9872d6474e1", "comment": "Malware payload (Loki)", "value": "5cf0fe7d3d3c026e6c262014442ceab086c0fb66223f1c70c9bcaea29159f6dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301080, "uuid": "5a141bb0-1851-4a16-8cd6-ae1febbe55c0", "comment": "Malware payload (Loki)", "value": "237a7f26d5d6e384adfd7eb97f15c216cc0d5b33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301080, "uuid": "de62cacd-5b71-4a1e-b44c-71f390c13606", "comment": "Malware payload (Loki)", "value": "8487f0c6371cb4c78d11fff2f1dd034ff2f27f8800565f0cca1a0d2b38f9e56d7f46e8aa19d8c4ad8a74e725f4d4d4b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301080, "uuid": "e48b7424-2fc0-4bad-8449-9aedecbefae0", "value": "T1465412A755930EBFC6B3033119B3FA34D3FBE2DD4262B49757809EB52C5214A881B553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301080, "uuid": "cc5788a1-8faa-4827-8685-37fe37a81612", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301080, "uuid": "08b8629e-609e-4b07-971d-7052e4e61246", "value": "6144:rGi8FyQePpfpO6OsspIDQJ46i7RYUhYzWMrpts:KydPpfTOZ+DD/tRYzNrTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301080, "uuid": "faae6692-94f6-4984-8c57-d0f95c1241b4", "value": 302320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301080, "uuid": "973f1385-48b9-454f-8d3d-3922c1c2874c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301080, "uuid": "22f8efff-6125-4bbf-b433-d2b58526f465", "value": "67d836328136278762f115d81ce17990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde834d5-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "cd80c2a3-6745-43f8-820b-4750dc74bd28", "comment": "Malware payload (Heodo)", "value": "f9e874a31dc3b530c6a4a74c06ab18ba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "b98c0950-d27b-4fb6-a943-deff39a2e631", "comment": "Malware payload (Heodo)", "value": "5d005ae4445a33212fce6d4caa9c93f32cb527989ecc15c2dbb69df907a07ad9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "d979660b-9cac-42f5-8334-a303b45fd63b", "comment": "Malware payload (Heodo)", "value": "524ccbce67b04af748872ecca86bc93d0fb9c7e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "75c9dc64-f36e-43f2-8f8b-fe931a0b1e09", "comment": "Malware payload (Heodo)", "value": "b48aebf1596d9b165e6317c99c712af2cf33f834907ceb25d486c94976bc781e0f75b2321721c9f0b06c36b44ecf1c69", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "05c47f34-8ba6-4b14-85df-9d5a41d2880d", "value": "T152D41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "397ccbfb-1298-421b-8cc3-684ed5fddba7", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "b1cfd2cc-317a-4669-889e-4009130b6ab6", "value": "12288:DjN/Z2wkRrA9CRDCkElAjHDsndSyHOrNvEP0Oua:dEHR+CRkyfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265652, "uuid": "91b47faa-bf52-43ef-939d-26c6bd4ec368", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265652, "uuid": "ecbaec9e-54a1-40bd-ae2e-fe82d68a243a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "24b881ed-2a13-48f1-b207-59ccdecccfe7", "value": "emotet_exe_e4_5d005ae4445a33212fce6d4caa9c93f32cb527989ecc15c2dbb69df907a07ad9_2022-03-03__000046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26a731f-9acf-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646297765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297765, "uuid": "8d1638e0-2d8e-4756-a457-76f43562a77b", "comment": "Malware payload (CoinMiner)", "value": "381506635b081f8d9425719a6c975e59", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297765, "uuid": "0d6f8dc1-eca1-407a-a239-2ca51647950f", "comment": "Malware payload (CoinMiner)", "value": "5ddc2cf610e2d96fd8c46286bf28c201d3435f2e848302657376ff6feace226b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297765, "uuid": "7d4647c8-deb0-405a-8041-a7718002fdfa", "comment": "Malware payload (CoinMiner)", "value": "1c318e5d5a1c443e4d2d745809d3b1f03b88963c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297765, "uuid": "a157f40b-e112-4911-9875-99bf0c16b5cd", "comment": "Malware payload (CoinMiner)", "value": "e8870b6004f18e0280bc8eb89838d0499bdd64cfeb19c78b070f14d9113626fefda890e7ab91ea53100f42d80fea986b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297765, "uuid": "bf9ddec9-1c69-4e1d-ab1d-6c851b9e6676", "value": "T196B5332FAC8C5940CDC499B5B5B69F482F4082B63A0E1FD47AE4314438E6A875BBD7D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297765, "uuid": "8b324295-cdb8-4a75-a1ca-5aa3c0ca67d4", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297765, "uuid": "de9440e9-a400-4089-a578-6f5bcfed2d0f", "value": "49152:29dqARtum2fKTwSMQbF7pC0BDi3TCv9GFykITTx2Zk+zsN9i53ThmPFgR3a6gU:cd3emmClpC0di3uUFyk/Zk8sN9i53Thr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297765, "uuid": "57667cf9-c6d1-48e7-bb49-449c9bba86b0", "value": 2327040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297765, "uuid": "bee29a5b-fa80-4d07-8410-8d4a8cb80c7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297765, "uuid": "e7e2cc0d-b293-4e05-89f9-b530757f8db6", "value": "381506635b081f8d9425719a6c975e59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a72875-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320968, "uuid": "5abaae41-0ced-4783-9ee3-686f6b0d7448", "comment": "Malware payload (Heodo)", "value": "bd8a44939816465252f5a9601bef102a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320968, "uuid": "e24045b0-2a3d-4750-8089-3d3cea954d1b", "comment": "Malware payload (Heodo)", "value": "5e19c0d65b78fe3a82b0e8e52214f03835af86743a05309e199993da755286cc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320968, "uuid": "b32f9ed4-0313-49e5-8b9e-cfedfdd2e286", "comment": "Malware payload (Heodo)", "value": "6ec47a40bba9a91f90deb72b958a159a02da1076", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320968, "uuid": "0067034b-5118-4c92-ad5c-a4348aabadc6", "comment": "Malware payload (Heodo)", "value": "36dab5f5cff093684dea1269bc1a75e7585b65eddf55eb62fab69f3aab0ff8279cb164ed378fee2c9c1a7b8bff4a9aa3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320968, "uuid": "c6e47bfc-9b37-47cf-bf2a-9b64a17da11e", "value": "T13E23E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320968, "uuid": "b1f68c6f-915d-46db-8dc7-253bdbd06f2d", "value": "768:mqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:trVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320968, "uuid": "0391b5f3-247b-4d98-aabf-cc9ce2720b15", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320968, "uuid": "96da2ca0-2625-44ca-a4f0-bfbf052da5ae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320968, "uuid": "d5785f7b-3097-4e12-9295-0dafc9e02f66", "value": "iMedPub LTD_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda82c58-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "ae181936-0853-46ef-80eb-36d1c3f97b4a", "comment": "Malware payload (Heodo)", "value": "2fcb354f71194c4bfeb6dad6367f1396", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "f418a810-84f1-4532-a330-717539f9c324", "comment": "Malware payload (Heodo)", "value": "5e3cb91e5a1554abec758b22a489e8b5cf0eed4d62f85116fe25b555a4a09451", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "3bc6ffb6-3235-414e-be50-0a6088dd5eaa", "comment": "Malware payload (Heodo)", "value": "31ed538765498b585298e4c01c5aeb8d88739f1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "cdf992e5-c527-4563-825f-01a009e2910f", "comment": "Malware payload (Heodo)", "value": "2406329b7989f82ee17979ed90c0d277a352add012b6e9ddd83c25b3b3fe8a506e77f452040d539cfa2ed13a55a06774", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "776574d4-454e-42f4-93ca-b7e961bf2b5a", "value": "T109D41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "be2bada5-63d4-4356-b8c1-05b66bd795da", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "88afb772-c0c4-4d51-9572-6a6d32f28049", "value": "12288:DjN/Z2wkRrA9CRDCMElAjHDsndSyHOrNvEP0Oua:dEHR+CRIyfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265652, "uuid": "79ab9e38-6d7f-40c5-bfac-9f2167d676e1", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265652, "uuid": "cd8f49fe-8d9f-4179-afaf-8ba144739503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "43054053-0f8f-4506-965f-15600a3ace6f", "value": "emotet_exe_e4_5e3cb91e5a1554abec758b22a489e8b5cf0eed4d62f85116fe25b555a4a09451_2022-03-03__000045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df42466-9af9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646315501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646315501, "uuid": "ea4924aa-156a-45c7-bbc8-da7f31364503", "comment": "Malware payload", "value": "4f31b76f67e930a653f64088f3028c9b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646315501, "uuid": "fc526e14-56e5-4294-8b36-1582802d4548", "comment": "Malware payload", "value": "5ef0a2a263fd225a3f2cfb1029b0d7674a0cd9225519f678c05902d4790abf71", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646315501, "uuid": "cf7492b0-574a-4f86-ba52-201ca8faf94e", "comment": "Malware payload", "value": "8378725b11e1202e8b87a28283ff24db1e52ace0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646315501, "uuid": "634b33f0-ac03-45b2-9329-e7d9e9b7c9f1", "comment": "Malware payload", "value": "df418fb848d592438206f25afb7742682a13b6610e6ee2ee432698292a108b75d7c70e8307cc803e8cddebb8fa30b483", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646315501, "uuid": "eb9690e8-c5e5-4784-b687-d731a7487fb9", "value": "T10005E50BB483CE42E546453E8D7ED22002D7FD52AFC1B25B3109B72E2AB23D5DE53696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646315501, "uuid": "a1f2e360-48b2-49a2-8619-53c3bc16075e", "value": "a710919090b88bb6ee88a01ac7806cd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646315501, "uuid": "4358e028-108b-4ec3-aeb8-4c95ffe41ebc", "value": "12288:Y30nVX4DUbLHZq7RLeW7IGHLAN+bP1OGbjFUt:Y30nJ4DUvHZIRLeELm+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646315501, "uuid": "be24432d-f7d1-46e8-882e-e2ead2d4bca2", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646315501, "uuid": "a5208bb7-6936-4ab6-a042-96f2b748a6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646315501, "uuid": "bd852f9d-f5b4-44d0-8499-0433630005d2", "value": "5ef0a2a263fd225a3f2cfb1029b0d7674a0cd9225519f678c05902d4790abf71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab20562-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1646300463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300463, "uuid": "dcc285ca-7057-400c-ad00-b9a699f43ce1", "comment": "Malware payload (RaccoonStealer)", "value": "6b9d028e896f76f72663ccbc86cab137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300463, "uuid": "8724081c-db57-44a9-b9f8-d0e26fc8d8fe", "comment": "Malware payload (RaccoonStealer)", "value": "5fc38752a7b21d5ec78ccc4fd21c5974c2698a5ac8730fa76e3c369fe68b348b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300463, "uuid": "e1c6fc87-ac79-45b1-9283-b6614beef3c7", "comment": "Malware payload (RaccoonStealer)", "value": "c6c7bd7a32d2b5d66b1544deb6c8bef17693e047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300463, "uuid": "06c0d954-d5c4-45fc-8809-9fc8a7c39432", "comment": "Malware payload (RaccoonStealer)", "value": "d6240de7315ae9f9613c2ca2a16e4beb78f97455e296639441f3727f6fb4176b9f496a3fe69d8192d26b2078d6362280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300463, "uuid": "a126fbb9-cf24-4505-9203-0659c3983912", "value": "T1983633694528EE66C977D7F3B84130F69DBD23F398E44690B09B041FAF72622223475E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300463, "uuid": "349c16be-675b-4f34-98b2-3a308ef62d53", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300463, "uuid": "33284407-ee38-48a3-b9c8-18c4757e30e1", "value": "98304:DgLQI7iHvwnQ98mHbPCuMZVoL4Z9ZB9OAvLH7zMwqQdBE2kg1NuAPe5F75IUR21u:D5RoP0b8JvoSdiRg1S5FVIURB1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300463, "uuid": "cc717b1b-dcab-4f5b-bbae-073bf6b21d78", "value": 5298840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300463, "uuid": "4ebcdfe5-5640-4d68-8622-0968a19c088e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300463, "uuid": "b8e19f20-7ace-4d4b-ade2-2f4460acadf5", "value": "6b9d028e896f76f72663ccbc86cab137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0aef37f-9ad4-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646299990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299990, "uuid": "8058a281-1fe0-414c-850f-e51a0d6a650c", "comment": "Malware payload (AsyncRAT)", "value": "90fe07836c23d2fc42c84dbd485d4b5f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299990, "uuid": "35752084-c5da-42e9-83bf-0d0151fdd67b", "comment": "Malware payload (AsyncRAT)", "value": "5fdbcbea1751a7969f219297b61ed6080d0840962cd60cf99593d89448622714", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299990, "uuid": "c54bc487-f49b-450c-9c38-35c159b6c6a8", "comment": "Malware payload (AsyncRAT)", "value": "a4215b4290c5b1a16015b3a904d4c84824455bb9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299990, "uuid": "1fe419fc-4a9e-419e-bdeb-667bf055d3cc", "comment": "Malware payload (AsyncRAT)", "value": "b9bf9b3b1918d9677146be5148a1a5390dbf3980d13fa99953cd138cffded84db95a992739841df4b5ab18e952243223", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299990, "uuid": "b681bb90-ba58-4dbd-bee8-b4206a952d15", "value": "T123125C711B6C5857EE539927E6B4FE16C3D2F53707CB1E42336DEAA00E92B431624982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299990, "uuid": "5e50140f-be49-4f6c-b8b6-c6288ca3d11e", "value": "192:5pi88G/bl/Kv2w5NWkynpBeSOvG3BXFjhefpMalhRDbiJoasC0vIuNDq:d8GDl/Kvt5NWkynl+gTEOsNb0o55vZNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646299990, "uuid": "c3394dc3-4772-4871-9a32-77fd4e8a7d68", "value": 9750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646299990, "uuid": "15411c1a-eded-40e6-88f6-6a9857fef17b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299990, "uuid": "5efc0ee3-0bd5-4aa9-b995-190207c20d9d", "value": "Inquiry 03 MARCH 2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2ff725-9abc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646289456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289456, "uuid": "99db6431-d54c-4a3b-8cd8-22c4d562b3bc", "comment": "Malware payload (AgentTesla)", "value": "ca2c08e24f9bc58439db98916a1145aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289456, "uuid": "33f0e695-5412-48e5-9133-cf71358b874a", "comment": "Malware payload (AgentTesla)", "value": "5fe961f98b993e2d9fa3dc286c07fe5f2cd36f2ee13335286e51b79ba9aa913c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289456, "uuid": "61d1bacc-f0b6-4a2b-a118-bc887e027297", "comment": "Malware payload (AgentTesla)", "value": "4426ff3bb55520ccd9a611fff03cf298fad1264d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289456, "uuid": "d95617f6-5663-466d-96f8-72ada655ecff", "comment": "Malware payload (AgentTesla)", "value": "ebf34fd392b19dadb85e05424cfe1e044703008129a22b072e006ff70a4b1b3732a7d57af57f54082d6db2e0c7af42c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289456, "uuid": "e1170955-983b-4f21-a724-ed1bfd8989fe", "value": "T15DB4230557A7A64219E1D3C4C19BE731FF0EA22353F7BF80B316ABC920969450BB16A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289456, "uuid": "d82ee4f9-f88f-4741-b45b-6c120574e3e8", "value": "12288:jKGLy+r3W2kzsEWNzd9RZhQdl8adRi0BMswZk7:j+u3WZWBZm8adzBMrG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289456, "uuid": "75561430-bd64-4100-9027-32c89f1ff98a", "value": 502470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289456, "uuid": "134c55a9-752b-472f-9f35-542ee9fa1ced", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289456, "uuid": "5827c368-2b2b-437d-b7b0-94f3f0f82b63", "value": "Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73352e5d-9b40-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646346165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346165, "uuid": "be62d6da-2736-41c7-9952-39835f80db95", "comment": "Malware payload", "value": "3436dc308e49087434e1da6f2922c4a9", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346165, "uuid": "2cb707f2-7d63-434a-a2d7-b0b5d38dcdb0", "comment": "Malware payload", "value": "6074e42611ac56ab1a775d82eea846543705fdaca594ba42a944db5d68656ff6", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346165, "uuid": "e368809d-486b-4911-a69a-0db98e26123b", "comment": "Malware payload", "value": "dbeda44b8983a71fe8d5de2cf756e558ea721032", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346165, "uuid": "eac7be30-5cb2-47b7-8c99-5df35d173c7e", "comment": "Malware payload", "value": "f0ffd07b3ad630d19f4322aa2a7d507eadde6242298b5f06972426e4b672b551cd6ed2f3d8faae02048e17588e80ce3e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346165, "uuid": "f0e50a99-bdd6-444a-8dee-3c76b3dfd292", "value": "T1ED23E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346165, "uuid": "5cc38ae2-1e44-470a-8022-c3da66d26386", "value": "768:WqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:9rVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646346165, "uuid": "7a7e98ac-6e55-403a-b8c8-13b800c58397", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646346165, "uuid": "2416953c-5cc1-4580-9684-64baec133a93", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346165, "uuid": "f35042e9-4fe1-4ec5-a2c2-7649fec93369", "value": "IhreRechnung 2022.03.03_0911.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5396c73b-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "2d43d9d3-f41e-46b4-aab1-17282c61bf0b", "comment": "Malware payload (Heodo)", "value": "b63563790d5e75835a4ea3b52d30d001", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "8489adce-cd5e-4d22-8c12-75f3688bd932", "comment": "Malware payload (Heodo)", "value": "61796ca050a6ee89915793a9b1d231267dce11532e2a21c843ee672083b5c2a4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "6a697bfa-7a3c-4a2e-aab7-6700aff3cfa7", "comment": "Malware payload (Heodo)", "value": "21653ce52cb0d725790eed720e24e8c62f76a90e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "eb0e04a1-47a7-4392-b119-dc861e6a8a47", "comment": "Malware payload (Heodo)", "value": "a61f97118c3b0d89999b095c47e3f711393a18b8bd37d0ab1b33a73378f031be977c7bf0515d69aa2c085b9c8add612f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "6ff597aa-0be8-44a8-be0d-1bdc42753000", "value": "T144D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "cd1c6ee8-6f96-4082-a770-8dddf9b78ec7", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "6a8c7ac2-6451-4e2a-808f-764eb16dd990", "value": "12288:ZxpNJJJ2NHPoczJrOtIhxf3foRXIa5EPwvA:Zx2gczJrFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "ee9b873c-a53d-44b2-910a-206449304a90", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "085065ec-583b-4f6c-9b2f-1a0165cb7f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "337022bc-1a7a-4fc8-855e-c658c82cdd23", "value": "emotet_exe_e5_61796ca050a6ee89915793a9b1d231267dce11532e2a21c843ee672083b5c2a4_2022-03-03__000307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8220245e-9a9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646275753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275753, "uuid": "2cff9362-9ff4-449a-8510-b80d48560f64", "comment": "Malware payload (Heodo)", "value": "2527adf258634289a1543cc8800340be", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275753, "uuid": "d4169153-3ef3-4293-a121-c31b2cef40fb", "comment": "Malware payload (Heodo)", "value": "617cd42d60ec58f0389fb3689e1bad5683b7913a8b41d73fb74887fae0ca8714", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275753, "uuid": "3a0bbe78-82e7-4ece-b8f0-1bcad71af364", "comment": "Malware payload (Heodo)", "value": "bdd724d9307b8b3131093a738ce3917b26d8cac5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275753, "uuid": "2ba8ab76-f207-415a-99eb-3b7c57c04388", "comment": "Malware payload (Heodo)", "value": "af008124e9891eb2925e13cf785820073bb8fbab8579d5dd51aed2da3faca1e9fd283436a4cc066d6c6d9d221ea72516", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646275753, "uuid": "9da0e09c-7680-46d1-a786-1c44a7436fc4", "value": "T1F723D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646275753, "uuid": "78caf462-62d1-43cc-bb63-93b6e3fa8ddb", "value": "768:qeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:5oPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646275753, "uuid": "d0addb72-c2c9-43a6-96cc-18a548b4b74d", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646275753, "uuid": "f5f7bb82-1828-496c-b2cb-d107c7c48578", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646275753, "uuid": "47bf2c99-9c46-4cbd-954c-a7fa76d899e3", "value": "Money transfer details.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de26e55-9b18-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646329003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329003, "uuid": "e327ac9c-d2ef-4f5a-bdd3-0f0a86737915", "comment": "Malware payload (njrat)", "value": "08bcda604387adbaca46c6ce200e82c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329003, "uuid": "fe7a2ed3-fd69-450a-960d-064425638d2c", "comment": "Malware payload (njrat)", "value": "617d6beb4fdb64c136fbb158c0151c72065cb37866b4287f538e236b31d76d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329003, "uuid": "3216e4f4-86b4-45a6-8872-47ad6f2707d5", "comment": "Malware payload (njrat)", "value": "d3ded0217eae864e04e1d945882a8b974c8dee87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329003, "uuid": "d608be4a-a8fb-4d39-b753-c4227ba83290", "comment": "Malware payload (njrat)", "value": "dc4a6d7fa0a6dd4b89eaa732e1e5adae38d02f1fc9ed64f932804284015ec8b42b2794c599dd42093ec42c977f114aa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329003, "uuid": "3844d334-17b3-47d3-b74b-0afa23003015", "value": "T104E34C1C37BDC26AC1EC0A381DE1EA7112BFDD27A829DB4D349079ED5F767850A109E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329003, "uuid": "99d46cc1-6b44-45bd-a1d2-0c6f8e83e662", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329003, "uuid": "471172bc-729b-4af3-ab3a-b8ed3445b4e5", "value": "1536:fZX9nYi9buaSPVkvP9OFhtf/kRyndPNTXpOsmIcS32Xv+:fVBYi9bugOnu4jpO5IcS32Xv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329003, "uuid": "8c6f1025-42e6-4466-9a4e-d56e4e361707", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329003, "uuid": "fd0945bf-ab8d-4ae2-9377-a7734661e809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329003, "uuid": "9f1e987d-59fa-4ac5-b99f-f9d54ff3c35c", "value": "08bcda604387adbaca46c6ce200e82c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba7bbc9-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320973, "uuid": "8b166951-f29d-4114-8827-d1027cfff2c9", "comment": "Malware payload (Heodo)", "value": "3e87149b2574f178fd3bfe9d0ba21170", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320973, "uuid": "f2cb7519-baae-4c93-a50b-d7869901faa3", "comment": "Malware payload (Heodo)", "value": "633ba36deadc190ec0a64a37718c466f37974cb604ef0ccf63792de008ee9f39", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320973, "uuid": "8e1a44bb-34e5-4cda-8711-65d9e63c15f8", "comment": "Malware payload (Heodo)", "value": "02ac4c594d0040a0529e40209c2838e3c79f5769", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320973, "uuid": "1dc08153-310d-4e5c-966d-11153cd2805d", "comment": "Malware payload (Heodo)", "value": "94f01455c3838f8d260d222ab48cdf387b88cdde9a556aa21178e1b15ae3f500b235a71d23eb22f2097c13eef1a5963c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320973, "uuid": "21b77ad4-c273-4130-9f0a-9e4781d1320a", "value": "T11A23E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320973, "uuid": "17ea6d0c-5a7d-4304-9549-b7442e41e04e", "value": "768:u/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:u/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320973, "uuid": "f1310e04-ca17-42e7-a521-df3f8bc6bf34", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320973, "uuid": "76302fcf-6845-411b-94a9-ce3c3c6be30d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320973, "uuid": "2dc9796a-bcbc-4329-a042-da3ec02a4e91", "value": "innovinc.org.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540a85e9-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "ed3cc329-4e73-469b-b2df-0371f20bf7e2", "comment": "Malware payload (Heodo)", "value": "c7a0d5c0da6e421cc3b0eaf26e41f77d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "70df08c3-ccc9-4f10-a32f-cf5ab1c89079", "comment": "Malware payload (Heodo)", "value": "63963b0f4fe18d1fcdc5665927c377536e7f088b31b3a5296cc0eaa3d916909b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "9c0290bc-a170-4c59-86d9-0b38562ee03b", "comment": "Malware payload (Heodo)", "value": "58f4921284d3765f94c06d7614e0025bda3a6da4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "7080e04d-029f-438d-b319-ab6bea8a284f", "comment": "Malware payload (Heodo)", "value": "4236ce4e55d964fb7e28fefa3e7ba553d926469b36cc71980f77ebbdb495ce7b7969f664c963e76a03e9425038f53c92", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "5c62f34a-7ab0-4ea9-ad71-3890528731e6", "value": "T15FD41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "fc548073-583b-4a2b-a006-9afc42a82051", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "5addffd4-4aff-4e4e-9800-74e5f0fbbe16", "value": "12288:ZxpNJJJ2NHPoczJsOtIhxf3foRXIa5EPwvA:Zx2gczJsFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265797, "uuid": "05e180c3-cd54-4a98-ab20-a4cb75180dbc", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265797, "uuid": "98afcb26-9362-4102-a9df-fa6d1444e331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "fe23e0e3-7053-4550-97db-08769a140753", "value": "emotet_exe_e5_63963b0f4fe18d1fcdc5665927c377536e7f088b31b3a5296cc0eaa3d916909b_2022-03-03__000306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c08bcc-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646300534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300534, "uuid": "eda9504c-9664-450a-acf5-ae6af436be4f", "comment": "Malware payload (Formbook)", "value": "5ecc6afd69d90b2cb8eb7c1e2e6863c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300534, "uuid": "25ab5f30-86ae-4654-8e4c-179247dcff2b", "comment": "Malware payload (Formbook)", "value": "63c80143bd1a7a36db27eb99762a5ca125a087995185ba5d583859e1bd93c62f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300534, "uuid": "97726afd-f0ec-48c5-8682-5f9920ab2c18", "comment": "Malware payload (Formbook)", "value": "6a39176eed7408f7f3c5a7e19deaa5c86c733122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300534, "uuid": "6bcf4f8c-951a-46a3-bfb1-2fc48c3c7293", "comment": "Malware payload (Formbook)", "value": "a48667d8bae3af93408043c7b1ed1c19551eaa6452a123dcfc8fbf0b39defe68000dd086b0c6ba2a4cd1b92198561bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300534, "uuid": "02a76856-d3c8-444c-8e97-ef20b9ca6b93", "value": "T1FA75E0C1E2A94656D27D5ABC90B32030C7678A661CFF92095B78B1D81B83783DD352FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300534, "uuid": "109eff36-0f0e-49cd-a7b4-d06748c4dcb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300534, "uuid": "3cd74b52-5656-4a34-8f52-248022d793a9", "value": "49152:L2lkAWVxueDUKc0cYUmu7k83v/4Hh6y1UmVr4QzDd:KlkAWVxueq0cYUm+T2Pr4QzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300534, "uuid": "fbb23bae-e6d7-4bfd-866f-d94cf78b29fb", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300534, "uuid": "44155225-147f-46ed-a4d2-72f05efb014c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300534, "uuid": "8c15ee4a-7f9f-44e1-be1f-f7c2f0004198", "value": "5ecc6afd69d90b2cb8eb7c1e2e6863c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72265038-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646294624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294624, "uuid": "67e2761c-abdd-4263-a851-da004cc27dec", "comment": "Malware payload (Loki)", "value": "46d58168681578ce3621ad8d79e4fc79", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294624, "uuid": "b3b7c135-dc3d-41cf-b0d5-d8567f517322", "comment": "Malware payload (Loki)", "value": "63c9f9ebfdd56d9c90555b4d23809c6af3f3ade311236eccdcdada2822d538df", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294624, "uuid": "3f370dbc-c76a-4a33-84f5-72a3b8835f7f", "comment": "Malware payload (Loki)", "value": "6e7d9c6a12417dcb2f48ece5f5a4afb48c3b1e4e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294624, "uuid": "e5d88293-d5e5-4a2e-8d04-1607e07ab271", "comment": "Malware payload (Loki)", "value": "c31cb4e6c89bad7b4d45c9483a92dd943603ed3547e50e881059aeed0e782997131abc32be46389dd6cc74b5b803ab7d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294624, "uuid": "d5ab83c2-302e-4357-98fa-2845fc4dd727", "value": "T1701412137D86C5B9C8304F384CF14B8A0EECFDA685D5A27D161BF2394572A4664EA3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294624, "uuid": "e1ecaf2d-e673-4244-94f0-5aede311d527", "value": "3072:wE9QbT4c4zjy2ZFwZDQx8ZzCf8nFCUyogC/rGxw4biVGfodfgPCiLemx3:NQP4hy2ZYDaazCKFCUyHC/dR4oqq6dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294624, "uuid": "7a9c41ae-1b33-48c6-bf5c-300b56e17448", "value": 191096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294624, "uuid": "a68ce222-0784-4ec0-b970-18ae130541ba", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294624, "uuid": "1a12171e-ee9c-4bda-9a70-9986d0ae2565", "value": "INVOICE NAIM7421814.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4aa01af-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298198, "uuid": "910a541e-69df-4474-90ec-21a9dc9929c3", "comment": "Malware payload", "value": "0e63ce314706ed134c2428cc142d9c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298198, "uuid": "b8c4e3be-1a1d-48eb-a576-00d1db3e060d", "comment": "Malware payload", "value": "63d4c3913ab8a4d494a39bdb71675f3f5b7b4d983ca68f8f2c6bfb64aec31c92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298198, "uuid": "3e0f5d3a-1f93-4537-90cd-ec432593e2e0", "comment": "Malware payload", "value": "415423ab9ae41940b16c0fc74a70275fca2f97d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298198, "uuid": "ff87b654-caac-4dcf-a4f3-ad2a1204c155", "comment": "Malware payload", "value": "a2dcfa4e3ad34f65b406982203eeca3bd14d16d732569f22943234e3407f2e38a86993aef2edf020bdd4e84e99741571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298198, "uuid": "67b6042d-1a5a-4117-b887-8e0e7679ec26", "value": "T173B53317B8B81CE6E46D337251A1C31B5B44F0A20395831BB2466D53AFA5CA44FFBF86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298198, "uuid": "71595bfe-6229-42b5-b730-3e8bea0bba52", "value": "ae08f2d56d8657840dac6186002f1d05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298198, "uuid": "b1039ef6-e7a7-4323-993b-312b096ba2fe", "value": "49152:UtvKIjYhvHOcvPq13txS97wABlwY8FG1RJeR9gZAG3Eb5+rBc9qiCtcsCG:UtC2Yhv613tu7wAPwYXoq3SkNc01xD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298198, "uuid": "6b0050a6-82ca-4349-95b9-e88742e26482", "value": 2295376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298198, "uuid": "fc59a489-1634-42e8-8a71-a2798d132f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298198, "uuid": "00eb0d8c-fa4d-472f-963b-2df7725a22cd", "value": "0e63ce314706ed134c2428cc142d9c65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c8b432-9b1d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646331184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646331184, "uuid": "a8ebe34a-1b3d-442a-ba68-1facf9d98074", "comment": "Malware payload (AgentTesla)", "value": "f13b59c4e69931954816180f9ed87272", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646331184, "uuid": "7b12ae92-a5b2-4e77-a1c5-5bdd6265cda4", "comment": "Malware payload (AgentTesla)", "value": "63e91c4f0df4dcd2c92888c7ff1084acb0ee9fd305dc4772ca368853ac92b92c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646331184, "uuid": "82c552da-702f-43d8-917b-471447f45466", "comment": "Malware payload (AgentTesla)", "value": "b5bfe6f9b39487fcd8ab447e74593c14d6cfcfb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646331184, "uuid": "11265990-ccca-403b-8594-84937a615d77", "comment": "Malware payload (AgentTesla)", "value": "0d652df6426f3d8802e855eb97c7aad38de5bceb7d0ee9854cb04a93cf2c8fdada6f7a73f09de58e96542f550c2dca20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646331184, "uuid": "5290ee3d-725a-46bc-9bae-ffb7df173ac4", "value": "T15535BF44B8D24034ED354BB0C994EFE0872BFE25E9B860BE59007D2536637BE8856DBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646331184, "uuid": "4250d7dd-7cb7-48e9-88c1-a370f61330c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646331184, "uuid": "b1569222-2015-4bd8-a6d4-0b5cbe486408", "value": "12288:7w3R/IUTRRzFpqgnD+RGlYruYRZdAhT6zIfsN4ubcsc8z7T+FiVMSmvMiDhHuP:EbrfqgcBaYXdo6kfsN4kcqwixmvlDhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646331184, "uuid": "5b8bf369-5ce7-4792-819f-c9ae69710d46", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646331184, "uuid": "a8c56232-f378-4852-ac99-d5ba012f4071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646331184, "uuid": "d1229635-4795-4212-8542-b3628ad5ad72", "value": "DUBAI GHC29138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2ea6ad-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "044815a3-c128-439b-a16f-855025be0654", "comment": "Malware payload (Heodo)", "value": "4d8876cb6ccfb8fdaf760ebdaa6bfd7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "42f14b75-91cb-4d69-ae3d-63d659f8e00e", "comment": "Malware payload (Heodo)", "value": "642a75139a09f26f9d430b53da2e72c5435496534b3e9fdb7043aeae85522151", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "b8ee8c81-eaeb-407a-82c3-9ef8f9d0cd66", "comment": "Malware payload (Heodo)", "value": "5d24d46a6175bd0c2a4076c1b5453300b463c617", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "79d69f7b-6d77-4ca0-aa3b-2c734dec1bf5", "comment": "Malware payload (Heodo)", "value": "4b2fdfe9d6d2d52b069e5f12f9c98623a88c0d9fcf51a0b26be0797862be9ee39320320f13fea59183301f0d11520469", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "027494a2-38a3-416c-8ce1-5c5f260bc21b", "value": "T1D2353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "7bcf6ff9-da3e-4bde-a3b8-3756bc79200f", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "eea40c1e-a199-435e-8705-8a6ea3ee44b0", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZw1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZeytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298726, "uuid": "0f0b9da5-b824-41ec-9ff6-6695b4ff8078", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298726, "uuid": "764dea58-6062-4c0e-9c1b-c5fca1b626a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "41d3c7e1-73b1-4905-9697-165a6d8ccdda", "value": "emotet_exe_e5_642a75139a09f26f9d430b53da2e72c5435496534b3e9fdb7043aeae85522151_2022-03-03__091158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48663afd-9ada-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646302284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302284, "uuid": "2e47dfab-80b4-48da-b182-26461894bb54", "comment": "Malware payload (RedLineStealer)", "value": "a768e4259faa0966307a9afc5cd895de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302284, "uuid": "6a5c8b83-c4ce-41eb-9743-964f2ad451a6", "comment": "Malware payload (RedLineStealer)", "value": "6489e500f911c3fb5d0e86b9b0723b051a0973538001cac94cbe32b597f8b0f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302284, "uuid": "276bfeb9-74eb-4856-89d7-cee7ccada897", "comment": "Malware payload (RedLineStealer)", "value": "d46d962edc91c7f0f470341861018e6050f4e48c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302284, "uuid": "b77f3616-1f66-4721-8008-8f73ac534d82", "comment": "Malware payload (RedLineStealer)", "value": "6f6ae62324c68fb79071660be5ceb7f83b781a05909c3ad627c5e4203c9e033bb32c850525ed8855efcc2424965851c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302284, "uuid": "90303d15-04f2-4431-ae5c-721eac83de37", "value": "T1EA2633D03FCB0E92C6CDEB7027E19092DA3184E9E6B0942563AB5513BD0F7B5A5D2393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302284, "uuid": "de3baaf2-7b13-4972-b070-f361ed454e01", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302284, "uuid": "1615fce8-eb6c-46ac-ba2e-3d2d7897da0b", "value": "98304:HcFQsszWrKa+OjMeHoY2ZcyTTbxaNRLGuN4JLY3lsIQk646OAs5MzFJ:8FSzWD+OjMF5bcNxiJ2YkJAsgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646302284, "uuid": "0ce937f2-45b0-4eb0-b540-55e45a10405f", "value": 4561200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646302284, "uuid": "a74acba2-2d06-4630-8dbe-515397355af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302284, "uuid": "6eb92c5d-28bf-449e-b680-67d81de58043", "value": "a768e4259faa0966307a9afc5cd895de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed61db9-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298859, "uuid": "49aaea23-983b-4e07-8dae-58c950f7a8e7", "comment": "Malware payload (Heodo)", "value": "37fb600bf8217dfb5c75fd2c7fcc7d65", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298859, "uuid": "889e99bb-8f54-4b7c-bf67-425ca23900d6", "comment": "Malware payload (Heodo)", "value": "6516d944f93186e7d422e7b93a476d4b04db0ed279ba93c4854d42387347d012", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298859, "uuid": "089055f4-dba4-4727-b80c-50b6ccd35fc6", "comment": "Malware payload (Heodo)", "value": "5ad40bd21ed618de1fd09077073d8b1769f0094f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298859, "uuid": "9ff7bb14-5878-4f98-8ad8-74fecdae343e", "comment": "Malware payload (Heodo)", "value": "f4eb83c06581ce41f3d69e631da40191ecf089e99110c6e1f9d7b92c8c04b03a815b52fabc9569d8659755dc24fd879c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298859, "uuid": "8aecadd0-4b93-4165-b74c-75c141e46f51", "value": "T1DE23E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298859, "uuid": "2f17b4bb-39fd-4fff-869a-2b3f46fcbe09", "value": "768:GqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:NrVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298859, "uuid": "741b54e4-2944-4d80-b2ed-82392e3133d6", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298859, "uuid": "2f5df28d-a5b5-452a-b7df-c312a50250be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298859, "uuid": "ff943cc3-2776-47ca-8611-af66f779ab28", "value": "OMICS Online.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254a5ebd-9b12-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646326277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326277, "uuid": "89690629-92d7-4ee7-a178-35c61c11a8fc", "comment": "Malware payload (Quakbot)", "value": "5f41770808631e45c834e46dc544e0a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326277, "uuid": "5eeeabff-86ee-4389-95ff-e54a2bac6914", "comment": "Malware payload (Quakbot)", "value": "65d1b723f439a40ed0f0ff8d1ea949313fb49855f09b3c38805f2e49a073b652", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326277, "uuid": "b6bd2852-791b-4928-b98f-e428b90312c6", "comment": "Malware payload (Quakbot)", "value": "87cdf4d25c7134f5bdbb8dea2803c158180d35dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326277, "uuid": "4d5c7a0f-27ec-4e0d-9c32-7ad616c3310a", "comment": "Malware payload (Quakbot)", "value": "a971f5defa8e2c545265383296481583772ac72eca59774d1abab7ec8956d1d5949b31060032934b80c232de371c72c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326277, "uuid": "91ab6a46-33c1-4b2f-8f6a-aa43f95d39d8", "value": "T12BB4BFB875146CE1E6BF163BC995ADE803762632DE87D8CE506477C709733A1FE1280A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326277, "uuid": "fde83cbb-d43d-4cc7-966b-a0791bc7da5f", "value": "0383b6e78c7f005efbff386cee23786c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326277, "uuid": "680ad68e-346c-406a-9412-b3c99de08fa6", "value": "12288:vnKiMBsfsXtxbohL+/JkjFbK5BFHGiIDwqJ6dYfH:vA6fevoVaJmFbeBF5IDt6dYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646326277, "uuid": "71ed83de-5313-44f5-a1bf-febad11c1d4c", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646326277, "uuid": "1228d1c4-819a-45df-8557-6e59a308399a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326277, "uuid": "a0b1823c-0dec-481d-89ae-8a45912b845d", "value": "6575895.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c660c47-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646300493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300493, "uuid": "9a24ecc5-067e-48d1-ad61-9f6f4c1f42f9", "comment": "Malware payload (Loki)", "value": "55e94f5b0833ca6ecbbd5dc2e7b376a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300493, "uuid": "40f1953e-f16f-4d3c-a05b-09c1ee1a781a", "comment": "Malware payload (Loki)", "value": "65fccd78398e413832c53a4b0341b87a3f374c8fcfb183cc45301a2f671c0c43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300493, "uuid": "fc19eb47-7c25-43e2-a079-2f39e4654e2b", "comment": "Malware payload (Loki)", "value": "43eaa898d69fd6e89730716a68c3c28d80d5e2eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300493, "uuid": "64b57813-7287-4048-9e9e-5fac8819748f", "comment": "Malware payload (Loki)", "value": "96da233e77a09298f3e3d145c6edd0a73e7c5144b1639de18c926993a1819b793f7799c6cb92006aefd02a645eaeb0ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300493, "uuid": "463c05fe-5f92-4c37-97b6-cad8cdc3dfcc", "value": "T199542223BCC2AA7EC4D605F12437CAB4F63A91E803A101575B649FF57D83E8A550C9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300493, "uuid": "11b30b4c-a8ac-4790-bbc3-5539e9931423", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300493, "uuid": "375f121b-25e4-476d-8aae-3b1d943ffccb", "value": "6144:rGi/UnY4lNAxktifKZ6I0UGnA4w5QpXJI7Gcq3RV:gntAxktiKMA4r/jX3RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300493, "uuid": "7b9c4e16-0749-46d8-9851-92d973cba701", "value": 301491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300493, "uuid": "372de9e0-49d2-4959-8d22-8fb7ed9ef593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300493, "uuid": "dfed05e9-eb10-44fd-b34e-c84f9e3427e0", "value": "55e94f5b0833ca6ecbbd5dc2e7b376a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2afc79-9ac4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646292845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292845, "uuid": "82db8a00-4af3-408c-9c28-85a009e7638e", "comment": "Malware payload", "value": "037ebfa45cdf6e0c76799c67e095625c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292845, "uuid": "c3d7ebac-9ecc-4ff5-befe-cc2186551fc2", "comment": "Malware payload", "value": "6761b2f083aec46ee207fe47f896a1943301e15a140a38b250d46c17824bf5fb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292845, "uuid": "d23ac749-eff5-4ae0-97b0-5075862b2dd3", "comment": "Malware payload", "value": "48d4b44d8a67aa6a66041e2b134d14d4a012b7e2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292845, "uuid": "8b4060f3-eff2-42ef-bcf7-5ff9f1b3462d", "comment": "Malware payload", "value": "ae934e4d24db642aa136e341485c4f50a4d13638c899adc9bcd620e9e01eb7d30823dc1ea870ed166815e070891b3d96", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292845, "uuid": "02b90a85-5c1b-4889-b97c-6d9a8712da08", "value": "T105552352E7A2D91BECF7283388476B7252336C974E931E077B8D57153BB23C907066A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292845, "uuid": "72b22ee7-b4c0-43a2-8197-ea609819a336", "value": "24576:MrRfjDmX9LIUHlgdw26OqmdZ31Tgex184kR/Q2KoUriq4yYnyxHuRg:+RrDmNLHa8mdZFger84kR/soUr0yYn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646292845, "uuid": "6dfcdc9a-d5d8-410f-9728-5361bb504449", "value": 1398905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646292845, "uuid": "6541291c-bc0a-4636-b1e5-fe6abafda21e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292845, "uuid": "0b1bad67-6d81-4d1e-b45c-474d87f165a5", "value": "bancasicura.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8787df-9b46-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646348862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646348862, "uuid": "4fc42af3-ef9c-4483-80e5-9323ca31cb43", "comment": "Malware payload", "value": "6bf33ae2be20f38e766bfc4067a5bb14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rev", "colour": "#6B37D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646348862, "uuid": "b06e8e3e-f492-4cfe-bc86-06aa505f6110", "comment": "Malware payload", "value": "678376204602f3d60d11725b0f62d125caa65b22200ec282e0806e055a9b59ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rev", "colour": "#6B37D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646348862, "uuid": "24be87ee-f81d-4b24-81b0-0869d669c9ba", "comment": "Malware payload", "value": "eafd9b75f4db49e8fd2e4f63724b1bcbad84f3d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rev", "colour": "#6B37D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646348862, "uuid": "7871dd3f-b93e-495d-91c8-b9fea3c9e3ac", "comment": "Malware payload", "value": "3e2b29a88aa361b3b81c67425c401e523a092f859b7e51938a43c441eb50636ef8f27c156a8cb94fdc43b537e7a54ac7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rev", "colour": "#6B37D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646348862, "uuid": "43769d13-fdec-4f98-93c0-f861d560a314", "value": "T18474E16D979EDF72C3EB4E3795A1260053B8F04A8E47F34A70505AF4AE523E78C22D16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646348862, "uuid": "423c827e-0b28-4809-9a48-3d6bad520364", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646348862, "uuid": "aa0e25a6-e84c-4b29-9685-f659bf97b084", "value": "6144:SbLmvOFvbNXNcs8ob3YO8uqK1suUKW+LiBgZN4gT0irRi/Uvp:S2CB+s8obZ2K1s7V+LimHwirzvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646348862, "uuid": "97f0c3d9-155b-45f5-ba88-da965b50e67b", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646348862, "uuid": "3b170590-241a-4f4f-89fb-9018042fcc13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646348862, "uuid": "4f43a493-7637-4f5a-a606-01da686009d3", "value": "https___radio-hit.ro_FEB2.png.rev", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2b2589-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300278, "uuid": "4a6378e1-e953-450a-aefb-95fd31389b3c", "comment": "Malware payload", "value": "49675a0c343c61b3a73f9d9552e1cffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300278, "uuid": "536b481e-6b69-42bf-bf8f-f6bbd7ac54f0", "comment": "Malware payload", "value": "67cccf2e99c8902365570711a4089ce41082d7cfaa0a2696f13dde60ff4693fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300278, "uuid": "19deb9b6-ae71-4682-91b7-2f3c4a4adccd", "comment": "Malware payload", "value": "f0f3d46f534419d38437c5d152f47ce265b867c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300278, "uuid": "14830336-7885-4222-9802-4b57a90c85c3", "comment": "Malware payload", "value": "61b5d45175692c1e9a31ee2107ea6a31f1f112cdcc959f768de1834002f20acadf1bfc9c416b36bf5955d186a0e5ee78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300278, "uuid": "971bad61-2d2a-405b-9ec8-4e8a27e57c3d", "value": "T155D5F1A2E710F87BED22B439D420D4F12AB3BD25D984A10F246D3D6EB77624201AD65F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300278, "uuid": "b2281dd4-94fb-4e46-b1ed-9061382e525a", "value": "aa770df5b9e208c1ca436e9267f0d390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300278, "uuid": "598f4f00-b568-4e18-8824-3937e4ee50c5", "value": "49152:OYtWyNyvRDbxiwnEhTY3B0YxktBF3bur9fSt0njAq2l1aZrHkN+aQ2KYSxMlOf:OYt30RcAEtYvxo65fSt0PCwyRKYSxMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300278, "uuid": "7aa4ea0a-a053-4015-b3fe-3c32ca0bdad4", "value": 2818048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300278, "uuid": "bd564bc2-65da-4d5a-bd5a-61266f47cc68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300278, "uuid": "9d319eed-4c82-4331-bf31-44967dddb5b1", "value": "49675a0c343c61b3a73f9d9552e1cffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99c07d0-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646294368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294368, "uuid": "70389820-9dc5-4ee9-9119-c800e3cff06e", "comment": "Malware payload (AveMariaRAT)", "value": "211ede1a320aa7904e5569cd838933e6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294368, "uuid": "cdb2a89e-113d-4c47-be2b-0fd20145e6ce", "comment": "Malware payload (AveMariaRAT)", "value": "683398930b3332516e89acb582c37bee77a4a8bada597ec772e921494ae4907f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294368, "uuid": "4c2384b6-8b5f-4c67-9fd7-4482ae365394", "comment": "Malware payload (AveMariaRAT)", "value": "0e0764c9f0b26e5d03a30cfddd13cb3cfd78ccf2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294368, "uuid": "a40a1ae2-1fb1-457c-b5c0-d776874939b6", "comment": "Malware payload (AveMariaRAT)", "value": "eb83d440a41a862dd92a1c5707c776eb25e815705270a385db5507069e8b4f2ef2a555f55ea9033a89507dd12b2f4bc7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294368, "uuid": "723db312-81dd-4fe8-a507-58ed2d70cd62", "value": "T1C18503B22BD9C034E93687B3E98097B0C72FA615D84860B2EC319E04767277D8D57DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294368, "uuid": "0217fda2-bded-46a4-ada5-f862fc6c9d2c", "value": "12288:YW1R/IpTLnixhXvAs6d0DLgWgdIujhBQpPy7FtDzGgdVsCBxEC5:JUXnohfAs6+DLgWqjAeFtDzGgBiC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294368, "uuid": "88139e33-932e-4868-a9ed-f60cf5e35650", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294368, "uuid": "b6c65747-8734-4198-8db9-a8298537aa89", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294368, "uuid": "48d2ef61-c784-41d1-9f43-b6e21ad63414", "value": "New-Order#38834343.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c988472-9af3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646312922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312922, "uuid": "9733a973-bf44-49a6-bd3a-56026c684931", "comment": "Malware payload (RedLineStealer)", "value": "0188998f12c6a84883437eb1a22e1b24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312922, "uuid": "81d6b2b5-b5a6-4b4a-a181-7fd85392c54e", "comment": "Malware payload (RedLineStealer)", "value": "687cbfbaf667ca21852f2499706ede3ff280edfc6418871519966c6d42195388", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312922, "uuid": "aa0f89ea-9cce-4a51-a96a-836aae471ba6", "comment": "Malware payload (RedLineStealer)", "value": "24c693c47d34ce710018227554eb706b5b176cba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312922, "uuid": "9e159e87-deef-4d9c-801d-72935796199c", "comment": "Malware payload (RedLineStealer)", "value": "459a4bd0f15bb3e6fd9279baa37efd96f691c5c219777d16dc5a8ddc04c1d855751c83544c57d9be73da5cfcd74bf252", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312922, "uuid": "80ee72c4-0dca-465c-a843-bd3032b8210c", "value": "T17A3633AF8B51FF3ACB03C6F4F680547A70AAADC0A7C48D5871990A47029C6F7CB659C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312922, "uuid": "10e4526a-33ce-4977-b642-89eeccf95397", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312922, "uuid": "97a62339-0fe5-4632-86b4-4d15be33a067", "value": "98304:MxbcuaOUpSth4pPC/0xtLjlo0PtqOw+uxXnf5I1MEdR6OjbXVu9mzVEOpPQS:Mx1atStCp7xFj604+GXnRI13dR6SbUmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646312922, "uuid": "067d1a42-7816-404e-851d-6b0680cdad1e", "value": 4884480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646312922, "uuid": "b685e06d-9951-4ad2-9f83-b33b30879733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312922, "uuid": "6fea9b82-14cc-4280-a69c-14c85ae5d1f7", "value": "0188998f12c6a84883437eb1a22e1b24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f621433-9a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646268688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268688, "uuid": "8ae8dbf3-ffde-4e27-8b97-cd1c0d4b57b3", "comment": "Malware payload (Heodo)", "value": "8c07f706a820bec6a1ea1420e1f8348c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268688, "uuid": "893ffcb7-831b-422b-a1d6-12b0af2a5856", "comment": "Malware payload (Heodo)", "value": "68964c6796de5ef9bf961527898e6c80edf6fd6d78fefdc95108491d9976e2d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268688, "uuid": "9c121b3b-ed80-41b3-ad74-64e7460268e0", "comment": "Malware payload (Heodo)", "value": "e8f6d731433a6455bda7d1ad5d668a196762636f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268688, "uuid": "7987f474-e7bd-4e5b-a1ff-a9bc158326f9", "comment": "Malware payload (Heodo)", "value": "bf23b256d55fdce8eb981990e05b1f4e0c4f3fe293e84a9b846ebcbd45696294f47785d613dd4f1a3856846417370840", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268688, "uuid": "106e96ca-7ba7-4612-bc98-abb47eaa1550", "value": "T11B45AD1137D1C07AC1AF03B5491AD769B2FABD646FB542C76F902BAE0E344D3D636242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268688, "uuid": "da1a1f82-bfd4-4abe-8293-39dd81c34c3e", "value": "2e575d8fb1e65dc783586b7b235e64a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268688, "uuid": "155c78f5-44ca-483d-9dc4-2686b1f209de", "value": "12288:/XF08FkN6ZayRkNx22Oi3NjjsjPb5SqZox02IDZN2W6VaYiKntDNPq:/XFt26ZaKIx27R/UqZQ02IDzJmaYD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646268688, "uuid": "bb615387-6902-4c99-8e47-781d1f199cd4", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646268688, "uuid": "040d4119-74ca-4a6b-84ee-6b228ce8e4e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268688, "uuid": "53dfe448-497a-4fe6-911f-88b8c37b8371", "value": "line.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534c54d3-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "1b67a203-cf5a-4820-8cf4-d9555a24fc54", "comment": "Malware payload (Heodo)", "value": "d5e87a1218c365e987d9697cffe9b3c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "983657b3-6720-4813-be39-5d2db462f9e4", "comment": "Malware payload (Heodo)", "value": "68b1edd3c8c32ee6e5bc413cba837b13b4c4ae7cf20e7c94be065c5b6d9818aa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "3e336884-ed53-4fce-a74d-2ddcd562dd27", "comment": "Malware payload (Heodo)", "value": "76df7ced457b9b50981f51cfdb0e8577bbdae1a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "a852264f-57ed-4417-a289-f65d2e67f50c", "comment": "Malware payload (Heodo)", "value": "044df844ad649d79067d5cf3e1bfe3aed6c2200e96a95d2375641fce5dd8195d664a3ef0342da9785b9216c75fc00576", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "a89ed145-f42f-4818-a16f-87b290706fe0", "value": "T12DD41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "38072a15-0799-4b8c-b23d-7e6bf46ad5b6", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "b551e10a-1f6c-412a-9c02-1144740b0838", "value": "12288:ZxpNJJJ2NHPoczJrOtIhxf3foRXIa5EPwvA:Zx2gczJrFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "b7d3fb9b-c4b3-4866-83e0-215fcea4fe14", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "b73cf511-92c3-4a0b-8e6f-f08fe3eede34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "31f1aa03-94ae-4ab2-a52b-2379d98a201d", "value": "emotet_exe_e5_68b1edd3c8c32ee6e5bc413cba837b13b4c4ae7cf20e7c94be065c5b6d9818aa_2022-03-03__000305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65838b2-9a9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646275894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275894, "uuid": "019f0f35-64a7-4a5e-a641-9e1cbed4301e", "comment": "Malware payload (Heodo)", "value": "7b7565e41809a7e99ab73a1e4ad35cee", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275894, "uuid": "29476b99-f64a-4587-8e9d-16234e46d93b", "comment": "Malware payload (Heodo)", "value": "69da6d3dc89b4e4bdbba52db6d679ff69a50dc068f69642ee3d208aaff6af349", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275894, "uuid": "f7381201-2924-4fa5-b170-95db608be8e0", "comment": "Malware payload (Heodo)", "value": "fc2c6d6d9871c3c1c2c2ecfc099dd1ac3e676220", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646275894, "uuid": "3a3c365a-ebf0-48e1-852c-9a9ad969cff1", "comment": "Malware payload (Heodo)", "value": "8e1f809f080d5e14c6004635d594b5871456dba4cede96fceee1dbf33d7844f1ea9224403646400b76c0f26b0edc9667", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646275894, "uuid": "cb7b550d-c8c9-4d56-bc8a-eb7dd6c4eecc", "value": "T14E23D119C560682CC73E8C75D200AAD272097906D9D5FB963585BB0C3FC2BE757AE9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646275894, "uuid": "89b9c8c0-7568-4b6b-9822-697c4534af61", "value": "768:RF0oGDOevZCwrvtq+9zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2j3l:n0oGDttT5fTR4Lh1NisFYBc3cr+UqVU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646275894, "uuid": "32fba61d-f0ea-4d66-a7f1-4fb8572e8f3a", "value": 47658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646275894, "uuid": "032b7f89-f85f-48a3-9f56-3df77422e367", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646275894, "uuid": "4c8f688f-b8f6-490c-8ff7-8eea642b7914", "value": "Scan-0303.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00883375-9abd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646289709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289709, "uuid": "062b2388-67a5-4008-823e-5d4f5ffe9e7f", "comment": "Malware payload (Formbook)", "value": "5ae601331de74aafd8433882bf6b5c98", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289709, "uuid": "467dabc4-ae43-4fbb-8011-3a1b0433aa57", "comment": "Malware payload (Formbook)", "value": "6a1a82aedd7d9d58176d49b659348e7d50a9a4b1e325b3fc9cd1e915f34c8784", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289709, "uuid": "882c8438-db42-462e-b59e-2af0688acb84", "comment": "Malware payload (Formbook)", "value": "83ef380a3ddc40415f4df738162217083e505147", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289709, "uuid": "6c405e1b-d529-45cb-9708-79a146a0674c", "comment": "Malware payload (Formbook)", "value": "6f11b89a1735c088d74e4ff9ef6d6d28299383cdeefdaa53d5c15f0e41ad58b715e1e8a0abe261d9b5c48bf4ebec6037", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289709, "uuid": "205f10e0-201d-45d4-b55d-a76536a74249", "value": "T131B4239353AC7750D8693DDCD9781D8C1CDA8BD87470F6DF22B8EBBB6102AD68681831", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289709, "uuid": "92be8869-b2a4-48ec-ab89-ea0747d640ab", "value": "12288:BfIZluf5i9TT1xlOcWgz9TwUvds5F/6YV3i3Rl8RK3lVZLTj:NqskB1xlOLgz9TllsSBl8RKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289709, "uuid": "a711ec9e-db5b-4ef3-927e-73a752b1052c", "value": 511884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289709, "uuid": "5482d30d-db87-463a-b5ec-52f94b4594ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289709, "uuid": "d46d40fd-eb19-43b7-a2b0-f00cf4989d43", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce776ef-9afb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646316573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316573, "uuid": "368195f6-01ba-42e9-8755-9d2d8fdcce61", "comment": "Malware payload (Formbook)", "value": "acc1d45c029a8fb002ac6b993298cca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316573, "uuid": "1717c100-7986-4b9a-ae5c-a43a88a9bd8d", "comment": "Malware payload (Formbook)", "value": "6a2790a5909d2769409da00b867f514698f39d3bd034851e72863b6b5ee05cda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316573, "uuid": "a85f3784-bc17-40c4-b8e5-da2f8b32f375", "comment": "Malware payload (Formbook)", "value": "e2a00ce0445259dded15f4bb53ba49a89be29aab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316573, "uuid": "a2b1d1e6-a777-4f81-8092-101713f382a1", "comment": "Malware payload (Formbook)", "value": "e254ca68c7777d7a9418c4fc686f7ed1e9ca9ade9e731320c9be8cec5ea3c313d79ebf2a852259357b4677011f0c10e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316573, "uuid": "9176157c-9966-491b-bb1f-afdcf93dd2b3", "value": "T16D6423A6DBE104A7CAC01B3C01B27A97E7FA56D8026FA967D3900DBF6DD0087D64D187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316573, "uuid": "fcbfba32-bb5c-4554-8916-cbccc31efad0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316573, "uuid": "18fde756-118d-495e-826c-f39f46e917ce", "value": "6144:rGic4rEygHSlEpzbzM5zEv0vPeqxrL/OixIXtDADLzmSski6KYREG8YE0b:XrpgH+KzM5IvApx3C1SQkCYREJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646316573, "uuid": "42316e89-820a-4003-a242-f00eac9a7b8d", "value": 307325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646316573, "uuid": "079706bb-104f-4c30-b677-9595660d92f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316573, "uuid": "52d2ce5e-30ab-4076-b78a-b63077b55f1b", "value": "030322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cd5916-9b1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646329768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329768, "uuid": "df939808-e7c0-4350-bbab-defe0484d4fe", "comment": "Malware payload (Mirai)", "value": "9ab9356e7d60403dc16651cb1467785d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329768, "uuid": "a3e27084-5b59-46a6-9675-158ad9639504", "comment": "Malware payload (Mirai)", "value": "6a3af4588161d0e00a59d5bd0dc2f81342f5fa6989b11437016d9bed595d646f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329768, "uuid": "b85132d7-137c-4108-81a4-b206602549d2", "comment": "Malware payload (Mirai)", "value": "d80bbf887fc14413f76ef167e1da763763871371", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329768, "uuid": "0c1feec8-a941-47b7-b3ca-387292a35607", "comment": "Malware payload (Mirai)", "value": "ee2e752a3b476e7381fa94f0996cd43f12abbdd3b09c64d39e774be4650d29b3fd04a3b2cd2fc254b85b47ff6c52f81e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329768, "uuid": "0d33ebb8-e7c3-4b54-bb69-6208a62100e5", "value": "T1C7A30896F800DFB7F40AE67604D34B20B670BBE54F532622731739A6AE762D52823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329768, "uuid": "fc6e365c-69fa-4245-9c79-a427f82a852b", "value": "3072:/Ir2vIBAxMyAOLRcftL2OemuxVqDr78fz1e:/Ir2vIRyAYcp2OemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329768, "uuid": "fc671597-0f5d-4d2c-9f35-5c6455d08e18", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329768, "uuid": "321097c2-0549-4afd-b67b-9bc085d05f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329768, "uuid": "85a99515-3732-49ee-a1cb-2d6167a1475a", "value": "9ab9356e7d60403dc16651cb1467785d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12b7fdb-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646298246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298246, "uuid": "d22f9343-387e-434b-b799-05b242ed6245", "comment": "Malware payload (AgentTesla)", "value": "2da1c4eaf03cb189d0a120c7b052ff05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298246, "uuid": "7317b262-2aaf-4ba9-a071-f36e9a748c4a", "comment": "Malware payload (AgentTesla)", "value": "6b0fe8d8676ab8f01353631c19a59bb98470d4b4d2a6dc90ff08d3f78b44d5ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298246, "uuid": "55a3d9a5-4173-4738-b175-6efdae5bb75a", "comment": "Malware payload (AgentTesla)", "value": "df65b53bf071a594e4a8489f91c206519255d9d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298246, "uuid": "f391d1da-f71a-487b-80db-d2c49e0992d2", "comment": "Malware payload (AgentTesla)", "value": "e428f760b753149ea4e5d1f0811b04c69d8075314a0059f9978bcab9cef11036ca35d082b830fe00c66832da51a79d26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298246, "uuid": "df84cb92-e661-4f4d-9944-db1a18c0f4e3", "value": "T12615CF0438E68038F9768BB1CAC4EBF18B6EF315D589B0F654005E157A46BBEC945EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298246, "uuid": "9265aece-44fc-456d-afbe-25f5f1912a9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298246, "uuid": "7ecc92d3-a884-4365-a6bd-216dfdbce0ae", "value": "12288:M1R/IjTHRgMohRvNJF5YJm0RmIQcdirTeaYFxMQsoHmPtMa4EJB3:MiLRhgpbF2U0J8rT4nQPtMaFJB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298246, "uuid": "f74c6faf-4b78-4835-be2e-d1f36306c84c", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298246, "uuid": "57d2e137-2741-41ef-b7ca-99d1e4b77a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298246, "uuid": "48e7f273-8a82-4187-aaff-db68212c05d8", "value": "2da1c4eaf03cb189d0a120c7b052ff05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cbdc619-9af6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646314291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314291, "uuid": "f589d512-3209-4d41-bb3e-dc44486e49ef", "comment": "Malware payload", "value": "6313ca4b89aac08428d74d6b06a49f0a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314291, "uuid": "9d2a6a69-646e-47b6-8f38-deb365343cc3", "comment": "Malware payload", "value": "6b6334deacd93e65c136058ddad5fbcc0017f67b219d39a7385a7dd39a4160b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314291, "uuid": "c1f2cf8b-eac8-4f07-b3c1-4b7f4409c945", "comment": "Malware payload", "value": "dc682f53fd05f1f333d26566604dc02ce9d666ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314291, "uuid": "89859dd4-314b-46cf-9333-b67d1569e66a", "comment": "Malware payload", "value": "baeef8ef552e4bd1259ea5350e77e4a33182c41609857378a54a868e4fb3fabaf37ae5ccd79f6745d1056cc50dee2348", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314291, "uuid": "ed874d60-aec3-48d6-8ac7-502c57d18cc1", "value": "T1AD11B7E853568290D486022385927D5363EE670BE9001624D20F9BCB798A15C5F175BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314291, "uuid": "1d4771d6-d19e-4686-8e11-386d5ffa3f83", "value": "24:YtE+5uIINbJPeHZQJlRAIsquxJIWTnDoEqOu/63Ch:Ytr5uIeP6U3LuPprDoBUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646314291, "uuid": "65586bbd-84aa-4d16-b24f-67e75324d929", "value": 896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646314291, "uuid": "f5ed2fdf-94a8-455a-84ea-b19515a70acd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314291, "uuid": "a5765178-b6d5-45f4-857b-58df230ef7f5", "value": "6b6334deacd93e65c136058ddad5fbcc0017f67b219d39a7385a7dd39a4160b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f2938e-9a94-11ec-9275-42010a9c0029", "comment": "Malware payload (StealBit)", "timestamp": 1646272409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272409, "uuid": "126e0db1-6048-4aef-a51c-a0475fceb601", "comment": "Malware payload (StealBit)", "value": "d7157c810238f288913e2df0b9ff5a08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "stealbit", "colour": "#B97D3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272409, "uuid": "4101cee9-447e-49ee-a630-1ee1d79f1470", "comment": "Malware payload (StealBit)", "value": "6b795d9faa48ce3ae31f0bde3dcb61a6d738e8cc0e29b5949d93a5c8ee74786a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "stealbit", "colour": "#B97D3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272409, "uuid": "d9e2f3e6-a4c2-462a-99b2-ef6791b127f4", "comment": "Malware payload (StealBit)", "value": "bfbc577800252ffb5ca3aa101463c7c91a2a9540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "stealbit", "colour": "#B97D3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272409, "uuid": "04ee2e4e-81fe-4ecf-90ee-486ae11c98e7", "comment": "Malware payload (StealBit)", "value": "15dd8e36b30442b1a62455aebc17b0523007aba315711008f264447ab6614a50bae9d4dbafa09f53dfb2f4394eb22b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "stealbit", "colour": "#B97D3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272409, "uuid": "ee089db1-f3a6-47b0-b021-13cd2d6bf44b", "value": "T158236C437CB280B6C450627018BE5B37AFB96922E3E809E76744C920C6B19D9F57D7CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272409, "uuid": "08fe24d0-b49d-4b91-9795-d1d934924ccb", "value": "768:AEPQI759hrPDKd0OHTiPHIm8oN2mfv+w+3Smfpp7Ker35yxK:GI7LdPDKdXiPotKvfmw+3TfXzr3YU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646272409, "uuid": "001a0e47-2f99-45d4-95cb-d59731a2ea4f", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646272409, "uuid": "cfca23a1-b43e-4571-b6e9-e901c9cffff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272409, "uuid": "5b9f90e8-587b-4732-810c-b59a6a15b37e", "value": "StealBit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e529ac-9b21-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646332770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332770, "uuid": "f8a6e03f-b0c8-45b8-af0f-4023aa38ce0d", "comment": "Malware payload (Heodo)", "value": "252b989865004cd7c96e62a9f088a8bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332770, "uuid": "7995b7a2-bab3-41c7-a8dc-34c2e44f3238", "comment": "Malware payload (Heodo)", "value": "6bc94d0073e4f9b9f4ff57c018dc4f95afa171ee291fcc212ac901bed9f5dac5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332770, "uuid": "8d28ad28-5a30-4490-b5b6-65a8eb7105c8", "comment": "Malware payload (Heodo)", "value": "9ff2978fb239adcaa3969d442449a14f5d6ad3a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332770, "uuid": "b6126cfb-7666-46cc-8e53-9ffa96a41615", "comment": "Malware payload (Heodo)", "value": "e651d04e801bb7cb7347559531e155865e5dd7bc61b8819e8609f562c07606e6627a386543ed8e47cd79e32c08476e07", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332770, "uuid": "b68197cf-97f9-4be4-84be-a7e213c82529", "value": "T129353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332770, "uuid": "4e86fe05-e774-404c-a0a7-fe37f4387b62", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332770, "uuid": "152e521f-e489-43bb-8c42-4f373e478c2f", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZC1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZwytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646332770, "uuid": "4d68e74c-9c0b-432e-a7ed-e81f07a76a72", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646332770, "uuid": "6bc1895d-888c-4581-8a75-3873efb95f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332770, "uuid": "46f18b84-234a-414f-91be-43a3876384e1", "value": "u48pYoEAw7H3TZwM5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce1c73a-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1646298856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298856, "uuid": "f91e3122-da70-4fce-a520-4fff123acb7a", "comment": "Malware payload (DBatLoader)", "value": "0382aa0592f578106c47345990f7fd56", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298856, "uuid": "76f06343-3eb9-413b-911d-2b494dfe35ee", "comment": "Malware payload (DBatLoader)", "value": "6c18b064240861b42aa8fadbea5472fdce174a4d2b1510d53cba2b28779602d7", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298856, "uuid": "ca1912f9-919f-48bd-a99a-a8f992f2da85", "comment": "Malware payload (DBatLoader)", "value": "4837493a5c7f9e2de9f645a2fc15801e82b4f54d", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298856, "uuid": "ad3d1f6f-94d9-4899-affc-46df837d150f", "comment": "Malware payload (DBatLoader)", "value": "84aca8699cfc49404aed0ac97f39580f159d2767cf4ba14a570b18155d118473e9f93bee4de88e6ca5903976991608cb", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298856, "uuid": "a31d20a6-4ee0-4957-b90b-58b95bdaca53", "value": "T12B15AE26B291C837D3731A38BD1B667559297FC03E28655B3BF46C4C5E7B240393A2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298856, "uuid": "c3d53500-4757-42b3-bb8a-51522d864493", "value": "1cddc22351b2c25b398d72c89c00fc4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298856, "uuid": "32edec48-4021-49cd-a2fe-2074a45405b0", "value": "24576:5z3ote+JnV4kQpjpi0iWOPyzZFJEdOn3:5z3oY+IFpi0pEdOn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298856, "uuid": "2488691d-9336-4b24-8ab3-b4165e684c7d", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298856, "uuid": "0687294f-eed4-4d12-b80e-2ecafa10cff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298856, "uuid": "d0e8e3f3-ea07-414f-8227-94d3163a2361", "value": "Nova narudzba je u prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63c54ce-9a88-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646267250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267250, "uuid": "a7c94388-062d-4bf6-8d14-3269b676c22f", "comment": "Malware payload (Heodo)", "value": "ad1f472f9915245c6305ad699af5d2f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267250, "uuid": "baf67254-e7ba-455f-9d5c-963f33ab4723", "comment": "Malware payload (Heodo)", "value": "6c3272989cb5e2eb31d9327fa04f690c3ac73f82b505f1e9969175ce62d57141", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267250, "uuid": "5a13c86c-760f-42d1-a358-0f0bae687296", "comment": "Malware payload (Heodo)", "value": "d5b86a1e38baaff49d57acfc680495f2b5e6e7f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267250, "uuid": "01414d90-2e88-4097-9bc9-f624d05afa97", "comment": "Malware payload (Heodo)", "value": "da39d541b82f61cc1b0340a0f30fdd42ea4e6abf135d8b4c870b8dd8b4e16d7c686f6c560c0c0d438ef0387ca5ef3533", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267250, "uuid": "4c453a17-091f-4abd-9a74-33e2ac3c3744", "value": "T12ED41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267250, "uuid": "a3cc2ec9-6dd5-4ce6-9ef2-09f616b80bfb", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267250, "uuid": "c42b99eb-b431-49e8-83de-672c6ec902a4", "value": "12288:ZxpNJJJ2NHPoczJ8OtIhxf3foRXIa5EPwvA:Zx2gczJ8Ff3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646267250, "uuid": "b8259c41-5ab8-41b0-a91d-9b39bc3ec64a", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646267250, "uuid": "0c8d361e-e19c-4194-aee1-965002f21034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267250, "uuid": "103936de-5d9e-4e34-818a-dcadbbcbdbd3", "value": "ad1f472f9915245c6305ad699af5d2f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc40403-9ab8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646287607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287607, "uuid": "3368fb91-d521-4da5-981f-4f1660ead602", "comment": "Malware payload (Formbook)", "value": "75096d1dac8c09fc56423f6074aae1a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287607, "uuid": "e0ea338f-2b87-4473-8825-cae533fa4bbf", "comment": "Malware payload (Formbook)", "value": "6c4946e53ef709831150bf2cc272bc4a0094a5d3d917c02994898178afe210bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287607, "uuid": "56fdc497-27e6-4b5b-8e91-0da62f051cab", "comment": "Malware payload (Formbook)", "value": "321ebe9784057ad7c1bc9935866a4a5d360f97dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287607, "uuid": "7d02d9af-75ac-4960-88cb-89ef9ddf9af4", "comment": "Malware payload (Formbook)", "value": "824142d08e9f6d1b272338dd4fbfcba3d6ce8325ffa16b5addf6c73ded742327c76bd3adcf4d939b67d8073f0f2e212e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287607, "uuid": "998f24d6-f1fb-433a-9463-074cdd66d913", "value": "T1B364225A33D004FBDEA206B041F75F7993FA874E01DA584B9BF04F6D9B20999278E588", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287607, "uuid": "229d2fbf-24f7-495d-8c9a-b3760cace2de", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287607, "uuid": "386769ca-1c6d-46b6-8555-2f69e3b2cd5c", "value": "6144:rGiZn9lLxhVf7GDM06Y4EgW29Xp/CvXcymEW1GHVj/1iE00jEh:FrxhVK1qXp/C/cymQVr1iJ0jEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287607, "uuid": "adf0e85f-e361-4f13-8f68-e6911b78c937", "value": 308418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287607, "uuid": "f0e8eea5-6f10-4e50-acb9-bde10c7f7e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287607, "uuid": "a093d5be-03c4-4c00-bf80-c97763c66444", "value": "3032022NT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f5eca5-9b32-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646339965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646339965, "uuid": "e49c7305-602a-4c9a-a438-7bf8659a7cc2", "comment": "Malware payload (Formbook)", "value": "ce7e87b578bbc0e7de9f4625df20fb98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646339965, "uuid": "c953f720-7298-456b-a00a-b049c888eb32", "comment": "Malware payload (Formbook)", "value": "6c4a670a0c87cbce298a687716baf00723673707ec966985f2d9e51d72d058f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646339965, "uuid": "59da4cc9-4aa7-481c-b5b6-4d876f8cd31d", "comment": "Malware payload (Formbook)", "value": "255df48e0d594bd36dfbbbce41edda7d9e21e2c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646339965, "uuid": "42083499-4904-4006-a371-c3fa730b9cbe", "comment": "Malware payload (Formbook)", "value": "989389d0f430f2997ca225b138593c8f4579dda78f482c48aa84408f9da5e11d85333fc95875c349c1bf1bea6d5dfd20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646339965, "uuid": "89ae7a71-53b4-4b09-adbd-543d5f438c1a", "value": "T1F464220C62E0DE77D687007131FBA67BD33E81E442791E8217E49FBF69704688216B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646339965, "uuid": "5995b494-3d6c-456a-86c8-8bbafe9e0785", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646339965, "uuid": "e85cf489-d4b1-40fc-a911-fdaefee8aef5", "value": "6144:rGingWt3nlq1JJrqmL+kmd3V+7mYi1VK/upGByLnWPjVqpvanVw7z5:7gUVInemL+v3BYizK/uMMLn2jVqpvanu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646339965, "uuid": "a2037f20-3ff6-42a8-95a8-b910ac1edcc5", "value": 306966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646339965, "uuid": "b8eb3bd1-d0da-4dcb-931a-036756efe4f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646339965, "uuid": "aa93b8d3-1d0d-4280-8c46-1f931e40da1e", "value": "Premedionlex.Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529854c0-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "81140ab1-fa61-42a2-bee8-4f8266eb049b", "comment": "Malware payload (Heodo)", "value": "c02f5b680bf0e0972ce5556b5cad76f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "6ff7de76-3734-452d-b1d0-eb6a67a7bcd4", "comment": "Malware payload (Heodo)", "value": "6c8ffcb358b0dd6d7c1e05a04872bc725cad7d1a79b6ba8e5fd13b9cef6ded33", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "57170dfa-cc23-4223-9624-b6de230f18cb", "comment": "Malware payload (Heodo)", "value": "75632ee3b0e3e0d3dd48a0a75ea3324659f9e56b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "0c8edd9b-9e51-49a3-b94c-9892e5bc618c", "comment": "Malware payload (Heodo)", "value": "bba5494a2e03191ac1418391f6efd7e76174686ff485dca48b7a1c68f7fd8cb68b98ddce970aaad2c887d931a70f6658", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "62cb41dd-f9be-48d0-81c9-85d0e05025bd", "value": "T161D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "03cf5f2c-c816-4de2-8ea3-e9898b540a08", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "5e345e5e-50fe-4f97-a4fa-1de28f918640", "value": "12288:ZxpNJJJ2NHPoczJGOtIhxf3foRXIa5EPwvA:Zx2gczJGFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265794, "uuid": "de3b5240-eae7-4155-bb62-1842a1640284", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265794, "uuid": "38422504-df97-40bc-b135-20ccabc6be51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "27fd5e3f-82a9-4ca3-984f-e53a28962797", "value": "emotet_exe_e5_6c8ffcb358b0dd6d7c1e05a04872bc725cad7d1a79b6ba8e5fd13b9cef6ded33_2022-03-03__000305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e65e3a-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298036, "uuid": "76ee4180-f81c-419e-833a-838df5432186", "comment": "Malware payload", "value": "0c84297632dffe68994d744487849fd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298036, "uuid": "adc429d0-2ab9-40ca-887f-8f3345fd662c", "comment": "Malware payload", "value": "6ccf16f1d1a495de9f5e7c1b60dd09da612ba2355887ebeb56cc1cacb5d64a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298036, "uuid": "56565ea6-3bcc-4e65-96e6-3392313ccaa4", "comment": "Malware payload", "value": "e91fc4c3a570950f7cebb691b75ba57990f0ee74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298036, "uuid": "e5b44ee1-452d-40fe-b8ce-5b8d7d9e07ab", "comment": "Malware payload", "value": "cae1ab578cadbdd478ef48627d60aef81c69d7f885ffdabc0fa9783ddbb89cc2194ce98952fec18cb0478132fbe6d025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298036, "uuid": "9819f1b4-5366-4b01-9006-cd026043125e", "value": "T137B423D8DD8E9415D2681DF1F93BDB67AB046F9128D48926DB8C332EE074C1C7BA5C09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298036, "uuid": "02bc1699-c44d-446e-95a8-537d3eeae72a", "value": "cd8b760cb83f38644768621cc3945d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298036, "uuid": "5f09e19d-c294-42e3-a996-09dea9606f9f", "value": "12288:dHDdD5BW/rGC9AqcrNNgqGK/lGRgOUqmq9kR6lhKXXCw0NWbWEyq7:dzU/rTAeqGK/cRgOnmq9g6qC/nq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298036, "uuid": "6b41b1f7-1120-47c3-8c82-dfcc26894c8f", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298036, "uuid": "e895f662-8d32-417b-b820-57b826aa3f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298036, "uuid": "66d7effd-36e1-4e1b-a53f-639d18eb4e80", "value": "0c84297632dffe68994d744487849fd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccd472b-9b13-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646326881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326881, "uuid": "85ce7de0-56d9-4b90-8d29-7f148e952745", "comment": "Malware payload", "value": "d010c580de9bc00bb669e61b42e6200f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326881, "uuid": "5921cdb7-aff6-4c85-b7e6-d16687e1a2d8", "comment": "Malware payload", "value": "6cfe913eaec6923caf09a2071997e0c3904776c476c0981acc2ab8189c6c5eb4", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326881, "uuid": "ce6182e4-d283-4814-94fb-31dfb609cd9f", "comment": "Malware payload", "value": "6eed21ebfd7148a1d996dfa7a90940d1bc3596af", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326881, "uuid": "f4af96e5-f364-496d-b0f2-2353f377230b", "comment": "Malware payload", "value": "d7c059cfff6d181f232ecfef0eebf70ec66d6a3a4c249ec013ea3f97d9720f6b7cd56096ba150ce79f6e47779c93d254", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326881, "uuid": "3e59aaed-60be-45fe-8344-43f8c7f6fac0", "value": "T198D3F1203624DEA1D2925B315DD5EFFBB2AC7C219E566B0733A03B2E1E74C55EDB2204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326881, "uuid": "8489227b-8714-49ef-ad05-26aa2d146736", "value": "3072:9PqMgi2eyror6ndXbTkKzir8mc77by5bm4+jtnJHLft8pnY:5qMP0bdrIUiIZ7byFmttnJWpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646326881, "uuid": "d9820fca-e64e-40f7-95c9-d099ad50e6fb", "value": 135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646326881, "uuid": "7c0cf10f-7f93-4dc0-8875-6d771389cde2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326881, "uuid": "92ced9d0-f1c2-49e5-9c48-b6d36017e047", "value": "WFARGO_REMITTANCE ADVICE_000003222.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7af0af8-9b22-11ec-9275-42010a9c0029", "comment": "Malware payload (Urelas)", "timestamp": 1646333449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646333449, "uuid": "bbba5750-c223-4349-af3a-1a415c88f986", "comment": "Malware payload (Urelas)", "value": "b3a3cb7e85b4bcf2f6e14158c4ae7b5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646333449, "uuid": "b6ae790d-5df7-489c-b387-f41afe9cc412", "comment": "Malware payload (Urelas)", "value": "6d131912e1ef737a6fc75e2d8694dff42502298e56059adc59ca12d1792261cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646333449, "uuid": "1b89d02f-ad55-40d8-87e1-2c0be9bb0778", "comment": "Malware payload (Urelas)", "value": "15d3e632bba2e5e1d98877da1e097e4bbd4ea0e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646333449, "uuid": "dff10fa5-8d3d-49ef-98f6-012de37f0db4", "comment": "Malware payload (Urelas)", "value": "e04532899c6afd9b86a984b518f14fdfa2660c80108b2f79de3e7980fa19bf66d22e0b2cbbd699c6c82cf87790e8c9c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646333449, "uuid": "1758afcb-4a20-4a2b-a9d9-6c14db193f9c", "value": "T1C9B4BE103690C435F36627354996E6F419A97C385AA4E68FF7A47E396E302C38A3734F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646333449, "uuid": "18d7cbe8-bdc1-4d1d-9e2f-d2d0a2cf611a", "value": "c655066d0a2c4420aaa11c9556e7466c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646333449, "uuid": "6718fe9b-b171-4e21-8be2-09bab950096a", "value": "12288:ReGtVfjTQSaoINAHT1ST82epyJ5JUkmoGNE:RLt4/NAwTWpA5aPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646333449, "uuid": "98a0a4f3-e544-4f1d-b452-572c5478989a", "value": 514850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646333449, "uuid": "4fa1336d-57f3-4e43-b4df-c28ac3d98c1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646333449, "uuid": "5c8ad0f9-35d1-4755-a0fb-7a5c57f4ebde", "value": "boot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f5af13-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646294601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294601, "uuid": "8e12516a-aa6e-4e11-8e7e-cd98196e0f9a", "comment": "Malware payload (AgentTesla)", "value": "6f5e95b4c18d0c8059822e3ae19d49b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294601, "uuid": "5568f275-ec75-48c7-82ca-80c75be18ffa", "comment": "Malware payload (AgentTesla)", "value": "6de413c40b860aa307517acc020f7839723e95e7eca42da4744612d71738fd7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294601, "uuid": "88bc1dae-2d55-492d-b61a-0a338b4f1100", "comment": "Malware payload (AgentTesla)", "value": "009bafb7360f882207cf02aec2a21e7958fac7d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294601, "uuid": "018bc0c3-561b-4f87-8c7c-adb009b724e9", "comment": "Malware payload (AgentTesla)", "value": "e24740d89064cb799ecea78e5c8431f8be1bca350a6040e3e84458165af5a1d44d45a9f5b79a86d579725ae60de52e83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294601, "uuid": "048e3d52-d48c-451c-be40-ad7f4755f3d0", "value": "T1133412DD3FEB4C70DB865A323B01AB34E0D7ECE47EE01425210A799D98B7B2095AB45D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294601, "uuid": "f2ffa618-8c4d-44c1-b263-47757dfc1f7b", "value": "3072:oTgTBhoKuaCfYG1JlqyzmhxtnoL2MUmfMtEUSaJ6Buzqv7CRC8tfqKhyO4k4B/Bg:SgP6f3tqyzcOL2fhcBuev7MC24ZHoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294601, "uuid": "9753b6d2-a58b-4e17-9c22-34e264caf8a9", "value": 235720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294601, "uuid": "f8e90c88-15dc-44f4-88df-81d9a5f5de7f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294601, "uuid": "a19b1775-e89f-446e-8712-4fccd46cd340", "value": "REQUEST FOR QUOTATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f426a00-9b37-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646342293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342293, "uuid": "790cf163-70e6-4026-9a4a-2ab80b8b7e94", "comment": "Malware payload (Heodo)", "value": "c33ac0556c0da593fb667cf5c85e2fb4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342293, "uuid": "5ace06ad-8a58-42b7-8143-5020a7605b8d", "comment": "Malware payload (Heodo)", "value": "6e3d53ac4c37fa57758b35d13fd638ba0a68ba7362fe2923c13a224d5bf80b5a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342293, "uuid": "7e622003-c37c-44a9-8922-51706c1cd61f", "comment": "Malware payload (Heodo)", "value": "b1372945f44a4d27083f3542d36f11068e342198", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342293, "uuid": "1c78610b-dec8-4eee-8eac-ecd41645c0a1", "comment": "Malware payload (Heodo)", "value": "ec3d5dc6ff04b7bb20a487d95b7a493d184e3d9965c98306ac08f954703cc111abf8a0c0d3d3c1424ac09359e4bb9cb8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342293, "uuid": "8366bdb6-baac-40e0-b2d6-6255d68a9abf", "value": "T1DDD45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342293, "uuid": "244f3291-21ae-444d-a9e8-87d86bbc4048", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342293, "uuid": "b7c99b83-303e-424e-b728-8c5fdf09141d", "value": "12288:J1U8sNY8/z0rYebzwd9CoGEAbcVBLku8w:oq6z0rYcMd9VGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646342293, "uuid": "62ccb274-b7bb-49da-b692-18e5969869d3", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646342293, "uuid": "3237bd2f-ee37-4305-8601-ea0e1d7e6c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342293, "uuid": "5832fd28-c3c8-4ed0-b668-1b16185cc568", "value": "emotet_exe_e5_6e3d53ac4c37fa57758b35d13fd638ba0a68ba7362fe2923c13a224d5bf80b5a_2022-03-03__211808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c593b7-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646300260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300260, "uuid": "b6c3dc99-b1dd-4416-81b2-656c4e3c1c88", "comment": "Malware payload (RedLineStealer)", "value": "7f39bdb169ab5ff1158953f631d95b7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300260, "uuid": "7c33b06c-0e64-4b15-b9a8-080a87320b53", "comment": "Malware payload (RedLineStealer)", "value": "6e9138e8e5eb3c3b003f2c923777645c94e1b2fa3c4173aa55c363f7bffb382b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300260, "uuid": "96cadef3-74a5-4d84-a6ad-824b5c045752", "comment": "Malware payload (RedLineStealer)", "value": "6f2572ab4f0906e0b6e5b74db4175ddfc1d84136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300260, "uuid": "e8b53ed9-ae9c-415b-9b16-5996091414fc", "comment": "Malware payload (RedLineStealer)", "value": "426f615763cf03c3d3d89bb4aff33b7209e25577c0a8aabff4e838e371068a5003742b7182239bbfe80bc029556353b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300260, "uuid": "1047a583-2598-4ab7-b205-6dc6c4e85b58", "value": "T1FAC42385351BF6AFD8636AFAF570E217274B6102ACD3169BC6D8BE46EC64120790A04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300260, "uuid": "30d6bae7-738f-4ab3-bfcb-f214680c2d82", "value": "a46b056f1965aa9a62c3f21951e41446", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300260, "uuid": "d11e52c4-f0af-4a2d-8f58-90fafc3627f5", "value": "12288:Y7M1J7lYTZBbOzC0Tx0SkFK/lGRgOUqmq9kR6lhKXlu+ty8ESO:2M1JmTKTx0SkFK/cRgOnmq9g6GPbhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300260, "uuid": "51ba83e7-b950-4fce-8a1d-b5de2ebf8deb", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300260, "uuid": "32e9ecab-9f7c-4bd4-8947-1945a189d0d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300260, "uuid": "d533227f-1efc-41c2-9623-538cfaad4448", "value": "7f39bdb169ab5ff1158953f631d95b7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0949847-9b0c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646323988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323988, "uuid": "d4fcc356-fbc4-438f-8aab-fe4ccde39af5", "comment": "Malware payload", "value": "86c72a621745529fe353fc47693f9dc3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323988, "uuid": "78ba1b79-7749-4c7a-a43d-b60abe748d2a", "comment": "Malware payload", "value": "6ec77647e52ec6eb24c69e7f210ddbbd5764834a5d50f976c1f55545facc927c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323988, "uuid": "53501756-48a1-4261-812d-b429bef73f97", "comment": "Malware payload", "value": "d578cb098a86f16e47f10d151c27588abe18c916", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323988, "uuid": "f325878d-121a-45c7-ab9d-a29f88ebc794", "comment": "Malware payload", "value": "21d070636a0b31eb68acf8b3f86b46a20323c8b57b7177389666095ffb98579a4638b2ae58c59069bcd5a0a5ff006a69", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323988, "uuid": "56862837-c1ce-452d-a759-3468aee30a73", "value": "T13692353DF28B8E98CF47D2D4111A7E8616A8F91C93D994C2B7FCF7346A4095F8622534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323988, "uuid": "c3956f8f-54b2-4db5-b25e-e538ff29133a", "value": "384:vP0flqbdFuetE7fOgwwvmluTKdpEfilHiKaySGNRaB:vulqBE7fOnAmuTKdifOBay5aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646323988, "uuid": "f9159961-9636-419a-9573-b00978768f68", "value": 20812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646323988, "uuid": "4e9c6794-36d9-4245-b773-9c3ff8aaa5fb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323988, "uuid": "d3270aa3-6181-48d5-a909-30d4e2a84a63", "value": "http___192.3.247.134_..-.--.-.-.-.--.----qQq------............qQQ.-.-------..Q..------.Q.W--w...-Qq......----....QQ--q.-Q_..-.--.-.-.-.--.----qQq------............qQQ.-.-------..Q..------.Q.W--w...-Qq......----....QQ--q.-Q.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b052a8-9add-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646303572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303572, "uuid": "b2162e83-72c3-49d9-b68b-bed18d18e189", "comment": "Malware payload (Loki)", "value": "d7f30fc4bfdcd8efe556cde2f49a6df1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303572, "uuid": "76c0b796-2cc3-46e9-af8f-2595d807669b", "comment": "Malware payload (Loki)", "value": "6fa3ca5bec61c6c9427b467ecefd895568f9d2db64097a2acb5d987228f97b0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303572, "uuid": "67c17ab8-672c-4aaa-a924-f1c55b23429e", "comment": "Malware payload (Loki)", "value": "ef6ee7631f30d1a3d453ba06ecbbb4c403e29bf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303572, "uuid": "5da4779f-314d-415b-b044-1d79f26adf72", "comment": "Malware payload (Loki)", "value": "136306b0369c22cca63b8f9fddc931e4509b933e345cb41477d2f951b29a3593f53a8c7dddfc70e06f1053b396e2bee9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303572, "uuid": "878b9ad3-f03c-4c9b-8a43-f288a0ed287f", "value": "T12324BF1031D4C032D4A716768874C7F55FBBB4762636698F6FC52ABA5F212E2DB3430A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303572, "uuid": "5e8a7dac-10f6-4569-9352-9a18d4871fcb", "value": "854bb78feb50b0dda6ba146455affeba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303572, "uuid": "ba6588da-340f-4586-8fa9-3e3616574101", "value": "3072:miRZWLffHi8JiCR9gaXrCtnZtUGnzTIILzMtPXvgM69Xsr7PR8dkxJ3:XRZWLSuyaXWtnZiO/I4zMvIpUmi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646303572, "uuid": "d73379f1-0257-401a-a03e-d7703b6d4d38", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646303572, "uuid": "f224a512-2d1f-4d39-9491-b4e42e2ecd41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303572, "uuid": "618359b0-86d3-46eb-be83-c2ce2494ddf4", "value": "d7f30fc4bfdcd8efe556cde2f49a6df1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2a9f12-9a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646268867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268867, "uuid": "9b6b6f1a-bdde-43ab-9b15-877d296d0282", "comment": "Malware payload (Heodo)", "value": "6b90bfa214fbb76b340b3ec0de0c8d4a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268867, "uuid": "c6963a0c-24fa-4c98-884f-f01d8c71d9b9", "comment": "Malware payload (Heodo)", "value": "70499db86c6f304ad9f2476bbbc658e14938c0d0ac7fc554b7d2d6554bd478bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268867, "uuid": "32c07fff-7f74-47c2-bbab-0aa491ed7c6a", "comment": "Malware payload (Heodo)", "value": "f7a3c245aac5e621caeca5558678805c802b1264", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268867, "uuid": "3ce8d16c-59b7-48ef-8cc9-198dbbfcec71", "comment": "Malware payload (Heodo)", "value": "79a88667b636a3e2e3c543f335d8f931cd22c6989a8d531a855bac35350eca7ab925bb1d3fb43f1ce0ac35c1fc51619d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268867, "uuid": "39cc0a21-0786-4829-85b3-1fb162a6d7dd", "value": "T1FAD41B017498F0B3E38918B04A858AFB724B5DB296117073F2ED378CA7725F15CE766A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268867, "uuid": "e49fa3b4-3512-4435-9ef9-5a9b4e3c9053", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268867, "uuid": "b9ed4fcb-0231-45b1-ac2e-e7c7d264c3b3", "value": "12288:pao0Se86lloPxHHVVIjqxEqRVoQmiIII999tLLLdAkkJoFLZZWbClgluPcRBATfI:AqxETMJ777u3OmONFqNJtN1v96TOAna2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646268867, "uuid": "f4ba5079-716d-4244-8092-92a7e0bf2ed9", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646268867, "uuid": "1c600faa-7eea-4c54-901a-224f90c1e73b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268867, "uuid": "10548ae5-d280-426c-adc8-75d67164290c", "value": "emotet_exe_e4_70499db86c6f304ad9f2476bbbc658e14938c0d0ac7fc554b7d2d6554bd478bb_2022-03-03__005423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c39d26-9ab8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646287597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287597, "uuid": "41a0d9c3-3fca-45f7-80f2-55339d60e362", "comment": "Malware payload", "value": "a9a4f02b92586543810110bd1e653fb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287597, "uuid": "37059a4a-8678-4572-8390-73da85be030b", "comment": "Malware payload", "value": "70c566d749ba9c8bbfd0ce18767fdef51cbe205ab0bb27c8070fab75a7396a96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287597, "uuid": "6e90ff89-a437-4d48-ba62-f1bbb8176931", "comment": "Malware payload", "value": "5d1c62491c4d92616f9b3f134cd91e00e49f7cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287597, "uuid": "38ed5283-1cd3-45fa-9cfe-080fe0cbe47c", "comment": "Malware payload", "value": "ef9e99bcbf35d90715b027d0a1e437b39ec9c85779444aec2000628b211b35a78d930213995ed727657d2501bde3c72f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287597, "uuid": "f42afbeb-07e3-427f-8c84-bf20ba779f60", "value": "T1CCB34AD211D3026FC944F6F1AA9D4984D6CF6E62389E8FDB900D347ECC39A66037AD19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287597, "uuid": "1d57f16e-9c9b-4c73-bb4a-d608f5c9faa4", "value": "1f1040cf14d469df6f954e38f3f02cb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287597, "uuid": "f07a3ecd-aca6-442c-b0be-afe1ece6b747", "value": "3072:qRejuS+WFrcM47FbqjSJ/UzJcAvvOq26r:yejuSDcn7FbISJ/UzWA3Oq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287597, "uuid": "49244b58-7f59-4aaa-9ef4-c51cc913189c", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287597, "uuid": "4ff78bc7-4112-4358-92fb-5e8e36c754bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287597, "uuid": "a1c44342-be37-4238-a079-e289387d2a5f", "value": "bovgkn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2340e993-9b35-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646341306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341306, "uuid": "1ef1ccb8-e251-4813-9801-d14b9cd0b0ff", "comment": "Malware payload (RedLineStealer)", "value": "e0d1e8998f0a056402f814cd753ea142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341306, "uuid": "bef9fcc4-ae4c-40f2-9860-289d7e1d08ee", "comment": "Malware payload (RedLineStealer)", "value": "7149206ef6de8a5cd723e396ae2c4624e5ec20dfe5f70fb8a57911a070a21d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341306, "uuid": "93f354a0-3533-4b9e-8e14-cc3d69e9f84f", "comment": "Malware payload (RedLineStealer)", "value": "8a31397d911774ea29d7bfdb58c8662aa0b264c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341306, "uuid": "42396efb-41bc-46bf-bea5-807c1137ee7c", "comment": "Malware payload (RedLineStealer)", "value": "bfc2f2e0a01b3279662f6fac81a549d85cb920c60e9ef31ad1c8b0c4a929d2ab3b5a06261f8ec629e8318d2733c21bd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341306, "uuid": "5256aa16-f25b-42b6-97df-30935bf35799", "value": "T1FD7401263A40C476C5C214764879DBB15FBFA8302460AD0BB76427EF6F33B92677931A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341306, "uuid": "07a66bde-2b3a-46fa-931c-a01ee0d73d8f", "value": "0623e16f7ad169cff85e84a96d4a7da6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341306, "uuid": "b9540e71-a16e-4fce-8ba8-925be7f56b3a", "value": "6144:D/Lz987eOKGxe4YBtVRmA1XzUBXD/tYi5ncyRwaX9lA50tHb:D/n987EGEhDlzU/0yNXsI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646341306, "uuid": "14dc89fc-be21-433a-8eb8-e60f1c204aa9", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646341306, "uuid": "814752c2-1a72-4c16-ac19-80a0dc894d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341306, "uuid": "047acb62-cffd-4ae3-ae74-bc35a0fab9bd", "value": "7149206ef6de8a5cd723e396ae2c4624e5ec20dfe5f70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c34c83-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646294415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294415, "uuid": "399ac9b8-5952-4ceb-b953-cf877d3c91dc", "comment": "Malware payload (AveMariaRAT)", "value": "bf8b6fafe4a70eb85cd9451b64d3460f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294415, "uuid": "9f8f3bc7-7432-40c9-8c1f-e07d3b1ebc5a", "comment": "Malware payload (AveMariaRAT)", "value": "714e06d12bf6f481cfd3dfa64a13d37c614a759543d87b38ca2c6a03ee936f7a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294415, "uuid": "cd20119c-3249-478b-bce5-246a29831109", "comment": "Malware payload (AveMariaRAT)", "value": "f9905389c60b5664b06ddf133a97f24cbe1fdc09", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294415, "uuid": "efe44401-c408-432d-bff1-6b7b5008636e", "comment": "Malware payload (AveMariaRAT)", "value": "606494962523f10da9af2cbb96898af47e6f5d698ca6e79ae6d2e7f6ca59839b8de2ddd267c4bf12198eda0a9fe1a372", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294415, "uuid": "66c45150-e9d8-4f6a-af6a-66869210133e", "value": "T126F47C16F2E2C8B7C32B06787C1763A55829BFD52D2868432AF47D1D7E381C1782CE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294415, "uuid": "6928a64a-b2f4-4f72-ab7d-fa9e1f0ac24a", "value": "bb8b994ea7204a3a00105e8b9f8cb8aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294415, "uuid": "0bdc556f-4198-4b4b-8c5e-7b89975979a7", "value": "12288:Pntj1v6o5x1oBghwJ27DKDLu0V9PUECzlsUm8OPyzZFJ+:PnhH1tw2uvukIBOPyzZFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294415, "uuid": "67ae05d2-1b4f-43cb-8bdb-f1eeb65ddb8c", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294415, "uuid": "841f90c6-c231-434c-abf9-cee71650e0d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294415, "uuid": "22309125-075e-4893-a888-269f3af6f840", "value": "SKM10322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107a10b0-9aca-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646295319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295319, "uuid": "b3e7afa0-6ac1-42aa-bb3e-cb948e65d32b", "comment": "Malware payload", "value": "dc491bdbbdde01d29a6addf80c0da6bb", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295319, "uuid": "d1e4ba6a-6794-4fad-9305-4256d2068265", "comment": "Malware payload", "value": "71663784607bdad8c76051bcf1f35adf2404faa72ab61ff0ecfe859daffbf2e4", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295319, "uuid": "267fddf8-cbee-4cb9-9770-d81f44cddde4", "comment": "Malware payload", "value": "36eb9562e743ae4cf2c27c96fb165b9ed5668301", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295319, "uuid": "84accec3-c704-4fa1-88f8-99881d77c190", "comment": "Malware payload", "value": "1da8900c3ff958b442b5f3ae969b3a18a3f98eddaa7cc53bd6669ca89d62806d88e30c35b3da998c980a30cbfe5950fe", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295319, "uuid": "84e46052-c60b-4210-9870-a8a00a89c0a9", "value": "T18213B018C112710AC2B3953EDC3DC5E65CBADC572224498FE1D6BA4707A4EAB2B4FBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295319, "uuid": "e35b96ce-83e4-4c2a-8ec3-3b750d63fb0d", "value": "768:i+aRD4S0JS00SneSnjS0yS03S0IMS0bS02ScxbV+cUs70Nn2srTpxKC6yDsfudHX:i+oMVU7N22Tbwy40zVMMAfGiE1/K8Nya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295319, "uuid": "fbb662ca-7102-491b-819b-ff198b5e3bdc", "value": 43629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295319, "uuid": "5c91a245-fd22-46a3-a599-f282b035899f", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295319, "uuid": "d0b7ea7f-c33e-40f2-8582-034f5ff7d8de", "value": "New Rubber RFQ List,PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79734106-9a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646268866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "ea2e7491-94cb-4c11-9071-11b819c5fdc0", "comment": "Malware payload (Heodo)", "value": "0e22aabadfd512147912212e41ce44b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "b08f0e9f-566c-4da7-bba2-19f119e9ec5c", "comment": "Malware payload (Heodo)", "value": "717adceae38f71de92c517efefcd31b5b1abf8c3260a9f58bf8e6681bce93121", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "cde23dc3-3715-450a-a5d8-cc2d479dc3c7", "comment": "Malware payload (Heodo)", "value": "d85c27ec94fb53871747fe0f2194743db1e97beb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268866, "uuid": "b0f8d423-732a-40df-a9a3-8d8b98b474c9", "comment": "Malware payload (Heodo)", "value": "7ac91188480f73d69c73e7aea343c25483af0a5f27b164859e17efd9d52452215d3e3c82e447c4bad4180fec8d4147c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "b32fd372-707e-4bb7-aa70-fc604beca786", "value": "T136D41B017498F0B3E38918B04A858AFB724B5DB296117073F2ED378CA7725F15CE766A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "91273ecf-1c27-4763-8208-7a68ef158e93", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "1c9a4a2f-a5c2-4a6e-a171-1f21b6d8aed2", "value": "12288:pao0Se86lloPxHHVVIjqxEqRVoQmiIII999tLLLdAkkJoFLZZWbClgluPcRBATfv:AqxETMJ777u3OmONFqNJtN1v96TOAn32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646268866, "uuid": "42113c52-6098-4fe7-a194-e667503e0dfe", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646268866, "uuid": "c416b08b-838e-4f15-a357-36bcd38c5313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268866, "uuid": "34758d7b-6f68-4925-9dd2-11dd6f77e6f7", "value": "emotet_exe_e4_717adceae38f71de92c517efefcd31b5b1abf8c3260a9f58bf8e6681bce93121_2022-03-03__005421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b68be0-9aca-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646295492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295492, "uuid": "97206650-b7ed-44cf-9441-c89b2d5a8c90", "comment": "Malware payload", "value": "80d613ddbfe2c9c33ff030f997e028ff", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295492, "uuid": "cae6599b-8f17-463d-8515-bec78b2d1d49", "comment": "Malware payload", "value": "71e15ba5fb82e4f6e9596ef4f7914f554569713640c3ddd547ca897332a3a15d", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295492, "uuid": "8256218c-899a-40d1-a643-ce02beb1b989", "comment": "Malware payload", "value": "8b4b80420496d67e1b99070692d7bbe905b7245a", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295492, "uuid": "66993a05-6719-4b3a-a90f-305724bba7d9", "comment": "Malware payload", "value": "86e12d4d3d2c255071bda28d521f93834b6e9a4f8d0e5e1ebc302fc3b166766535424fabbc03b8f8e03edacfe23d1bcf", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295492, "uuid": "a132cd03-f59d-4f28-bafe-6fa7610d0742", "value": "T135E26B06C4116D4BC163D73AFE3888D06AA98C1360547DCFB2DA7A4B4B64EDB274D7C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295492, "uuid": "040454cd-875e-4d01-863b-09099378c959", "value": "768:U+gRD4S0JS00SneSnjS0yS03S0IMS0bS02ScxbV+cUs70Nn2srTpxKC6yDsfudHN:U+yMVU7N22Tbwy40zVMMAjrtjSYZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295492, "uuid": "2d8e0d45-f987-4a25-a904-6aca91d244a1", "value": 33198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295492, "uuid": "6da9f9f8-049a-4f7b-8f62-60a252b64366", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295492, "uuid": "f7e5ca87-adae-40f3-b48c-9e997aac8b26", "value": "New Tools Order List,PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2011bb-9aed-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646310347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310347, "uuid": "f5cc9fd2-9cc6-4e11-a19b-fad4dd2177f3", "comment": "Malware payload (RedLineStealer)", "value": "431cda0ada52d6a11f194af894349bc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310347, "uuid": "ee2d69b4-e0b8-4dde-a883-a2928b1c6b0c", "comment": "Malware payload (RedLineStealer)", "value": "71e7a03161cdc4acb96f0e773943db6cc2b69152e5e03a8ef791333da8d7eb8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310347, "uuid": "2e006c27-10c7-4e90-8088-5621873d1983", "comment": "Malware payload (RedLineStealer)", "value": "b7779af9ff7e3403178778ad5a80b724fe795979", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310347, "uuid": "40125f24-6da1-4730-80cb-f06150b0bfce", "comment": "Malware payload (RedLineStealer)", "value": "cc8532cf4024320617730bbde8db2a0439f3412a77a20d5c4755bff4de504b60cc99859c7383fe3027f890f9e757038f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310347, "uuid": "a3b27e21-911d-4537-8906-7dc28559bbff", "value": "T162B4022539C1C1B6C47B157084EACFB95A393022477A85E3B7ED1BA96F213D1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310347, "uuid": "e61753e6-bec9-4907-979e-36a93282c5b1", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310347, "uuid": "09ccd092-5cef-4105-a92c-d0d0e9d3294a", "value": "12288:Hh1Lk70TnvjcH46RRD/sW9B06dckdBIWT2WhYuX4zYBl:Tk70TrcY6IslGYBda0r4sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646310347, "uuid": "dcb2b114-c767-4f2d-a620-1987d9218328", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646310347, "uuid": "0eb7065e-9dbf-46ca-997d-7fe56c71a9f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310347, "uuid": "c711b6d5-d265-445c-b5da-2793a7b3e74b", "value": "431cda0ada52d6a11f194af894349bc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ca7888-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320965, "uuid": "a15233c3-4273-441e-b1b4-0532248f4955", "comment": "Malware payload (Heodo)", "value": "a82d998067e7dfb9b76311f2f9c23d91", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320965, "uuid": "6f88ec06-a4f8-47c6-8fb4-ae9f7f045cce", "comment": "Malware payload (Heodo)", "value": "725d266bde9f856185237b8d0da309152e6c021d276a1b7935c85b1606f8cb75", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320965, "uuid": "d44add36-49d8-4978-b39a-4906e45e6bfa", "comment": "Malware payload (Heodo)", "value": "ead9bf6c0f0daa98a28a73b0785e8a0b3003bf21", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320965, "uuid": "8282ba7b-4d62-4fa2-b5f9-9a744c230307", "comment": "Malware payload (Heodo)", "value": "dd762eba4dd7058ca73b0f1ea4f31fec2dffec35990d6e59337c4bbb38c8078bf0245d064cad8c3b609b34ec32d00acc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320965, "uuid": "ce031efc-b7c5-4f84-97ac-42e4e57f5ef8", "value": "T10823E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320965, "uuid": "622efbb4-b068-492b-a2c3-e0ada75f31e5", "value": "768:mqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:trVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320965, "uuid": "23556808-1b22-4dca-bf9d-63c02e055f44", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320965, "uuid": "ac1e898c-a396-4642-8a3d-68fff83fbd00", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320965, "uuid": "b159995f-0ab2-47b3-9023-57a0c407f13f", "value": "imedpub.com_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b16f220-9ab7-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1646287257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287257, "uuid": "35585bbd-12c6-41d3-9470-98aab796c653", "comment": "Malware payload (OskiStealer)", "value": "1954c57cdd3b2dc68b054e89c9235e5e", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287257, "uuid": "a5baf55b-0f38-401c-aeec-70c0d4f2d980", "comment": "Malware payload (OskiStealer)", "value": "72c5370f4cb8145e9d8b54563dfe30dc1268723edf8e71c29cacd6dde5fa9770", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287257, "uuid": "2072e0ed-153b-4968-bde1-3bdcfb91534e", "comment": "Malware payload (OskiStealer)", "value": "4006c4f5f1a520e7a503f178c653ae942001cf41", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287257, "uuid": "fcf8f6e1-a60b-4a24-832a-63549062aeb7", "comment": "Malware payload (OskiStealer)", "value": "8d3c454094d16db3267688422bc1865a66335edef07d401065fe9335f3c2370fd308d4b619ab8fb7128372ce09924224", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287257, "uuid": "be0b247f-d714-430e-a295-c7f2102fd81d", "value": "T1BD14023472E02103DE0AC1BFA6634C9F928BAD9CB34814115944736E8F7ADC6ADD87B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287257, "uuid": "ee476e6d-d9ab-49c9-9f80-4822af441b8b", "value": "3072:mMoTjDLPAdzy5omt2Q184zU1xIgZlOTIUdkrn6KxtJhc3i8VvskkoOm/J9+v8xWg:aDbuwH84zUpkylxt/AV9kQTIEWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287257, "uuid": "0c85d9e4-0811-4ec9-aa1a-6726578c6136", "value": 190888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287257, "uuid": "cada7e44-81e4-4674-b198-29d92543568a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287257, "uuid": "c048081e-2233-4c96-b5de-d1ab65f4b3a3", "value": "Remittance Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbb827c-9af4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646313380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313380, "uuid": "f950c5a9-455c-4566-8fc1-234475e5b9b2", "comment": "Malware payload (RedLineStealer)", "value": "0734d0b6d2b1c19cd99ca9201b92eda9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313380, "uuid": "c77b4620-5f32-4c5b-a42c-b0dc63328abb", "comment": "Malware payload (RedLineStealer)", "value": "730b9467638f8a8af4043b2f5075787dfbe175c9b43c5d95b046cc3b72f1a276", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313380, "uuid": "bbc95bc6-5b5b-44be-8fd0-f06b56cdbcad", "comment": "Malware payload (RedLineStealer)", "value": "3b977721bb4c261199bf98b7ff67c16bf5816e92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313380, "uuid": "b228d6b5-4bb5-41a9-abe9-76021584eb3f", "comment": "Malware payload (RedLineStealer)", "value": "90179b6b7721f7a0f0a6cb8ac3939daf42c35c1d196eb3166cab94e64aacd53adfce761376a15caa84d1d194c3a7c4b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313380, "uuid": "c5f0c1ce-018f-4805-a3d8-2c4f37e5aac9", "value": "T13736027322645198D4E98C358937FEE172F43A3A4F5194FBB3C979CB19321E1A632A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313380, "uuid": "be3ec963-8243-4b6c-a617-e37e51a8c882", "value": "b2ec5e305a410e6442f3911ef61575a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313380, "uuid": "430df965-aa4a-4d21-9288-ed18951d5e43", "value": "98304:7QBMMbircy+j2qbzeHvRpXkYKrN+TTRcje4DirRfrv90OH:MoY6J5hSN+HRt4DYViq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646313380, "uuid": "55e7268d-73aa-47e1-af2d-075f1e2f173a", "value": 5183488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646313380, "uuid": "16202b1d-ce98-40de-b104-cd594a5cd5b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313380, "uuid": "0e9b27df-3194-42ab-9905-69929f4512c9", "value": "0734d0b6d2b1c19cd99ca9201b92eda9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bb4e21-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320983, "uuid": "835a057e-0ca9-4aa4-a041-82a29164ffa1", "comment": "Malware payload (Heodo)", "value": "03b5f9ef654f313a9ff06ae037904f46", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320983, "uuid": "ec9e6b56-b0f2-4c6f-a58b-35d24e21b359", "comment": "Malware payload (Heodo)", "value": "7388b7ed10de89a430acf776b70fd5fb9eb38728f2d6c33be0abaef9620370be", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320983, "uuid": "d9c638cb-217b-416f-9903-42e888e39988", "comment": "Malware payload (Heodo)", "value": "c07160da6e4a233e81c62f5aeffe6785d5d38b05", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320983, "uuid": "c8962d7f-07d2-4dd8-87bd-b2deeee62e18", "comment": "Malware payload (Heodo)", "value": "cb45bfa6110938241d8b3adb4b7323993236232c62358a3758c224be8e2be00867288a4fe97425beefd9f143c5514a5a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320983, "uuid": "984f0691-f881-42fb-9bba-3569e4a55c03", "value": "T1F623E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320983, "uuid": "519a4743-559d-44b7-b264-d2477e0f0d85", "value": "768:qqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:5rVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320983, "uuid": "c540549a-6d2b-4d9b-8bc0-6d4bbc21f6f3", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320983, "uuid": "1e8ffc92-be4a-46ab-aa30-e59760bf8d63", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320983, "uuid": "8ee1f4ae-95d3-46c9-858f-586ccfc97f22", "value": "OMICS Group_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb49d40-9b1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646329783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329783, "uuid": "a032db33-63be-444d-93e8-5b72e25ee62b", "comment": "Malware payload (Mirai)", "value": "2cb5247598c43671e3441ca372e5f61a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329783, "uuid": "5385620d-d557-41f9-b48b-9e006d29c10e", "comment": "Malware payload (Mirai)", "value": "73e0dd6715050bb26c1c5a6e79298b31c593c8b185c8fda9d2b9aff9b5da1ef9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329783, "uuid": "720566c3-6368-48e1-8c95-6c730edda5e9", "comment": "Malware payload (Mirai)", "value": "29a028311f0c22b0c30009ca4eb4907228c8c2c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329783, "uuid": "aef46180-6476-4a1b-adc3-b400ae9456ee", "comment": "Malware payload (Mirai)", "value": "3d326c8c14370ed729e0098cc8cf11a905b8426c7ecda7faa1067c456fd85670a3c0a5b25c4722bd67561f6cc48c88bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329783, "uuid": "43a8e644-7481-4458-b5f1-d1a74d9d725e", "value": "T1E5F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329783, "uuid": "41cd7589-cd1c-401d-b212-b5c1f1f59a26", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBaYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/MYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329783, "uuid": "ae60aa4a-903b-4285-afae-ad9b9523c606", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329783, "uuid": "e0391889-48db-4d03-a087-826899f59e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329783, "uuid": "e69ca722-684c-429d-be74-a3eaaf42fa4c", "value": "2cb5247598c43671e3441ca372e5f61a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed09bd1b-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646296548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296548, "uuid": "21a89bdc-7e6f-4f92-a650-5a6e72781cf1", "comment": "Malware payload (RedLineStealer)", "value": "4af5d329b9906995a3d16a88fcb642d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296548, "uuid": "08a0ac4f-56e0-4431-86ae-2ab462386fb3", "comment": "Malware payload (RedLineStealer)", "value": "74a69d491cf1b7c8e2c24c862c0aea24f33f8ed6bec8f2bfab0ec4a4281fd892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296548, "uuid": "0e84c3f6-04c8-43d3-9f88-8661e5d143d1", "comment": "Malware payload (RedLineStealer)", "value": "588a5bac5ff84dc7974c2e21485ea2c72d142bc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296548, "uuid": "b9c6d023-08b3-4014-8b14-15eaaaa84cbd", "comment": "Malware payload (RedLineStealer)", "value": "ca17333c628f11acc00ad917787bf501fc16000a743380a94a449ccbc1cd1c31539ee2dfb461edefbc89f28685ebc639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296548, "uuid": "ca264630-825c-4e7b-ab39-a617459b1e5d", "value": "T14F645B2439EA5019F1B3EF768BE4B896DAAFB7733B07A45E1051038B4B23A41DD8153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296548, "uuid": "b093ba26-d395-41b4-bb25-c9f9688bdc79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296548, "uuid": "17916d50-369d-4b5d-9f83-480ad826a61f", "value": "6144:oNdm8jtESceAN3Vrysx4MBWyh4+MRqIj5Mrx6BbPqh:2bESceANpysXBWE4+MMIjg6Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296548, "uuid": "f63e4c52-41f1-467a-b401-82d77fb68fff", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296548, "uuid": "7b46ab48-65b0-4a8a-abd1-da0be065dfb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296548, "uuid": "4a4e2926-8165-4401-bf43-93712d1347fc", "value": "4af5d329b9906995a3d16a88fcb642d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1407ee-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646300360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300360, "uuid": "5ff6f1b4-47e1-4c9a-8978-52efe99cc5e0", "comment": "Malware payload (DCRat)", "value": "6ccd19409f8eaaa0f70982a9c7db8f05", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300360, "uuid": "1c62a341-eef4-4048-ba93-9a09029c2b3d", "comment": "Malware payload (DCRat)", "value": "751093c95f43fa8bbb300ba1545ec5f39bc29c6293244bdf620157e80952c73b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300360, "uuid": "590ceb2c-b9b7-4c0b-8181-6bf6dce14ad3", "comment": "Malware payload (DCRat)", "value": "121a0c0a8419a6f3b05e123291c1e73d3a620661", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300360, "uuid": "d0a7519e-f6e1-46d4-9be7-8808439244c8", "comment": "Malware payload (DCRat)", "value": "b0cc6fab5f293fff59f5e20f0845a47e738abd8c9b6a98db5d3864534789356255cc08e2b9548030e53f6f08f0286fa0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300360, "uuid": "28d659e2-451e-4ea8-af91-6227f5e563a8", "value": "T1FD7533FBD7598DD0D9C7A831B8A04F723C6FC075B78A87A350C856D90548A6B1F33A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300360, "uuid": "07125366-5ac7-433e-a67c-0f223d6abe6c", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300360, "uuid": "8538ff4a-9e06-41ec-996e-1c9e3a50ee33", "value": "49152:htKGB2L5v30I2tSMQxZY4c1MSstTjz9NrF:TbEhEIZFJGMSs9NNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300360, "uuid": "57f075fe-f9c7-4d75-b5f1-b0c890d50518", "value": 1611776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300360, "uuid": "d355a5f9-b696-4578-9e47-aa72ad0890aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300360, "uuid": "2ab6df18-8ce9-486e-a5af-ed41da6ca439", "value": "6ccd19409f8eaaa0f70982a9c7db8f05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832538f7-9b28-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646335884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335884, "uuid": "c7d8e98b-ab40-46c2-bc61-b7edb6549118", "comment": "Malware payload (Heodo)", "value": "a1ada95eb4e41ec8208668454c987f94", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335884, "uuid": "7c59e9f2-0e9f-4c74-b0ed-dea64b2027f0", "comment": "Malware payload (Heodo)", "value": "753a6f21f83e9054caf0f59d5eb974076e7a8f2711da58302e4f78d73273d898", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335884, "uuid": "7c04221b-1667-4c23-9eee-a6e8fc128bb3", "comment": "Malware payload (Heodo)", "value": "7af1454e1fefcf9a467dbcb929146cf8876f4c48", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335884, "uuid": "801020b7-f9bf-4352-a0b3-7f21417f4706", "comment": "Malware payload (Heodo)", "value": "8862e71b46cb67eb9e59002cdab22cb47907507858ef69f1389f29e04e3afc343bb9829f8c16458ac1b4fb2a4e29ddef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335884, "uuid": "76e9f0c7-d514-4e4d-bf34-5bdb5e76733a", "value": "T148D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335884, "uuid": "8b7f4722-b97d-4ded-b6df-8cb2f2542c0e", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335884, "uuid": "53172125-e32c-4d11-b3c1-4a1c91372a5e", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLOCjzhmD/bwb1r8Hc:Bg4IqjYTO20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646335884, "uuid": "51f56b51-147b-497c-8820-912e5df15a4e", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646335884, "uuid": "2f13ff3a-9218-4e52-9cf3-793fa0e74aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335884, "uuid": "a022856c-9f4a-4996-b378-de459e9ba689", "value": "emotet_exe_e4_753a6f21f83e9054caf0f59d5eb974076e7a8f2711da58302e4f78d73273d898_2022-03-03__193119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4186842-9b0e-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646324799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324799, "uuid": "99ee92fa-5c4d-4145-8e53-a439933e495c", "comment": "Malware payload (Loki)", "value": "61a0c75acbefb611e52b54e2ba31f9da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324799, "uuid": "6ae053b7-b674-4581-82b1-c5a91edee4b4", "comment": "Malware payload (Loki)", "value": "754a492ef497df0dfb09de45b56ca338bda9d031275e388b356366fa29783039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324799, "uuid": "5200fe38-c07d-4f9c-a716-a61ac1c88193", "comment": "Malware payload (Loki)", "value": "dcdd07829c6fdee48bf0b18f5ac16ea4cd13c9c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324799, "uuid": "b9e8bea6-f7ad-4d60-bd26-e8e8abb7dedf", "comment": "Malware payload (Loki)", "value": "296f1b11b230af3afe8f3fb8ff295e54b3f9e07f9d599fef03767cea5c46737493ded4b046f6fa5fb83c2a7f8e29901b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324799, "uuid": "82d6355f-1479-432c-b2a7-7e113c420a0b", "value": "T13C54130975E04D23DB9285707937AEBAFBF7C24406F34A9F67683FE566812434A017C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324799, "uuid": "658c5298-c18c-417c-b04e-2d0feb6e1922", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324799, "uuid": "be1adac1-f0f5-4387-8673-d0a2699c3c40", "value": "6144:rGiLj2YObyf0an15V3fPIoF6S0lLa39Cbru6AaFFikA4QWqBcI:L7ayJh3Hnr0lLawby6BzikA4Q9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646324799, "uuid": "3cb3123f-416d-43e1-b3ab-5a68868436d8", "value": 300695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646324799, "uuid": "f0864115-e779-4bdc-91b4-23c1f70d1d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324799, "uuid": "d31f867f-9369-4fcf-bc13-034ceaee6a71", "value": "http___192.3.247.134_221_vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c390eb5-9a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (SunCrypt)", "timestamp": 1646274884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646274884, "uuid": "ec154445-cc0e-4ff0-b3cc-4b390ce31079", "comment": "Malware payload (SunCrypt)", "value": "11dccb5eb461878c559f4bc93712366e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Suncrypt", "colour": "#F89D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646274884, "uuid": "92cbc895-1593-4358-87ab-c526a601d898", "comment": "Malware payload (SunCrypt)", "value": "759f2b24be12e208903b00f9719db71a332ddf8252986c26afbcda9f32623bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Suncrypt", "colour": "#F89D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646274884, "uuid": "92590f65-2d1c-40d5-8bcf-3960c5540b31", "comment": "Malware payload (SunCrypt)", "value": "cddab958db6e9cf779fd3ecad740dc1c0ff61143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Suncrypt", "colour": "#F89D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646274884, "uuid": "6a8291d3-0538-475c-b03a-047c5fbb4c1c", "comment": "Malware payload (SunCrypt)", "value": "151360aab469dea9d889e6204367c205556937364c5a7c9a8be206d8d320229e4f1bf250f693f086b9e8280d636d434b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Suncrypt", "colour": "#F89D0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646274884, "uuid": "e167f6f5-8334-482b-9ff8-f8c3926e77ac", "value": "T1E4946C80E02B34EBEE4B15F6503B61FE3BAD2E2850084FBBD7A5EB74A5756815548C3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646274884, "uuid": "e2db4d8d-51be-4ddf-96a1-edb7de3b2a32", "value": "2e2e603f81de6f98acc5ee8147bf8e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646274884, "uuid": "3cf079fb-4110-4146-8bd8-0275c46101e6", "value": "6144:mG4IIssmANgdlxltNPfNx5ChB9EdEF5/ESBBR8Hxdd9e:MSHltUnEdEF5/ESBBR8Hxdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646274884, "uuid": "8bfe2b24-eedb-49d3-968f-396d1572563e", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646274884, "uuid": "6a9ab87f-368e-462f-be7f-c6451db94f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646274884, "uuid": "3f1f0b55-aa12-4316-92dd-58692772e5e7", "value": "csc-solution.com 236K$_cryptor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a002150c-9abb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646289117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289117, "uuid": "b2fea138-c470-4e25-a05a-867efbea876c", "comment": "Malware payload (Formbook)", "value": "540da0c640631bc2f27f162a7c5974d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289117, "uuid": "a8a66ea6-ee48-498d-9046-72a36f893262", "comment": "Malware payload (Formbook)", "value": "75a17cb26bd616c7d7b48b0b3add3033b6cd8656d8d20a0618734a3850072632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289117, "uuid": "c7da7f99-64f8-4d01-82dd-612c65bb3588", "comment": "Malware payload (Formbook)", "value": "1d29e94ff13b16661ea78d4f0259cae6d8cfd1cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289117, "uuid": "d3c05882-00e1-4845-bb42-c24f6febb079", "comment": "Malware payload (Formbook)", "value": "676db90b9eba5b48cdcf7bf7c6bac08eda91e8b02fc7cf43ee74fe2b4ed618b5c1ad59b2e309264e8c9c81b974e1ad63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289117, "uuid": "f2e4953a-1662-4265-aed2-548f4d210e5a", "value": "T105A4E00A2194E213E7C832355F75DEB86769ACCC6C154A2B32F43E8F3AFE1179506672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289117, "uuid": "0b46f119-2034-427c-8524-93f05e0cc4cb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289117, "uuid": "e925c3e7-88ba-495e-9810-baa26ce19868", "value": "6144:0GiWuZSYIF8PeqN2U28qNyfVnCjUX0+vJNbGenw9HT2tnWNgfmu:QZDCgeqIX/IEjobUxT2tnXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289117, "uuid": "eba7d364-6074-46fa-bd33-7e18de4aa5dd", "value": 473702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289117, "uuid": "d90f894e-3206-4940-8486-816c349e3eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289117, "uuid": "bab0eb20-5bd6-4b71-8784-6fee71f1185e", "value": "IRQ2107799_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cfc773-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646294526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294526, "uuid": "cf741186-eac5-46a3-9384-e253c01dcdfa", "comment": "Malware payload (Loki)", "value": "a91877df9d1eb0f79896e4a1028326d5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294526, "uuid": "6b09fe2d-345a-4b0f-88fc-e2cd62bdc674", "comment": "Malware payload (Loki)", "value": "75b5952709d385de020f9a679a1c184c110cf933ac81de9514ca260f9099f3ae", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294526, "uuid": "aedc46e5-6c40-4414-832a-6b9b353b3edd", "comment": "Malware payload (Loki)", "value": "6ea9a1ee8af29dd2a3e2da985bc75c77314fdea5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294526, "uuid": "ff5dc1ac-d66c-4e51-9b01-8ea42ed7e932", "comment": "Malware payload (Loki)", "value": "1fa6363134da621d4281a71382ed57ddcd035bbf2a2831758a08d345b8dabd9afc27d8d5a6734b9cd6e692b5ce9e246a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294526, "uuid": "c4b1b10f-2561-4e25-9203-5ab28c75a340", "value": "T1E6141261BA65D327F84419FA28B84FE54EE0AD5194CF890CA00632327FF6904A79E57F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294526, "uuid": "fcb285fc-53f6-44c7-a083-0bb9c88951e4", "value": "3072:6veXD/b0zxWJibG9AqmDcYYp02M8oTNAz3vvfcGngnqH1pelC:nXD/FJPtYYp02M8oTNeHfcoUqOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294526, "uuid": "53fa371f-a48f-4e03-af7b-f5af4f7ec234", "value": 190888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294526, "uuid": "a055e175-5118-4cda-8ff3-6289f382ea35", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294526, "uuid": "15862a83-ea3e-471c-91e6-5d203f887def", "value": "Purchase order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c12b0a-9b40-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646346111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346111, "uuid": "499c416e-b1b8-46ee-afc5-0f1b4efb5038", "comment": "Malware payload (RedLineStealer)", "value": "cacccd6f1c391ed9f617931181b752d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346111, "uuid": "49358b20-03e5-4831-8928-985e47aa6fb6", "comment": "Malware payload (RedLineStealer)", "value": "7605a5d355941ddf465272bd31583c254584b65b230c0fe7a93b8f887c5af3aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346111, "uuid": "2d9674de-3960-4365-9a90-f30da84599bf", "comment": "Malware payload (RedLineStealer)", "value": "3ff51146d65d17bbe5eec286349be33c2b6c7567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346111, "uuid": "a27106bb-6341-449a-8b60-4eb1254570ec", "comment": "Malware payload (RedLineStealer)", "value": "e21dcccf7a9456b90fba7f646a2eaf6ff9a9ffa5cd97480039ff639f638140ba40442af7a03f11494b173dbd2415748c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346111, "uuid": "76f7e202-44c0-4334-9170-f05f29597f36", "value": "T1A6C433DED389B852C3CF15B4BC4CBE62A5C18920ACE0B554B1F811BBDD5C4F2C6198AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346111, "uuid": "aa2cedbd-b51c-43c6-bdcf-325ac9d779b9", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346111, "uuid": "fcf0331d-760f-4894-b16f-8d50cff00740", "value": "12288:hU7kB6QLxsqV0vMC69SFQS03ULaHNqrxlKIQNoZ+YXWP:hskB5ViQAkEaHNYK3ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646346111, "uuid": "84c6648f-e0b0-4cda-bbee-f7c74815556a", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646346111, "uuid": "982e965b-117d-4202-bc58-0d2c198a049e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346111, "uuid": "5173d1e0-75d2-4fd6-8cbe-39452b486cf0", "value": "cacccd6f1c391ed9f617931181b752d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462a2a77-9b09-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646322467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322467, "uuid": "78cf5632-c6a3-428e-ac45-c4b76df2eb90", "comment": "Malware payload (AgentTesla)", "value": "756517807ff09ecd651b83f5f962dd9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322467, "uuid": "03f7ffbf-e999-4752-ab4d-dc05eb8c5b91", "comment": "Malware payload (AgentTesla)", "value": "7613ceddab7fa5b4343af18577e3d4d96bcc78771893a3eb8108dd8aa24e6623", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322467, "uuid": "571d69dc-b25a-4ba8-93d3-6e1cf0418140", "comment": "Malware payload (AgentTesla)", "value": "0e3626962aac1d10b11175e6a490a99689f68b72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322467, "uuid": "54002dd1-37e5-45c3-ad87-55b54d3c2046", "comment": "Malware payload (AgentTesla)", "value": "ba527386fa4db15dba1588f6adacd74a069325bce6c50172feb95da7824e203d0c2d79602e56ed8a4c1e30e83b54b482", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322467, "uuid": "a5534aeb-a50a-4990-999e-7d12f5b67cd9", "value": "T17D45F10434EA8034F9769BF2CAC8E7E09B7EF614D549A0B268005F1576537BD8D4AEBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322467, "uuid": "5cc84ea6-0a06-48ee-a64a-2c42b710897f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322467, "uuid": "11634ac7-8e44-412c-9bf3-4e708702ea4d", "value": "24576:d8BdHElOZyZHLkkWv9Wq8tbmwSJDz7O5vRl5I4Ppz1MZtmq1uV:dLOMHLlW1O8O5vRl5RpMm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646322467, "uuid": "14fa9c45-5fec-44d8-8d7b-806bed6dc8a8", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646322467, "uuid": "2c530f3f-5306-4ab1-b205-27e7fbb48f5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322467, "uuid": "e420fda4-2f04-4b1a-b518-d1d18809dd76", "value": "DHL waybill 030322 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e1d5ba-9afb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646316640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316640, "uuid": "23ae2095-7459-41b3-9f0a-a56401251ea5", "comment": "Malware payload (Heodo)", "value": "2109ba7ca39a0fcf78c8ed4adc95eb1d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316640, "uuid": "0e9b22ab-bd0b-44c3-87c2-8b00de78ea72", "comment": "Malware payload (Heodo)", "value": "763d86131dcd42979ac67207674759d1faa94a57ae6034b5df6def3210ba1a09", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316640, "uuid": "fe43b592-7fdc-48c3-87d5-5f01712aa804", "comment": "Malware payload (Heodo)", "value": "f80e3678d72b03d2da5e2f15be4f17fa7b39b926", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646316640, "uuid": "8d265ba5-4cea-4f01-8427-0c081549b5d6", "comment": "Malware payload (Heodo)", "value": "31115ca7e70680ef65205fe628ae901cbf0db0e389085f3d5b496d2dc2d6b31be5ec44026c6c463c6951fa44cc98042c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316640, "uuid": "bbc48889-d241-4cd5-abe9-70563cb042e1", "value": "T1D423E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316640, "uuid": "fb828f5c-442e-4947-a246-f392e3f09266", "value": "768:O/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:O/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646316640, "uuid": "01e3e856-1fe8-412c-a3cf-d6333cc4a75f", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646316640, "uuid": "5587c130-1def-405f-b598-57423a5dc9ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646316640, "uuid": "1558cfa9-08c5-4c48-8c9c-08292cddfac8", "value": "Rechnung 2022.03.03_1445.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46635459-9b33-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646340506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340506, "uuid": "e8cce9a1-8e27-4a51-a43a-834e987612aa", "comment": "Malware payload (Heodo)", "value": "1cc3a8849c949539d1f61509101ee4a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340506, "uuid": "fc384462-1f2b-43bf-b114-37c9f7708601", "comment": "Malware payload (Heodo)", "value": "76d736e8bbee012eaf4be9f3b0aaac66df2ef7bf5690dd425916842a30655dfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340506, "uuid": "109f730a-41f2-4d79-bb4b-30b2227b8dd9", "comment": "Malware payload (Heodo)", "value": "ba461b303c7040bc96cf392a86b246968fc9df84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340506, "uuid": "340bd178-d839-4455-a9d9-9e9be7f7652d", "comment": "Malware payload (Heodo)", "value": "7c11dedc086103c519bf457c6017b041c07e5970b11daedafef1572be7bc9c8e18188817226073242faa1290a400931a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340506, "uuid": "e23523cc-9af3-4fad-b274-52e5024dbd1e", "value": "T15FD47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340506, "uuid": "2b2a141d-547b-4dbd-bd34-c0ab19108545", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340506, "uuid": "dd151b4c-bcf1-4458-b291-19144cbb0464", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLuCjzhmD/bwb1r8Hc:Bg4IqjYTu20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646340506, "uuid": "5bd84e1d-2034-48c1-87b2-324d17545f69", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646340506, "uuid": "9ad4fb90-bf9d-4cc8-8569-3c9d193283f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340506, "uuid": "7bf6e004-3682-4d98-bd96-ea690d686d34", "value": "1cc3a8849c949539d1f61509101ee4a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ba1ad9-9b16-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646327939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327939, "uuid": "7fe6740f-1a6c-4df1-94a5-6e93438066e9", "comment": "Malware payload (Formbook)", "value": "eaffb53859519d8720211f3e1620fd0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327939, "uuid": "b7a89fb9-36d1-45a0-a995-6ccae83af946", "comment": "Malware payload (Formbook)", "value": "772d929d92df65dbf1317692104071529b8519e077df827e5d02dc59c5ede773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327939, "uuid": "341d922f-b864-4610-acde-d7359ac23f8d", "comment": "Malware payload (Formbook)", "value": "da0c0103ce97465eb8da9ce3e6a572235e22d472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327939, "uuid": "b434f6f1-f8f3-4c38-8f27-7778eac0f9e2", "comment": "Malware payload (Formbook)", "value": "f1e6289c063acd38f41bb68dbe7a74fd507b4c2aa6f5a0fba16142b1d0c52a5ce78e492fcd6ce21216111655dc2a0897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327939, "uuid": "f42b6b36-91ce-42d8-a7e7-e62c4b52b39f", "value": "T14554122BA4D16EB7D28A563021B7A27EF3FF5285043107676BA81FF24E52D571C182E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327939, "uuid": "fc2f5a9a-fecc-44d5-9775-a39d906f1111", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327939, "uuid": "a7db03c7-ab2d-436b-a66a-6ef9c9fe9d84", "value": "6144:rGixpBtC3Ujzx0I18NxwT7M8FwATJr8TfTGpXhVK:NpT7d0Y8bwT7M8FDTJrQb8vK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646327939, "uuid": "77aa722d-cbb3-4aeb-b9b9-7fa5b597721a", "value": 305572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646327939, "uuid": "04aa9277-6f2d-4c3c-9cb2-fc6b21df8dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327939, "uuid": "d2001e44-1237-4dc2-b7c9-755d9e6d0287", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e266ab54-9ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646293953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293953, "uuid": "ddc9d19e-f0e0-404a-80b1-80930e5dd681", "comment": "Malware payload (SnakeKeylogger)", "value": "e7dd2c09a66a97342bfab332bd97b61c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293953, "uuid": "0c3b7776-7f06-47f3-ab7a-bb3e5961a6b9", "comment": "Malware payload (SnakeKeylogger)", "value": "77930c0cd78b1755f08458a5422a1b3e9d404f9653fe2a5179a7899a3e99831b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293953, "uuid": "46874b0a-767d-4019-ab38-0b30e232f308", "comment": "Malware payload (SnakeKeylogger)", "value": "b1e4b1f8fefa105cd9cf5a174326e53ba76e6407", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293953, "uuid": "72147a46-9056-4d80-9b3f-511581c0138a", "comment": "Malware payload (SnakeKeylogger)", "value": "9e03aef58e6756fd82b386a07df1f82c7b7ab9711d5d641cb08109e67ef02a6831ef34f96fb1bd8c5d06d66255108a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293953, "uuid": "04cfff20-28fb-4cf8-ade2-6323cebc2f9b", "value": "T1F8A5331B92E4806FD1BA67B2DFC21B5D4B954263600FB82B93CBF43F26B6F5240E1564", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293953, "uuid": "89959753-0fb4-4a57-aae7-5ed587207737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293953, "uuid": "27cfec1d-a6e2-452f-98a5-720f6f18e545", "value": "49152:AJr0K8rAe2HvXngk1wgb/PqZdoKAajlGSVz4L:80zXRgTSZdoFaj5qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646293953, "uuid": "980a3815-4b7a-45ca-9449-550a89a7663c", "value": 2110976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646293953, "uuid": "07f34909-92d1-4d41-b1de-8d2cecb188fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293953, "uuid": "b6e79718-df7f-4085-97b1-4fdeb7aedace", "value": "4487654189000976545678900---0987656789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148615bb-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646300479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300479, "uuid": "4f85b793-d7f6-4709-b562-e74720cdd2e8", "comment": "Malware payload (Loki)", "value": "ceee204b07e5598e134431affed14b81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300479, "uuid": "d8afacf4-839c-41f9-8689-ad04e08c78fd", "comment": "Malware payload (Loki)", "value": "781eea0865be648267a08dd5216e3d598de51f5438951a9bc35d9dba22277770", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300479, "uuid": "aaac2d1c-e05c-4147-8c16-fbe534be1ef5", "comment": "Malware payload (Loki)", "value": "f660fe4561221644829eb82f70f609a0517ad8fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300479, "uuid": "3eabb7a4-49de-479c-99b9-b8c3549dbf70", "comment": "Malware payload (Loki)", "value": "656cd0d0e9c0026c73bf570ab4d81f709d7ce59dac28e7d0cf2003245d5f812993c716a8ae3e35ddad02f65543f4073d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300479, "uuid": "acf07e56-85d7-41cb-b09d-56591b1d3ffd", "value": "T18354238BA2D1D463DBB219B58A7373DCFBF241DCD562CD27CB9E2F712EA61450019222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300479, "uuid": "d7ab1150-c5d8-40c3-9700-848605293d2c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300479, "uuid": "43ba3f50-2c40-4a37-9bb6-52252033a6f2", "value": "6144:rGis7P3DUbNEFhOXsMqu8zB/qb5Gj490A0lc7/4kzMuBaHw1eg+w:wz3DBz+sMrmB/I4ax3rrzMuY9g+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300479, "uuid": "1c95d723-8d75-4fea-9e26-386249c21de6", "value": 303357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300479, "uuid": "40217d55-2568-4b68-b739-35f50dbe6c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300479, "uuid": "cebf6df8-c88c-4be8-af5b-81ccaee3c36a", "value": "ceee204b07e5598e134431affed14b81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a50bbb2-9b15-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646327601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327601, "uuid": "79673d96-09fc-4212-a3ab-e921c7ca9289", "comment": "Malware payload (Heodo)", "value": "fa082cac71ed747ffca609a7853b261e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327601, "uuid": "a62448f6-f991-4048-b633-ec0af78787e5", "comment": "Malware payload (Heodo)", "value": "7a4262d54d42cd7f1613128d6716a5423c57df1a66aecd2bf896b9c00a11e2e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327601, "uuid": "2cbdfae8-61bc-476e-ba7d-1106f31ea615", "comment": "Malware payload (Heodo)", "value": "08379526fc6785dd9bc53202b5ed42026fbfb664", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327601, "uuid": "021ca1e3-944e-4687-8316-5275e04faeb0", "comment": "Malware payload (Heodo)", "value": "81977492769911254847423d83df1c5f276177a6161cd4038484c9b324a7f3eedb565e4761f0f72be6ff897ae6e37b79", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327601, "uuid": "5e6aa185-bbaa-4132-a1a9-1f0a5ba3fef0", "value": "T1CF23E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327601, "uuid": "6f6b0309-9f97-4406-82dc-1132cc24aeab", "value": "768:e/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:e/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646327601, "uuid": "f4af5d17-c980-47e7-9605-101b1c45451c", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646327601, "uuid": "705d06d5-40a0-4ec9-9cc8-cd4acf81cbe2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327601, "uuid": "f87a90d2-a72a-42ee-92e8-293f381d157b", "value": "2022-03-03_1801.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a35da7-9b33-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646340690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340690, "uuid": "902b9adf-ada4-41cc-a8a4-8b449dc4c255", "comment": "Malware payload (RedLineStealer)", "value": "63443eb5bb254ce29d91bf1dae7fea1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340690, "uuid": "016a75e7-82f1-4211-9f98-15bb50b6f7e4", "comment": "Malware payload (RedLineStealer)", "value": "7a708cc9aca4024d0cf7183459b837961bc859a17f80a16cead597896126843e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340690, "uuid": "1f150de6-a00c-4769-9a0c-69fb131df144", "comment": "Malware payload (RedLineStealer)", "value": "70af66b33c6a167f7ab5945a2d7cb9f747eb3173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340690, "uuid": "cf4905ba-72b9-4a92-9d45-11ce9d13b771", "comment": "Malware payload (RedLineStealer)", "value": "bb4d321b93262f2c8b1514849909dd58d94ea204ae14d88eb8601e24b9e3cd155985b7ed57f976ee969a43c1e7a23a36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340690, "uuid": "c1938c5a-4183-413c-9247-705adfe19584", "value": "T1A2F37C1836E5C072E56B51764474C2B44E7BBC762F369D8F7EC12BB90F262E18B2530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340690, "uuid": "1b503b23-720f-4f75-8351-970e69d027bc", "value": "df5ad39bf385f94719ae74c297a05bad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340690, "uuid": "0b17a1f2-77f1-4216-bcde-ca059e344d15", "value": "3072:DBPLXRz7Ut6k2IJigeeOGdrFgF2GOBR16moN0mbq58tQpJ3:lPLXRz706uJ7gF2GtN3ZQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646340690, "uuid": "c47a40a4-f3a1-4d62-9278-185e8388fb50", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646340690, "uuid": "0b747a6f-91e6-4459-b6e8-29fece53b2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340690, "uuid": "af84a1a4-1d5e-4f59-a43e-8ff6d7b507c7", "value": "63443eb5bb254ce29d91bf1dae7fea1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae9d94a-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298906, "uuid": "b1e3ddf1-2d06-45bd-98ea-961bde39bc0c", "comment": "Malware payload", "value": "7018f234af8bad22087be6e90ddeeafb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298906, "uuid": "47981980-2e7e-45ad-83ce-33a5cfddde85", "comment": "Malware payload", "value": "7a76c39cebc89415a125d7773796ac539e0fc0f36a4663ec0ec75fec0d46bb7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298906, "uuid": "221605a0-f9b5-4914-b46a-27db8ecaf3fe", "comment": "Malware payload", "value": "a789b31320677d57b52f9ed56aecf144dc89f12a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298906, "uuid": "e02acc54-6d29-4a89-8f64-3b3d26c8cbb9", "comment": "Malware payload", "value": "ed5350106fbe967db652cd2fcfcda29ad62e5d8d6c61358cd2433b89e7d6a2283e822df41c8d768354a496103fc58528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298906, "uuid": "7a1467c8-0345-4f3d-acf2-c20f314d5601", "value": "T1D8C4BE17E6428076E4632430265D9B7649BD76300A2655BBF3C42E2D9EF02F2AB35F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298906, "uuid": "9eebb34b-e344-461b-9491-6b013fc79e48", "value": "06c6e92acd3ff57b00b3132976b3f6d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298906, "uuid": "873e08d4-d4ba-4ea3-a455-cc90442bb9c4", "value": "12288:F7vT8cGUCZmxIwNjVGCXZqmmJUL+JHkdIUnjoqhwKw4d:Fz4BUCZmxIw1VGCXZ5mJdkdZnBhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298906, "uuid": "0159ee28-6f2a-4240-8380-69da856864f8", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298906, "uuid": "d971490c-a12e-4eec-9046-2d937623f65f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298906, "uuid": "28e74fb9-abb7-4486-bf88-40bf3bc26fa2", "value": "7018f234af8bad22087be6e90ddeeafb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22fe800-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298140, "uuid": "29f471c5-d3fd-4164-ac72-c719197079a1", "comment": "Malware payload", "value": "078f0da0dd1a1c340dc6d8badafbcae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298140, "uuid": "bf3c0c16-1f71-4a88-bc01-8298057982c3", "comment": "Malware payload", "value": "7a9cd326adf37a9b48788b4106f94ef9e624a85c7e6c9e68db5aefd0f07fa31c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298140, "uuid": "782c5765-fce8-4d26-b8e1-4323c9cef7d1", "comment": "Malware payload", "value": "927457a0d2d4ce166a6b918ad09271c403dd6b53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298140, "uuid": "d3f39b2c-aeb4-4d41-918b-7b50851ba5aa", "comment": "Malware payload", "value": "8730fea067cce7f93c4b56a7753d8750cc5fc09f5f29462f14a2260168ece887b4295ca066404a455a371fce3b1464e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298140, "uuid": "c8dfede9-52d8-4898-a455-c1477f582198", "value": "T1D3B312863F94D111EEB60DB9D740E2E22E30D390FDAB1FD6A00899572ED03591F62A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298140, "uuid": "ed9c602e-0762-4cd6-82e9-7bfc5507dcfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298140, "uuid": "08d320e9-5a6f-482d-959e-30b10ddaa0e7", "value": "3072:CihCy1BAneg/IIhOH8nyjLYx6T2229WFmdsa:rCpntMH5n/T7uZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298140, "uuid": "91d2e3a5-17c0-4ba2-8297-e0ae5609d364", "value": 115208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298140, "uuid": "2cd1f4d3-65b9-4ffe-867d-eb9b0e400f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298140, "uuid": "44b827a5-6ece-49b4-86b8-5bce8157dfff", "value": "078f0da0dd1a1c340dc6d8badafbcae0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b4e695-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "cb81a249-6ccc-4b20-8972-bc8d43ab4806", "comment": "Malware payload (Heodo)", "value": "717ac962600750836c2db8369828d90e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "fd599c4e-59d0-465f-a44b-b0d7397f4e39", "comment": "Malware payload (Heodo)", "value": "7b6c13ae8ed584a8e4676f7c60a280e23c4a85f292f0d6e0b108f4d05a799998", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "1d2915d8-ea27-4a54-87ad-fb1414d548ec", "comment": "Malware payload (Heodo)", "value": "c515b9be5b9d05bf9897ba35a5ee21e8b68e7b44", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "cbd34ad7-ae4c-43b3-aa11-0c6e5cac9e0d", "comment": "Malware payload (Heodo)", "value": "3ad741e8c95aa4bf961ed15789991e95c59f22280689a13701e48d7b1c8e2af372cf7329ef6178e5d20b8389cbc2791d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "e7383ed7-413a-4c2a-985e-5231cb2e5ca7", "value": "T12FD41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "7767b683-3981-4bc6-9356-077cbab4b1f1", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "a2e7d3e1-3187-4845-a45e-e45d02a3f99f", "value": "12288:ZxpNJJJ2NHPoczJhOtIhxf3foRXIa5EPwvA:Zx2gczJhFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "e8f10303-308e-48d2-9403-f11e3895ffda", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "71cf4986-4116-4c1f-ba1f-b5a09e7c4e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "333510c1-9295-4183-8741-1727f7f5f5e8", "value": "emotet_exe_e5_7b6c13ae8ed584a8e4676f7c60a280e23c4a85f292f0d6e0b108f4d05a799998_2022-03-03__000310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b137fd57-9aaf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646283992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646283992, "uuid": "8a63e208-6605-4dc4-aacf-12fc5e88c7a6", "comment": "Malware payload (Heodo)", "value": "1da7bb4ffd8cda2de23a1434cddb91ee", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646283992, "uuid": "35dd157c-186a-4601-a167-57e1da93a85b", "comment": "Malware payload (Heodo)", "value": "7b9b4722f2d9bc3c442af3337867b3274f780d51563c7419339c2e5d56d1771c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646283992, "uuid": "38a52cfe-b782-4fa6-8e31-94816332098c", "comment": "Malware payload (Heodo)", "value": "bff9050a077f716e1e297defd1ec859fef7993d8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646283992, "uuid": "a1c2edaf-e41f-4b7e-8474-bf10a82b733e", "comment": "Malware payload (Heodo)", "value": "9d1357c3653c7f41c919da60e94f7a2e4a2df0055f03efdb9392e59dd8dffa8de1edaa8768e4be00023a9bf3d596d261", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646283992, "uuid": "3179ba1d-64ff-4830-baf3-c54ad468e74d", "value": "T19B23E02AC5207828DB3A4C35820469D2721A7D05DDD5FB5A3145FB4C3B86BFB53AF88D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646283992, "uuid": "ff1354fc-5830-4fd2-b229-c204934ee8b7", "value": "768:71m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:71HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646283992, "uuid": "9ccf92dc-9e54-4a49-a068-54f90ae2995a", "value": 47653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646283992, "uuid": "1c93a009-3cd2-4081-8416-a93ae6887542", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646283992, "uuid": "f8c7e84a-1039-4777-8022-783e646c07ee", "value": "2022-03-02_1644.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfab1f3-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646294320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294320, "uuid": "8e248329-977f-4069-9514-611fb23ebebc", "comment": "Malware payload (ArkeiStealer)", "value": "e40fcc8534a1479e274825b151bf0993", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294320, "uuid": "0c6ee3ff-f947-49d3-9375-3a367652677e", "comment": "Malware payload (ArkeiStealer)", "value": "7c09763964287a2d93483939c64fba14a0439b2a04db94eb03cc9522fe08c081", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294320, "uuid": "4e3c3446-b49e-409f-82ce-95e308c2970c", "comment": "Malware payload (ArkeiStealer)", "value": "966c6337019dbbb4e6fa753317b3abcf96fcd6dd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294320, "uuid": "d2806573-b16d-4787-a4ee-6b0ade6a7003", "comment": "Malware payload (ArkeiStealer)", "value": "35db01d43bc072aebf0fe18cc0bd705cbe9d716818057377dc7f5fcb90186146690cb22a03d83eff494b7a4d502668cc", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294320, "uuid": "9a1ad45d-941d-42dc-bc11-ef388520a59b", "value": "T19BD412277FC0C171C995267444A8CAF15E7BAC20A83846437B8567FE9F35BC0AB3A749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294320, "uuid": "eb512eda-a6f7-4ee4-8139-71ec0513c8d8", "value": "773c52d0914f529a889bc69eefc3fe56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294320, "uuid": "4286daf1-bfbc-4ab2-8763-e0f61815496f", "value": "12288:6DKebjcSLFZRjTGlKN3FZiGvy6uku5BseyhooN3n6:t2jFTR43G6lkuvhSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294320, "uuid": "8095432b-c79a-4bd0-92ad-81a598d2d562", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294320, "uuid": "41d753c2-e2a3-43c3-93b8-16fb3d57fd0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294320, "uuid": "95476bed-4dcf-4fc9-9ae1-c53e01ce1290", "value": "e40fcc8534a1479e274825b151bf0993.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5bfe78-9b3b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646344110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344110, "uuid": "da354762-c9bc-41a4-bd6f-a789f2fd606f", "comment": "Malware payload (Heodo)", "value": "d418ec2b5b80330e58fa80f44c3ea30c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344110, "uuid": "fe147de0-8e75-4f62-baad-8147aafd3550", "comment": "Malware payload (Heodo)", "value": "7cd16550cd43f9508408cd0fb2fd23f849e975a6eda1be3a887a6de6a6ed9536", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344110, "uuid": "dc3d2639-abc3-46f3-abae-7a97365997c1", "comment": "Malware payload (Heodo)", "value": "2f0cd678b9100fa687ee56a598dd1ba8fcf6f396", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344110, "uuid": "8d28a7fa-b34c-40f9-ae03-8f2ba9ba5131", "comment": "Malware payload (Heodo)", "value": "230b2a442750b2f67fcab4340259adcd3ac2e481e5e5d9493accae170bb6ef22fe38b04fa014f17d127ae79ec9b59968", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344110, "uuid": "06d32c1c-6a3c-425f-9320-4649e8ffb0ff", "value": "T1E7D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344110, "uuid": "86e32465-8802-49fb-a0ed-15c40be8fe9a", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344110, "uuid": "f2113ffe-677d-4ff1-a8aa-4d65cb60e7f8", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLvCjzhmD/bwb1r8Hc:Bg4IqjYTv20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646344110, "uuid": "129dfa76-e8e3-40a9-84f5-db2fc5384787", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646344110, "uuid": "2b580aa3-0895-4f3c-bb77-5031c6fb5893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344110, "uuid": "5c9dbab7-82bc-4ec8-9d9d-fa3f8f9e201f", "value": "d418ec2b5b80330e58fa80f44c3ea30c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc9d936-9ab7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646287479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287479, "uuid": "25c754db-ca6a-4ba6-8799-5fb761c248e1", "comment": "Malware payload (AgentTesla)", "value": "02358e6b95607a9db470e78257c2cfec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287479, "uuid": "baa785be-87e8-4d81-a48d-abe5c6d4e826", "comment": "Malware payload (AgentTesla)", "value": "7d1ce895b378ac882afa295257d1be99a16c8f9ad36bdfc7940419c1d7fa8348", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287479, "uuid": "e60e65cd-1d37-4dd4-9896-e10a5545c776", "comment": "Malware payload (AgentTesla)", "value": "0479fcc6a303a9ac846f84ac8a3795785388b1e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287479, "uuid": "c7cf43d4-08a4-42f2-8221-e75f786257e1", "comment": "Malware payload (AgentTesla)", "value": "497cee6c99f4b39e89123230c32f5cd97b2faf48d11da3190166e3a7226e15b12a59a6895078d896f1f9a23819ddd823", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287479, "uuid": "391e5c6e-f729-4f98-ac4a-dc3db600885e", "value": "T18A635C41E6670567D5284AB2A0C342C307B5730F58E3CAAB5DCD708A5B6F3C62696FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287479, "uuid": "fc07f47a-5f17-4a4c-bf0a-99d5faca6853", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287479, "uuid": "54e648ca-54bd-408a-a9d2-dc87f7eaac9b", "value": "1536:9FT7/KyCviTHWpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrXDjQ:3bWpga/eHUTQQQQQQkdBft/2YWLrTjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287479, "uuid": "8c6fe76a-cea8-4c2f-83b1-ad951247af41", "value": 71880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287479, "uuid": "47b6b2a1-90b6-4298-a08d-c67c4a29480c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287479, "uuid": "733873e8-2265-42c7-8dcd-bd4f013ac4da", "value": "WaybillDoc_9151243522 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351b02d0-9b40-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646346061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346061, "uuid": "f0b61394-0245-4a11-85d7-9eff2bf89ce0", "comment": "Malware payload", "value": "b2a39ac7ddec02f9513e47b9e55d795a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346061, "uuid": "446f0010-df8c-4e36-b565-6a24a7d9c047", "comment": "Malware payload", "value": "7da0242696e709c916f94dd14e88fe8fa68004e44603a564f4aa8d6bdbd310bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346061, "uuid": "d4095575-81dd-4265-ae17-90920a37e0ab", "comment": "Malware payload", "value": "cd2dd52f6e801d1085513d17784ced5e3585c518", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346061, "uuid": "21d139e0-145e-4fdb-91a0-cdc5a8ad6f94", "comment": "Malware payload", "value": "34b4aa905b9e37f5e75da0d60f13c10395d40a1e9f9e5513e39df5325d926c3f6ede13b387122facdc7f5d9b30666167", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346061, "uuid": "62054729-07d1-4666-8707-055a890a2636", "value": "T17613012A12F132E163C034E3947E1942F5DE3AD153963C62BF7069D7A93EAC56F90425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346061, "uuid": "c76447d8-a34c-497e-9e66-dd151c90cd3d", "value": "768:e6WNVxOfLqrJkUmLiwClfkbweLCrNN0+gaHE+I5+16GdRLTa0e4/3RktVs1:sNVxO2RRZOrLCrNON0i+AgLzN/6t4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646346061, "uuid": "68b0f046-6671-4d4f-b7ad-78985ac2c259", "value": 42639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646346061, "uuid": "887bb435-8079-4ac0-8f30-e6db9291b03f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346061, "uuid": "8167057c-173b-4c00-a4de-cb42c256e6b3", "value": "IhreRechnung 2022.03.03_0911.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd946b4-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646294405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294405, "uuid": "25c6c42f-fe04-485b-b93e-598f6366b19d", "comment": "Malware payload (RemcosRAT)", "value": "f6861178eb51610cb13da7d04b25f304", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294405, "uuid": "da76939c-cadf-4223-a5c1-5ea2a1204ab0", "comment": "Malware payload (RemcosRAT)", "value": "7da894d0269aba487ae1535097eed28676c937cac1cbd1ff9cdbbe6f916f17f7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294405, "uuid": "18bffd41-02e6-4da7-8519-fbf210794756", "comment": "Malware payload (RemcosRAT)", "value": "786af321d49bf0867ed773ba50c2507b37ea5ad7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294405, "uuid": "c9f3b1a0-4d08-4a86-9650-b3ffebdb8dec", "comment": "Malware payload (RemcosRAT)", "value": "ebc9f5ab8c1fd30a058e657ebfe812748ae77b47635386b22f34e59282943d57850306a5969e8e26f4999a3862b13c27", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294405, "uuid": "5c0d656a-2366-4ee0-bf3c-a719341624fa", "value": "T12D1412B07286E02DF6E52A384CFDFBE9D031EC02AD15220EFB547A4E2A745256CE4577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294405, "uuid": "2babfc5d-a734-4004-aa10-4bad6ac0c97e", "value": "3072:h1ZYsabht876ZEzJeDvNKelj7kEuZchsyBnbBA14sUwwaMc3wLtIX:NYsabbk6Aaxlj7KvyJ21bwU3waX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294405, "uuid": "b297d2da-66d9-4f7f-bdb4-489560d88373", "value": 191064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294405, "uuid": "82b19aae-5b1b-4cf8-a0f1-3f4fea15bd9a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294405, "uuid": "4c33de1f-d112-45c7-a340-7ee76abb7622", "value": "+9053798666_2119-091312-110.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212f8e0e-9aa8-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646280744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280744, "uuid": "413d15da-c592-44b4-b81e-bbc9cf6b5a34", "comment": "Malware payload (RedLineStealer)", "value": "c6b36286df59d9e844d1b6fd3fd96f72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280744, "uuid": "73bef638-ee22-4688-ac08-3dbaf19d29b1", "comment": "Malware payload (RedLineStealer)", "value": "7e6b77eacaebc148af0d1c6c670f26ced4a5f735b54a2d84a573c6a3e1c91cc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280744, "uuid": "2cd104d1-9d29-47c7-8ff1-8e3011e3ff0a", "comment": "Malware payload (RedLineStealer)", "value": "e109e6a47c93480657807de652916cd11dd620ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280744, "uuid": "899681ee-a3da-4164-9582-9bc51d9b2339", "comment": "Malware payload (RedLineStealer)", "value": "7a31132ab609ebad75665b460275eaf072d0ecd6c7a7d9909cf1e555e700c0a526f15df98275dfbea8d1a11c361e5b08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280744, "uuid": "8afdb531-aa86-4ffd-b600-566542417c3e", "value": "T1F616336BCF62B06DC21DE5F43C0934AF0635405FC694F532E297378A815B6AF91981EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280744, "uuid": "00231df2-6fcf-4975-b711-be33ef606d3f", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280744, "uuid": "9ec13479-f96f-4c93-8fce-d07d217def37", "value": "98304:q+zbuN1tbuwQuEX7kVwfx0NPoWuq0zHlmiBFK3dPQg:q+GNTuXuELpfxYAWuqEH23dPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646280744, "uuid": "60c72798-e3c7-43b4-a3e8-2df842fb3f63", "value": 4065736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646280744, "uuid": "209a94aa-6bc2-4164-b821-b916018753d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280744, "uuid": "1fab8bb0-03c1-4dea-9816-7cc1544a92ca", "value": "c6b36286df59d9e844d1b6fd3fd96f72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ac07a3-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646296238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296238, "uuid": "dcdf0224-f17e-4254-898b-e85cd0caa2cf", "comment": "Malware payload (RedLineStealer)", "value": "046d84994df11aadb9a921340694a084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296238, "uuid": "7fb6ade7-070f-4700-9cc6-4fd502b1132f", "comment": "Malware payload (RedLineStealer)", "value": "7f413a9baa11bf40a86f5bb1bf71f6d8de21bb6b28ddee8dc09a390bc24a04d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296238, "uuid": "767adb58-10a0-4ec1-accc-4f059497f1ee", "comment": "Malware payload (RedLineStealer)", "value": "8ea131c9d094a5b0620e617ce3421983ca86d5c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296238, "uuid": "81f2168c-ae74-47c6-beec-5dce9e10e2c9", "comment": "Malware payload (RedLineStealer)", "value": "ca4e35ae28aa77653bd0ba162805c13c17d44f5a52cc822c687d2a50a9cd7d96ec6445d0fb3eceadcd763d97e98a0012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296238, "uuid": "802ede78-f39a-40e7-9a71-ce0f026be5f2", "value": "T1F63633D1AEDC5926C504AB7123F598A75F6585FF7BDB23403293CF8A833CA99BB02015", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296238, "uuid": "f38e5f06-f9a0-4628-99fa-f61c4536a9e0", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296238, "uuid": "0e9c9c70-744e-45b5-bf8b-b58b16bcf87f", "value": "98304:LpaSE5HkV/RIxoU/lctRFR89JZZ/KtcQW51e+fTgyu32YMVEmlRWb07bScnBMPQ:LESwkFsd/itRT89JvBQ61ZfTu32NKoUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296238, "uuid": "30167284-975e-4f52-9b0e-68f05c98a1fc", "value": 4876144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296238, "uuid": "0bc8d1ba-0980-477d-8393-748109228e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296238, "uuid": "30693b14-6f46-4cc9-95fa-1fb5e65520af", "value": "046d84994df11aadb9a921340694a084.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23137c98-9ab8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646287619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287619, "uuid": "30a18253-64a9-4e35-99ca-12f15f31c47f", "comment": "Malware payload (Formbook)", "value": "81bffb0bbc51e84966fafeef48c95973", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287619, "uuid": "1312da2a-0ecd-476c-ae13-0e57ba7050ab", "comment": "Malware payload (Formbook)", "value": "7ff47fe8fe08ec46857fd322a3d050d9703593539707d21bd9e365539204c0a8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287619, "uuid": "64cec7f3-6446-4b49-aeb7-66ae50981333", "comment": "Malware payload (Formbook)", "value": "bcee78c36a967aee0089bd77aea3f196766ecd9e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287619, "uuid": "72f83e0e-d1a0-48a5-8581-1e99d7f3be34", "comment": "Malware payload (Formbook)", "value": "b8694d20c09ff365e1d06ebffd039695263e46dc8a8506d44de66dc7c1300d09c19a4ced1022f2954a59e810fe201d5a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287619, "uuid": "99889a90-00d5-4575-9b79-27b8b90882f3", "value": "T1D8542396DC88C85ED8663BB5C1EB32911490F9EC36016E87F8A0F9C84B4B7F514F4AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287619, "uuid": "a6bab8a9-347c-4da9-8d50-b5b765de8ac7", "value": "6144:ssL9Waqtx48Oq3kFVQbDQ/tYp9O5idXLFX5LVZ:sspCy3ADqGp9OIFlVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287619, "uuid": "41053212-361a-4f84-8a8e-9b14ed4e3fbb", "value": 295600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287619, "uuid": "d6786644-d8f1-405a-8fe9-62086a3932bf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287619, "uuid": "df64dd4d-06d8-4f96-b3e2-4185f4ff224b", "value": "3032022NT.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76b5766-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320966, "uuid": "25c78c92-4740-43d4-9367-061f61ec0347", "comment": "Malware payload (Heodo)", "value": "c591023fa31c48fb098a04eb5c6c8efb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320966, "uuid": "9f9e3139-c855-4f56-b891-13959b6aa6d0", "comment": "Malware payload (Heodo)", "value": "802d18abe412e2aeb21048c36691517e94703aca92b18b2d48e611c9ccf48281", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320966, "uuid": "2d7da250-1bb1-4deb-a0f7-a2312b2e5421", "comment": "Malware payload (Heodo)", "value": "a5ce80d54502de223021ae131a4c7c6a5f84e74b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320966, "uuid": "0491905e-56fc-42a9-883a-012f6b5ad657", "comment": "Malware payload (Heodo)", "value": "71355c8c4c646f647449c4ed8ce1028044a9422c3c7fd6d910dec186b100c1e953fec8bd74ab3f60e76f33411197b307", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320966, "uuid": "19c7529e-5551-42ce-98b9-48f2001077a9", "value": "T17023E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320966, "uuid": "c1a179fc-2244-4653-aa11-954e76dc4669", "value": "768:mqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:trVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320966, "uuid": "9a31d8e4-f178-42fb-a57b-f4dbbdce918f", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320966, "uuid": "dcd9d074-bb5f-48f6-9a50-f5a3ea9ec3ba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320966, "uuid": "84b491a9-3130-41e1-b81d-60e78024eb5c", "value": "imedpub.com_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ccc822-9acf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646297774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297774, "uuid": "09f17fed-6928-4819-9a28-f807cccfd1ea", "comment": "Malware payload", "value": "2ff81dab885871e6fce7510b15cc38ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297774, "uuid": "fd5e2b64-8cb3-466d-8af8-e2f5e4347fc9", "comment": "Malware payload", "value": "8106ef3eb81450eaa681bebbbe8671e3fdbaed8568e8d0376bda37c75ad61c02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297774, "uuid": "61c170f1-1e6f-4cdb-8eba-fc0fb6b5ea07", "comment": "Malware payload", "value": "be01ef0b63ac98676dbaaa9a19490990204853bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297774, "uuid": "1b9ddc7d-9cf7-49db-84a4-a564a8eca3e2", "comment": "Malware payload", "value": "84f3ba4f03873b4c47ea549c4e2cbe83b37a678c1a4c896485748cacf1e14c24eef6794567bfe2be776b1e6da6b19a75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297774, "uuid": "44d163a0-1c36-45fe-9341-bb1f3d0c58c5", "value": "T188E20A1722EE7DE2C4BD1678377343C1C72DEE028123D92D69D871698A7E2037A427DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297774, "uuid": "e8edf7f4-c0b4-4ea7-b7f3-f4622a0a6f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297774, "uuid": "b98d83be-406c-47c4-a30d-7e8d19296964", "value": "384:hs/CIpy+PyvybH+zfyhPhv/uKfDJioLjwOtpMKbdlgJmFMUE1J:hHUyUz8fqp3uKd5VlhMUE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297774, "uuid": "99f0d1d6-f012-4650-857b-228ab8fed81b", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297774, "uuid": "1c7505f3-8467-40f3-a962-7b89792af2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297774, "uuid": "3a69c9fe-65e8-470d-b144-18c7bab6e823", "value": "2ff81dab885871e6fce7510b15cc38ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e4f9fe-9aef-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1646311291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646311291, "uuid": "60f7563e-bc53-4700-b2a4-95d552fc1aca", "comment": "Malware payload (NanoCore)", "value": "177ecd729d8052e06d3a18f7cfea1830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646311291, "uuid": "6cb16afd-227b-4cb4-82e4-2dc3f225a299", "comment": "Malware payload (NanoCore)", "value": "8141fae70ffd2918e015e5626af46b24706075a22900abe9c3e9ee753c892f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646311291, "uuid": "39b8b837-9e37-4023-ba22-2a62a638a4b5", "comment": "Malware payload (NanoCore)", "value": "1556d8ff3a520a0bba76e66a660a631a5bbe1fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646311291, "uuid": "b623f939-6ab4-4eb6-a907-c28955f02ef1", "comment": "Malware payload (NanoCore)", "value": "9d2094ea8d080cea6351b6f4642905c650fe024ab72e22fc28fdb9f83b7ecddbbc806a0e44c4252aec9f61d0fcf0f1d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646311291, "uuid": "22281cbb-f3f0-4d1b-bfc5-d9cee004062c", "value": "T1DB73A0A1BE84F629C1262C32DB12DAF5C127BD2BDC609A537CC87F1F7933642951172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646311291, "uuid": "c46383e6-1b11-4ac6-9a30-06bb3e2bae24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646311291, "uuid": "1b705452-4934-4db0-9427-234e73e84c01", "value": "768:9iM2leQV2+CLufHCyiAiUyS9Xxgq+4PiHq0L94CSr0sY6b50PRpOqLO70qo+J:0MRQU+iopiA+bHq0R4Co0s7yj7c0q1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646311291, "uuid": "702e3d67-d299-4faf-bb6b-c84e4321b997", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646311291, "uuid": "4dd33dde-1f64-4dac-a33a-2af5027dcadc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646311291, "uuid": "f3190cff-dc76-404b-ac5a-455503631edd", "value": "177ecd729d8052e06d3a18f7cfea1830.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4054236-9b48-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349790, "uuid": "f9a2ba24-aab7-4443-830d-a81c08f6992f", "comment": "Malware payload (Heodo)", "value": "4f0db38562c32dad1f7235fb32b01acd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349790, "uuid": "743f3ce4-0467-46cb-940e-767212f380bc", "comment": "Malware payload (Heodo)", "value": "81e835188ad8d90f651e07abc11fb87627b135266e333d9642a80ee8b0784639", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349790, "uuid": "32a7780e-6227-44a0-8b4d-60fc6ac064d2", "comment": "Malware payload (Heodo)", "value": "39947bca2d9911bf03dbce979588480cf6a88227", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349790, "uuid": "85305cc0-479e-41d0-a779-bd20bedb35da", "comment": "Malware payload (Heodo)", "value": "73d953f3512974fee92ae55b3010206e7d08f402afb5ec2d5b9a394fd9f2a81cb0a1b304c9e57ea5605b1f4ef003be1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349790, "uuid": "f3960ec6-70ac-44ec-94be-0ce4895ab373", "value": "T1C3D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349790, "uuid": "1cbc2bdd-b224-4675-ac9d-bd39e4b92b50", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349790, "uuid": "b6a5de62-6bdb-4e1b-b455-e815c1dd88db", "value": "12288:J1U8sNY8/z0rYebzwdZCoGEAbcVBLku8w:oq6z0rYcMdZVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349790, "uuid": "27058b70-3f53-4949-97c9-12d8f402e088", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349790, "uuid": "dc4333e3-139f-45bc-aa61-6e2597d6dc0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349790, "uuid": "f1051356-3d4b-4d47-a988-69179fca4cf5", "value": "4f0db38562c32dad1f7235fb32b01acd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7963abd6-9abc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646289482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289482, "uuid": "47f1be5e-0f3f-436b-8e80-44e8e447435a", "comment": "Malware payload (Formbook)", "value": "3ba2feb0f59d0b7999352c0080b2e14d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289482, "uuid": "448122ec-6cee-4f11-b0ae-8bc9e8873ad0", "comment": "Malware payload (Formbook)", "value": "82169fda67a41da589866d3b7de35a7438ea8da40ad68477419748e500266025", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289482, "uuid": "e0fb489a-b348-4785-b923-d445f9761f60", "comment": "Malware payload (Formbook)", "value": "e77bdc6902a12c1a7caca07e783b169b8af92801", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289482, "uuid": "37e6dc17-b44f-4a0e-9bbc-b1ff07ea2e1f", "comment": "Malware payload (Formbook)", "value": "87744f770ec0c48d95463ea8c6741121702fe23b3ffa1275dde77b6e99c7c19ce85e0804e3ac8cdd1f0db82bf5feb282", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289482, "uuid": "d303a5d1-e7dd-4300-a2b1-43f79509f3fb", "value": "T1277423C7FE6169C4291FEA05D959C1232B3A7EC9289F5B68A3749D4C2C13A183E74B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289482, "uuid": "5fa53a8d-75aa-44b9-b381-d5e8ab6da12a", "value": "6144:6wVfBnYbDOzZY7iXC2nJHS3J0Tnepi57FyFX1bWbOBrmgMfwXWRBhVRR2:6U5nYbDEWGLJH6J0oi55k7CfYXC7h2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289482, "uuid": "a6b58cea-e4a2-4909-8755-ecd98f2d3ccd", "value": 337918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289482, "uuid": "d798400b-762e-4cc8-b4a3-d0bf548b9e40", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289482, "uuid": "910f40f6-4dfb-4feb-9cc1-9c6d5c268874", "value": "RFQ BN1068-MSRF-2833.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29f2981-9b3b-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646344151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344151, "uuid": "c8825868-0855-4a1a-b39a-cda844acf49c", "comment": "Malware payload (SnakeKeylogger)", "value": "ead73cfab9c81883bd592d22751a5ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344151, "uuid": "52feea05-d6f9-4d0c-aef7-1b8e4d884d01", "comment": "Malware payload (SnakeKeylogger)", "value": "827d6ccbbb1e40f6227f213627242bb61452b7e5f7827fbd49ca2c81343811fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344151, "uuid": "9915dc67-f3d5-43fe-8cdf-4b0abc7cd905", "comment": "Malware payload (SnakeKeylogger)", "value": "3626c3c9660433b2ee3530363ea8439f047a92b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344151, "uuid": "326af381-42bd-4d08-9545-9f63efa7c2e3", "comment": "Malware payload (SnakeKeylogger)", "value": "92fd002055aaf05586f26ace8bb39f7d0d4b544f5f58ed62995146d91d5c926a249dcd7623eac81da2f4afe707c53e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344151, "uuid": "eeeb0f63-0958-4854-b2ed-8dec66188771", "value": "T17C44126956DBB2E1D2AE1F79FA22E30147A4FDD47887D32E3B01D0AA055B7120B04FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344151, "uuid": "514c0e64-b667-4c2f-ab69-d5b53c73fb76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344151, "uuid": "8dff2cb9-3bcc-426b-a1ff-899ee0af6cfa", "value": "6144:PtvJ/xaqAC4oK92kXzVni3HAKjpNEEji79G:lFxbP4oXkXJyH5G17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646344151, "uuid": "3281aa9b-6e6a-4617-8042-e6d77d823820", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646344151, "uuid": "1b2b997d-2e19-44e0-af34-098e68ee3fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344151, "uuid": "190ff32f-d96c-44c6-b507-a9939f23e601", "value": "bunker forms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2483e8b-9a88-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646267243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267243, "uuid": "ddfffb3f-dc92-40e4-95ae-4f40252c2fa8", "comment": "Malware payload (Heodo)", "value": "f4ed7136691a2e268ccc7a42070803aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267243, "uuid": "d853d06f-cff2-4518-a61a-d5a84bfb229c", "comment": "Malware payload (Heodo)", "value": "8293799537f05ef203f2a915d8d0212295d4ca4f25ac2fc2964a52294145ea6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267243, "uuid": "914d95e8-2202-4e48-b093-ef6aa400c228", "comment": "Malware payload (Heodo)", "value": "83592d26666ac00bb80b1ed4b05a8071f5580918", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267243, "uuid": "425378e4-a497-40f2-bf88-80ae6b3391c6", "comment": "Malware payload (Heodo)", "value": "3ea2e071bc4a0ead9a4c625c1d7141a2a6aaecdf3687fe12d10d3dac49bb18c8b864fbf92821f699bfc0927b7be4a679", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267243, "uuid": "f2697f3e-8440-48dd-a3c9-ac069c9533a6", "value": "T131D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267243, "uuid": "2a1c2de4-651e-4b72-9789-a32efb2922df", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267243, "uuid": "7b093f08-6d4c-45a9-a581-9dfa8099604d", "value": "12288:ZxpNJJJ2NHPoczJYOtIhxf3foRXIa5EPwvA:Zx2gczJYFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646267243, "uuid": "685ab4e3-8b55-4a7c-8bbc-36c327f88230", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646267243, "uuid": "0b8db5e8-0681-467a-8521-4c9db4acf63d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267243, "uuid": "1760c6aa-d968-4b72-8dca-6dc5bcbf33de", "value": "f4ed7136691a2e268ccc7a42070803aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1197131-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298138, "uuid": "49c8fb98-7b49-4992-9b60-2974259e22cc", "comment": "Malware payload (RedLineStealer)", "value": "0b5db692a700c55b6ccdbf2845d42d6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298138, "uuid": "82a91825-c533-4516-904c-e39d0044c6fe", "comment": "Malware payload (RedLineStealer)", "value": "82ea67455512d0deb3830bf6824cd9d54c05f3f7be567baaf0e3ff1c8726a525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298138, "uuid": "ebb6bb86-ee72-4423-80ce-a3d493b0f3a5", "comment": "Malware payload (RedLineStealer)", "value": "01fb08cd86316e7c85b5f1af952a8571858d02b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298138, "uuid": "f0fade87-13c5-4125-8135-4ecbc03099d4", "comment": "Malware payload (RedLineStealer)", "value": "df871ae3556b746b022b837345650bb117a4cf5e7d8d1ff9d8c0efd4429f4cbc26d077ffd662db6b939941380aac8dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298138, "uuid": "d78a6183-6c1b-4bf3-985d-0b4b158d8bb4", "value": "T120A51243E2C4B9C6C89630B3A76641D015F8EDA4E90D3237F95DBADA42F619D11CA3CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298138, "uuid": "e3b5b445-2f14-444f-9cf0-91088c3cf591", "value": "9b8e3dfa141bbaf10a4ceb06a38f2493", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298138, "uuid": "766423d9-1073-4c83-b530-d398e23f312e", "value": "49152:k3332BWQAWj7IxBHMx/dnE+VRVxCAnKuxbxbWtDSGAP7:k3332BWRWXIxmDbfxnxQDSn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298138, "uuid": "e7931f39-f6ec-4eca-bfad-48d1be0e2914", "value": 2084344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298138, "uuid": "f2a29ea8-65e7-4abe-b2ea-f3b58126da11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298138, "uuid": "8fb8252a-6f12-49b2-97b2-23582184a9ed", "value": "0b5db692a700c55b6ccdbf2845d42d6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b71fb0-9aca-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646295628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295628, "uuid": "917d5340-5950-4491-a4a2-84b7153d0484", "comment": "Malware payload (GuLoader)", "value": "63c6e050ad3908ec3954e48c77664ab3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295628, "uuid": "edb3d2af-217c-42af-a3de-0966f07c74c7", "comment": "Malware payload (GuLoader)", "value": "831a4a89617f984bf834ec558f702942c4ded5885d6a949890466629e79258a8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295628, "uuid": "db784e21-4990-42f2-963f-8cee2c629839", "comment": "Malware payload (GuLoader)", "value": "6577cbf5151c9c2e970b906c6f3d11a700d1c01f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295628, "uuid": "54c62412-39ee-4c00-b0ba-a6b78bb0ea7f", "comment": "Malware payload (GuLoader)", "value": "6c2a84f41ac0295804237da04333dce0f460276d758e4bcf6260357d134e862daa00f96435688c46376c78a2f03bf9e3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295628, "uuid": "45371555-b7c4-4a62-93d5-d496b40b9c6a", "value": "T15D333A2D5A05CA6D3E8FD3FDB5631A5AC190C3113EE0A10B89DF528F540F5AEB7E4286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295628, "uuid": "7aae78cc-6e63-439d-84b8-35e44b937b29", "value": "768:kAQJ3nW6+JBVasulwKhL9NVur+h8GpI1A1DaQxUw4SOjSVWpIaw1yMz:kHmHJBVUDurIjW+pLVvVIIaQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295628, "uuid": "1281df0d-9c5a-4aac-bc0f-8fa6edb42aa4", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295628, "uuid": "491b69de-646d-40dd-ac8a-8cb6620d8012", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295628, "uuid": "2cee05bf-b074-49ca-add8-d4322f1d3d32", "value": "Artisan_20220303,pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5772342-9aeb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646309849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309849, "uuid": "cfaa6b18-2dfe-47fa-89e2-aaa5ed4dc36c", "comment": "Malware payload", "value": "6fbaf9862dd80ba4003c9f9a5c1873f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309849, "uuid": "b6503ade-04ea-4ace-b650-b2144b83eb62", "comment": "Malware payload", "value": "833a608ccf32924d07a9d75c0f47995f0698578227157316d4a5a6ee71b50fa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309849, "uuid": "9dd74036-4527-4549-9858-6c4ec0ec0db3", "comment": "Malware payload", "value": "89ccbed3ff3359205da33cb1ed1f39dda3b91495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309849, "uuid": "708a304a-ed6a-4b99-9005-f88ca81b8087", "comment": "Malware payload", "value": "72cead57d852b50b41f2b891ffe111a42476d8da96b28f5c1714c986c3425d26a30820d4a81559cb1bca563b31106c84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309849, "uuid": "c5e87f59-3d55-40cc-9d7d-f77eff844d4a", "value": "T1A2B34AD211D3426FC944F6F1A69D4984D6CF6E22389E8FDB900D347ECC39AA6037AD19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309849, "uuid": "5edcb157-d54f-477f-81cc-2b01f3bc99c7", "value": "1f1040cf14d469df6f954e38f3f02cb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309849, "uuid": "59383679-1430-49fc-bef7-633715525f52", "value": "3072:pRejuS+WFrcM47FbqjSJ/UzJcAvvOq26r:7ejuSDcn7FbISJ/UzWA3Oq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646309849, "uuid": "7dcf09b9-3458-4883-8e4e-6ddf76342276", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646309849, "uuid": "b235063b-3dc7-4a54-b5fe-56fe57c349eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309849, "uuid": "a552df29-4102-4d9b-890a-fdbf3769d179", "value": "SecuriteInfo.com.Variant.Midie.108466.18242.28660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e8083f-9aca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295296, "uuid": "69fb439f-ef2b-47b6-9564-b381a61a3438", "comment": "Malware payload (Heodo)", "value": "d4a64fdb76898e102f73afe154bfb34e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295296, "uuid": "36258464-92a1-45c2-9288-566498dbf37b", "comment": "Malware payload (Heodo)", "value": "848ecbc323b0b55b06e16ac8c5f8df04f393872c46cb4c1ebe2c069b1527db80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295296, "uuid": "c7cb6c29-e608-4343-a68a-71c7fd4d02d8", "comment": "Malware payload (Heodo)", "value": "34ac95f905ee84600c8f35356c1cd886df413a92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295296, "uuid": "591f7935-d2fb-4628-a535-c69a58bb0c53", "comment": "Malware payload (Heodo)", "value": "20dcf4aadde30d15c952c3af31e9696573ac683c88ec652bcbf3bee56bd6b61e248efa475476d2969f6d1db3d659dc86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295296, "uuid": "5c510bc5-9558-46bf-8cfd-c5e0256a3198", "value": "T173D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295296, "uuid": "24f0aa09-1990-40c6-b62a-99dc248d7bb7", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295296, "uuid": "ac7851bf-a022-4ead-a47b-af6e4f17443c", "value": "12288:ZxpNJJJ2NHPoczJwOtIhxf3foRXIa5EPwvA:Zx2gczJwFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295296, "uuid": "fdeb5e9f-a454-480d-9171-0e58ee71aa49", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295296, "uuid": "2bbc3358-aeb6-4278-9179-b25e046ef0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295296, "uuid": "86985e24-07ed-445c-af02-57e3dd508381", "value": "d4a64fdb76898e102f73afe154bfb34e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b946f2-9aa8-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1646280748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280748, "uuid": "3509294a-bf6a-4374-a448-dead16f167e1", "comment": "Malware payload (Tofsee)", "value": "1324598067622176349860f4e8d68aa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280748, "uuid": "5183f3c0-57b5-448b-9c54-1cd6f7a7b3b4", "comment": "Malware payload (Tofsee)", "value": "84cc4707c97905c1082d9eb31dd7d995e04955506b9275b6c4bfd19683150430", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280748, "uuid": "6d8c50e0-f69d-425b-ac52-32a452cafb25", "comment": "Malware payload (Tofsee)", "value": "65fb2bfe5cb2ba7093d45e0d24d32f557582f904", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280748, "uuid": "b5917faa-e84f-4e8b-a2c0-122e866c9abe", "comment": "Malware payload (Tofsee)", "value": "eba2403d3c22d2105852d896f687f88a48679472a29627bfe6f3c26655c523094978c5137a08169e89de150786cf615a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280748, "uuid": "bc1f2d65-4f19-4665-ae5e-cc8b3d9c3465", "value": "T1AD34C0D57783D033C40775308435CF90597AAC22CBA56D473BB86A7E9E343E2667B24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280748, "uuid": "894f9317-5d58-4618-b078-2f0fce8e0abd", "value": "eabb194c814da30562c2ce7e427fcafb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280748, "uuid": "8ee79cfb-a95d-4373-b76c-c78677e8e88e", "value": "3072:dJOic3zib1QCKM365y3PMTka5SVggjcGkNIVqIpRuv:6ziuCKf5oPMTo7ITsq0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646280748, "uuid": "01b833f2-e5ac-4c16-b1f8-b9412b86ada2", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646280748, "uuid": "35f898d1-d53c-4c88-85f2-2ceed2d3e361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280748, "uuid": "2867b7e0-e739-499c-ab4b-8d03e499f425", "value": "1324598067622176349860f4e8d68aa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822c2d81-9b28-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646335882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "0b59b294-adf9-4de0-b2ff-6c9f58e15856", "comment": "Malware payload (Heodo)", "value": "41b286b943d77d14c6be56174c81a824", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "be5cba75-54ea-4f35-9308-95f44375e646", "comment": "Malware payload (Heodo)", "value": "8551180c465aa5b9a4f9056a4e539513f0d47e1c59167ddea57bea9e73d1d2b9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "68cac675-4ccb-4944-adaa-35c69c0eff40", "comment": "Malware payload (Heodo)", "value": "c3879605ac4bffb5c02b1066ae6bb13d63daac0e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "01241b3f-898f-4da8-ba0a-a82214ff6ef7", "comment": "Malware payload (Heodo)", "value": "69b538d4c7985341ea9e048c8a6fa4aa553a2e4656979c230bb7c140587a5effbaf8badff2bc4c86e6f48bef8f3bbc40", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "6bbf09a0-7488-4335-8aed-c75437944771", "value": "T19ED47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "7bfa8eb6-f435-48eb-9079-be6d1172359b", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "47dfce15-bd14-4d56-8b50-f587923ea07d", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLVCjzhmD/bwb1r8Hc:Bg4IqjYTV20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646335882, "uuid": "4c65b1f0-e48d-4642-a05e-a5ef28efd42f", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646335882, "uuid": "615f0238-66be-4ba4-b795-b376f775720b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "8ea53310-8e19-4923-9b37-b7def1065a4c", "value": "emotet_exe_e4_8551180c465aa5b9a4f9056a4e539513f0d47e1c59167ddea57bea9e73d1d2b9_2022-03-03__193116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7986230-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646295223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295223, "uuid": "4564c1bf-8cd5-4d53-8ea5-1c3af67b8eb4", "comment": "Malware payload (RedLineStealer)", "value": "cb899ff8a7ff2c6d7660f8a4b36f8ebf", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295223, "uuid": "0c3d0845-155f-44bb-b035-8bc58a7294d6", "comment": "Malware payload (RedLineStealer)", "value": "85642cbbaf1a8eee9d60dea7bd340f84197485d5189ac6188e722b082008b2b9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295223, "uuid": "c5c2777b-0cd8-4236-a7c8-973a15855473", "comment": "Malware payload (RedLineStealer)", "value": "ed3249d6aefcdabb71feff44494ea230ff33fa9b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295223, "uuid": "ff315207-8ee0-421b-9da8-5bac001366dd", "comment": "Malware payload (RedLineStealer)", "value": "5fff177102fd8b45e7ab079eb751fcb0cbb7d528e1b1a98b3df6b7dd3fcc8b77652818387432b20a9791c8203adef7b7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295223, "uuid": "d136c9e5-c07d-4155-8cda-62502265684d", "value": "T1ED51EA2CCF990718D6B7C635F8AE6215E96E7853E62E8F5D0CC12288505D106F1A6F1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295223, "uuid": "e5c5907e-6d6a-4b6e-a6ad-a54d3c2f5cc6", "value": "24:8AntnHYVKVWFe/CWMpHzwIXRQpmWWpTMITjrQDlDwldA9Fe/E4I0aHA+:8wHaNTwIXR0mX4eEDxwwFgIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295223, "uuid": "1a65b969-b1da-4a36-9955-4c9a8f51998a", "value": 2556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295223, "uuid": "ae2ce3e3-f31a-457a-90a6-87522ad40284", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295223, "uuid": "370c6c0c-c1cf-417b-aa5e-d50e4a64a0e8", "value": "Payment.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe59c93-9b26-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646335093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335093, "uuid": "584046d7-914c-4c3c-a418-5750b0c96b13", "comment": "Malware payload (Heodo)", "value": "60874e7a56bc38c2fe03f73d302d7059", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335093, "uuid": "02d15a1b-8741-48c9-bb58-a8f49132f731", "comment": "Malware payload (Heodo)", "value": "857a7ea4144d6a06c65e88fa4620167ddfa6c78b3b42a352d92a851fe8804d32", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335093, "uuid": "ab542b5e-113f-4897-9cc3-dea695c6afc5", "comment": "Malware payload (Heodo)", "value": "3462f12276a1ee6b0e76073afc5eed56f1577232", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335093, "uuid": "30470eec-a379-4bc8-91da-1c9beebbafc4", "comment": "Malware payload (Heodo)", "value": "736af1363f98564369b6e61caf1fc83710c19d543fd4a59136eb0a7fe0d7c7f6bef4672746e3c1bf41312eb9b9c5e91f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335093, "uuid": "8a0c1797-f07e-4914-9c31-fab1e287e391", "value": "T16A353942BA48C5BDF04E08B9181EAA69667E1C447B3296D7338C7FDDBB319F90832517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335093, "uuid": "b2ab972a-7704-41da-bb45-06833d9379cf", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335093, "uuid": "466abbbd-11aa-4611-8910-59c1d9e0e364", "value": "12288:C4rjnpAeev7HmOsVUCfbWierRcDFtLlirkfIcsMEPe6MpPfXxiDjM+R:5rjpAbv7HmOsiR1cDFXiQfNsUPv4DjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646335093, "uuid": "3766422b-2151-4a23-8a5b-c2c0afecb6db", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646335093, "uuid": "167f9a4f-e137-4315-8591-6c33a4e36244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335093, "uuid": "f22a7157-30db-49bc-a075-a5acc672ba59", "value": "emotet.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301f9597-9ab7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646287211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287211, "uuid": "e46ce7c4-e03d-4c5d-97e5-3a81ebcbf408", "comment": "Malware payload (Loki)", "value": "3cefd5a284edb7483895cb6d4bebd6dd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287211, "uuid": "dc9154ad-be0d-4fb2-841a-28d9718c5a15", "comment": "Malware payload (Loki)", "value": "858d2228753506ee1a04c27a0136d8981939826057c291f44fd9085728efd75e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287211, "uuid": "b8c6289b-d14f-43b7-8a9c-c699982594d1", "comment": "Malware payload (Loki)", "value": "9025e40488697165da46df2ea6392a71b221d30f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287211, "uuid": "33b62c00-6583-4f38-b145-e36c14747c62", "comment": "Malware payload (Loki)", "value": "653dad3c0348b98abccd6872765cd5bc9c0875b9af59461e996efd13c5ad8364a464e5e788a5ccfdb9825e8640e9460a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287211, "uuid": "32884466-5854-4218-baad-176bcc00b2a1", "value": "T1B7041247A412FC61C962A87CC5269015D280BA0CD4B5C10DA670A3FFBBE92DF5F97B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287211, "uuid": "320a8f07-6c54-4750-8f2a-23532fe27bc2", "value": "3072:xTFYRDyEsfM3jQ29jH2tYiUiL4z3o5q1mTBOQvqmL7VaQutBguM/xSVFW6h+g1n5:xTeRmoDNMRUiLqx1gB1TaBI9/2x1ngMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287211, "uuid": "f41f1bab-8ec6-471c-8602-61723dbddfc0", "value": 184356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287211, "uuid": "1fe8ad4a-5536-4c83-862c-90d42caa3602", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287211, "uuid": "7468e1c1-16eb-4bb1-a09d-e944c01ffe68", "value": "FQR4252Q.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd90f87c-9b48-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349833, "uuid": "d915ec04-f026-415e-936e-2c823e2e0f6a", "comment": "Malware payload (Heodo)", "value": "e04d7760612b200f562ce723722c4189", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349833, "uuid": "241a642a-89bc-40de-98d0-97677ecbc886", "comment": "Malware payload (Heodo)", "value": "85b6837000d6966d90b91158d3f3c98a292daef049b1639628a19f05b4ef4fde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349833, "uuid": "d3191c9e-be9b-4ec2-b583-295a051250d2", "comment": "Malware payload (Heodo)", "value": "678a404cdb76924b95f01221ff399a5e7f2a5536", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349833, "uuid": "10be3a40-a0b6-441f-90fd-b1837a0b1d24", "comment": "Malware payload (Heodo)", "value": "c1252895ec867527c3566ba73ea134c5c3b5642eff505379952c511b1a3651e210bcea72420bbe38d2a2c8e891b1953a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349833, "uuid": "2170c168-a1ae-45ad-af3b-cedc953db133", "value": "T1F6D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349833, "uuid": "45204296-f66d-4a28-af16-2ade14d9301c", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349833, "uuid": "c5d5779a-49e4-409e-a54e-e525bc11011e", "value": "12288:J1U8sNY8/z0rYebzwd9CoGEAbcVBLku8w:oq6z0rYcMd9VGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349833, "uuid": "24a96030-017c-4ba9-9c38-f8c7a6a8c8f8", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349833, "uuid": "a796b618-6d83-48a4-86c4-09b6fdf55b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349833, "uuid": "3f11b39d-a947-49a9-ae99-d90aa3b87fbb", "value": "e04d7760612b200f562ce723722c4189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99dc6710-9b1c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646330768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330768, "uuid": "decaa498-399e-4d38-9578-588d6f5a8ca3", "comment": "Malware payload (Mirai)", "value": "17a178bdf7f7d515a33ed7c3b0760239", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330768, "uuid": "7e842655-9f76-47bf-a7b6-69c746869a27", "comment": "Malware payload (Mirai)", "value": "85d150bfc7da5e06fe303fd0fc546d3009f0a16248c1b62f770afd5e16530f89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330768, "uuid": "095134e4-40be-4883-a58a-c4afb243151b", "comment": "Malware payload (Mirai)", "value": "a1f40b539da745eefca38e71d23ac9c3cc4c04f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330768, "uuid": "874a2e96-a4de-4fec-90ef-db866bc4bf3a", "comment": "Malware payload (Mirai)", "value": "ac761437d5a3a1faf05469b7dcdba657f9ac4d00a071ec3bf6403cf549d87aaf75f504bf887fa8d31cea3497a9933509", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330768, "uuid": "76dfd1c9-4144-4897-b275-a6d83e69ae89", "value": "T18EC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330768, "uuid": "4075ed4d-0891-4f7c-abe3-401ee41b779c", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBejEdWfRZrmW+IFj:Ted0W0MZQHLd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646330768, "uuid": "9ce21fa5-425f-49db-afef-77a4b1bb5753", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646330768, "uuid": "fe76d9b6-7012-4210-8b6f-b7c5d22053c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330768, "uuid": "abdd1094-0ddd-468c-a685-7f9a44d8f702", "value": "17a178bdf7f7d515a33ed7c3b0760239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37667b27-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646294955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294955, "uuid": "60ab326b-b994-4e55-896b-87a5ba435085", "comment": "Malware payload (AgentTesla)", "value": "71b0411a804b8dd35afcfaf93ab1fab1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294955, "uuid": "2058d4b5-128b-4968-a4df-29fa7b1ded3b", "comment": "Malware payload (AgentTesla)", "value": "867e4de82fdd0954cdbc7b15ccd77a476aaddbcc9c8dfdfc67bf8030de8b9c7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294955, "uuid": "f5235cd3-4bda-47ac-95b4-dd57499f10b3", "comment": "Malware payload (AgentTesla)", "value": "e10c47c7a662fa6b1a5cc1394653b4316b6c8581", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294955, "uuid": "6e40713e-0179-4007-abd6-59398d599ec1", "comment": "Malware payload (AgentTesla)", "value": "17a7220e4448ece972edd89c93d9af1a6537fa8a98ae0d8b07748359c8a6c5612bfd2323980ad45fcf7cd6c7003c0290", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294955, "uuid": "0ede6d60-b56b-4605-87f3-bfa7e0e81893", "value": "T13415D00438E68034F97A8BB1DAC4E7F18B6DF315E189B0F664005E257646BBE8D45EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294955, "uuid": "db5a065b-6d6f-496a-a1fb-0e5acb9685f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294955, "uuid": "2bcbcd9a-6f89-436a-8464-ce05a98d4ddb", "value": "24576:EA3R6Al5O/f1wQsQUgeYgMgSIexzGoPdZSaB9OGiIftSRgB:l3R6Al5O/fHsQUwzIexzGoPdZdBQ1RgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294955, "uuid": "f80e617f-f114-412d-aea7-fc8e28dc3c34", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294955, "uuid": "ec49cc62-038b-4c52-84cb-e6bafdf35a1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294955, "uuid": "4113b579-d599-4cb7-8531-1c6e8231d32f", "value": "DHL AWB_032675620 - Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25c1597-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320984, "uuid": "a48aedf4-08b3-43c3-ae40-129642da6f6c", "comment": "Malware payload (Heodo)", "value": "2835d86e421547e321cf2b4e768fe834", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320984, "uuid": "17a3705e-8b91-43b4-bab3-3ab5b29ab06d", "comment": "Malware payload (Heodo)", "value": "8b0ebbd622d2c829505372261558a756d697816b817462a3caaa8b8e0f707e19", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320984, "uuid": "fad041bf-f136-4e4b-ab0d-32a3b9767718", "comment": "Malware payload (Heodo)", "value": "0957ebb3475cb8c2570d071c600f2e74b6b8ab57", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320984, "uuid": "1ad421d0-ef16-459a-b791-2807eece3502", "comment": "Malware payload (Heodo)", "value": "c6a6e1f817085cc449c825faf0c1d46a0f033f9e0e3eb6dc833557c9b9f4c31c4a45b4d903eceda558e970a4bb80c066", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320984, "uuid": "aeb5e511-faea-4b3b-9901-d485f3940a58", "value": "T1C523E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320984, "uuid": "eb36bb13-f63f-4766-a24b-ee68e79e5c59", "value": "768:O/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:O/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320984, "uuid": "c6dcecc7-6dd2-43f3-9995-db75274152e9", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320984, "uuid": "6ee0dd5f-fcc1-495b-954e-f122ae1e41da", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320984, "uuid": "2d28b929-1ab4-45ad-aec1-da9d395feda8", "value": "OMICS Group_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0af1ab-9b1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646329802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329802, "uuid": "ff58f5dd-e86f-4e1e-99bc-4b22054506e8", "comment": "Malware payload (Mirai)", "value": "3487727c127ed81790a20f94e203491f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329802, "uuid": "501379f9-dbd2-4f21-ad5d-ee0b0c5ad51c", "comment": "Malware payload (Mirai)", "value": "8b74ea9bd2badecdfce7fb0732e2e7084990c174306c959969f8fa94f8ad2cc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329802, "uuid": "dd9be01e-ba97-4fad-a7e5-3c7f2873800d", "comment": "Malware payload (Mirai)", "value": "0654a2be085ed4117fac119b7daf04c5b5dbf5e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329802, "uuid": "bfe6f622-6922-48c6-b4b4-5a9e0719e252", "comment": "Malware payload (Mirai)", "value": "32a16f835fe9909107baa59975126dcd8fff656b48373c37183c4098e8977b52421d95193651f5f03b11bd67ebd70203", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329802, "uuid": "da199f4f-f59e-4db9-a700-a232075d6870", "value": "T1E1833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329802, "uuid": "d46df97e-8f3f-40a6-ac4c-611f77058aba", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8L/WDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YL2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329802, "uuid": "d733629f-0260-4652-b359-de73a0a88622", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329802, "uuid": "57d2fbbf-636f-4b97-b586-3385111ae31d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329802, "uuid": "d606c986-a861-494e-924f-cfe885e4e03d", "value": "3487727c127ed81790a20f94e203491f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54062e28-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "d33aaaab-555b-47d1-9568-b7abf62bc6cb", "comment": "Malware payload (Heodo)", "value": "eed6e63ba3da6e8e68e52be3b72dda9d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "6cb08a26-c8e6-4149-8c79-dc8d4de43cf2", "comment": "Malware payload (Heodo)", "value": "8be4510ca6e491062d1a851450db185d88aa8d7a55526f9ebef49fd52a3804d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "84e3c534-0439-44c2-8b5f-f9c62c2f4be6", "comment": "Malware payload (Heodo)", "value": "c7314e8bd61e3887f7bf0bc017721fb2652cef0c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "e524f6de-46e3-4397-abbf-9e08eac25bcd", "comment": "Malware payload (Heodo)", "value": "08beb368d13787039647e1ae60dd1b2c799d8039aefedb23ebb1d54cc1e2c60002906efecdae72c0ced980788200e40b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "1a0f6f7b-1bb3-4cde-bf86-3695f5da81f2", "value": "T12DD41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "b97fcea7-99a7-45e0-bf44-9ad6af6295f8", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "0d260302-9a8f-4a47-871e-e49b8685d32d", "value": "12288:ZxpNJJJ2NHPoczJkOtIhxf3foRXIa5EPwvA:Zx2gczJkFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265797, "uuid": "2c84f1e4-d0f8-4abb-b7d4-9656d70f4857", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265797, "uuid": "630bd017-a356-4137-b715-ba1bbb06d360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "282bf15d-5d81-4d1b-bca5-7f6db49a89f0", "value": "emotet_exe_e5_8be4510ca6e491062d1a851450db185d88aa8d7a55526f9ebef49fd52a3804d4_2022-03-03__000305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9404f55a-9b12-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646326463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326463, "uuid": "caf270fd-32e6-43ab-b89a-787ed8103824", "comment": "Malware payload (Mirai)", "value": "8967089be2d9014a6040382c0e0909ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326463, "uuid": "1c0e00d6-fdaa-4c56-9db6-fb72638b4d07", "comment": "Malware payload (Mirai)", "value": "8c948b750fceab46b6c9e59fc050022c3dca17dddec3efebbc27fb9f0b1f56b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326463, "uuid": "7a9b4304-9fe5-49d3-b4dd-80fcef91986a", "comment": "Malware payload (Mirai)", "value": "94668727c67379682ea5495182b4474de76bf1d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326463, "uuid": "3e3d5761-4777-4af2-9bbb-4c0aa10b4776", "comment": "Malware payload (Mirai)", "value": "b818f2d11779a527a5b2799a86d69da20767b1f7621bcf9e0a0268592726867ebf1f83ef7b85774d881929c899cb51a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326463, "uuid": "75327381-941b-4262-9d7b-eb65a2b41cab", "value": "T186C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326463, "uuid": "f9f7b385-7b81-4b60-8867-eb2bd8f2a1da", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epx+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EL+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646326463, "uuid": "fcc95682-48bf-4317-b01d-5d4222e85234", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646326463, "uuid": "b0116eb7-4ddd-4a69-b5a0-09f69532d9fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326463, "uuid": "3c5628af-55dd-4b61-a69b-230bf2f6b10d", "value": "8967089be2d9014a6040382c0e0909ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2378e57c-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646300505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300505, "uuid": "01791150-5f7f-4535-8f9d-d0cb78ac0ba1", "comment": "Malware payload (SnakeKeylogger)", "value": "ee01e203d81a7ae130b25580bfc4066c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300505, "uuid": "fe112585-a356-430a-8550-824410173fc1", "comment": "Malware payload (SnakeKeylogger)", "value": "8cac1e4c388a3fa931f8dbec7aa555bddf1880cea74bd1750e8a386e7becac70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300505, "uuid": "7193dd44-50dc-46d3-bffb-5bb6b7626f6a", "comment": "Malware payload (SnakeKeylogger)", "value": "a42bb8f0d76c0ab0b0a7d6f1158f1097d34d0667", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300505, "uuid": "41fb981e-2ca3-4ffd-aa6d-ecbc8b555e63", "comment": "Malware payload (SnakeKeylogger)", "value": "571a4093a134f714947d1c5164fdfe5c864e4c59175d71e392e8ea09e7a59b4f3c73bd2efaa475330f2f10f4ba1da05c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300505, "uuid": "c100886e-b027-4c5f-a68b-270409004e8c", "value": "T15E7390A2BE84F669C1262C32DB12DAF5C127BD27C86099577CC87F5F7933642904172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300505, "uuid": "36d493b7-052e-4666-9056-6b7f1b812510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300505, "uuid": "b2864806-6aaf-478a-85c5-0ac3c9803c83", "value": "1536:6bFjrQU+iopiA+bHq0R4Co0s7yj7c0q1L:6b/YzCo8/c0q1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300505, "uuid": "e862be42-af8c-4eb5-b850-46adf4b50ff0", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300505, "uuid": "e4381a02-ae8b-43c1-8e31-ec9587aad43f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300505, "uuid": "67253ef6-14b4-470e-9c7a-12336c239ba1", "value": "ee01e203d81a7ae130b25580bfc4066c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17cbcf8-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646300421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300421, "uuid": "9c5325d7-9d5b-47cf-80da-61348d748389", "comment": "Malware payload (CoinMiner)", "value": "592be4a2711c9dbf80c35dfe031c7bd3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300421, "uuid": "48dda8d3-c95b-40b8-ac93-7b7d3bdc3c90", "comment": "Malware payload (CoinMiner)", "value": "8d28f3c7f370b5d1bf1868e5de0e16d380ca93d583ca74c45fae83ba24f9c8aa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300421, "uuid": "1f2e37ee-8a68-45fb-8b0e-a4b101c5f8b0", "comment": "Malware payload (CoinMiner)", "value": "194d80f4964b9067c42878665e48a316908ea1b1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300421, "uuid": "df0de790-eceb-4088-ad81-b9aa6fcbfb8c", "comment": "Malware payload (CoinMiner)", "value": "1c2c4905040130263667b2feac78ca62237a9a847e93d577c822f2cc16b6bdde4775dcf0e3de7c1ddb2e56816e60009e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300421, "uuid": "fa7a98e8-8a59-4374-b861-ab9a2026f186", "value": "T19F26338D29C85122F9B647BF09E681B39535B0A01731D7DA20E7E67C6F5A4E07278F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300421, "uuid": "fb8ce6b2-b0ce-4866-903e-8f5dfd954386", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300421, "uuid": "d8a9aa5a-51d2-42a7-af35-d0116bfa7a1d", "value": "98304:IbekDKvsVxv6yOabnyA73DS7P5GfSI0qcJxbhb/qU8P7S:Ib1MsVxyyFbnyA73DS7P5GfSI65yL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300421, "uuid": "0221bc1e-a145-490a-b5bd-f63e47f5575c", "value": 4797440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300421, "uuid": "63cb4633-9489-4f45-8ae9-e41b832e3e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300421, "uuid": "046a6e94-1706-4bb1-a6ae-507df5fe2ded", "value": "592be4a2711c9dbf80c35dfe031c7bd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26481b1b-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (1ms0rryMiner)", "timestamp": 1646296644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296644, "uuid": "538c3c67-8e51-406d-81ab-0873ac8243d9", "comment": "Malware payload (1ms0rryMiner)", "value": "1938fdc1b7d5848c309d44360fd3273b", "object_relation": "md5", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296644, "uuid": "71bb72ff-fc2a-4789-8561-e9cc1ef8fa8e", "comment": "Malware payload (1ms0rryMiner)", "value": "8d969f9014e5f4c7d2385b96c8a00870e634d271106cb6e684183e012e56aa8e", "object_relation": "sha256", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296644, "uuid": "d820a852-fd72-4cde-a547-98466e8781ff", "comment": "Malware payload (1ms0rryMiner)", "value": "0729e7430fc078f1245aa9be8aa5701f5abe7a27", "object_relation": "sha1", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296644, "uuid": "2e8c1893-654c-45f8-ba84-05e94cf095ef", "comment": "Malware payload (1ms0rryMiner)", "value": "a1fb70c72856d2bf6d706987b38024d41f381ad33bb6c9b3bd4a366607c0624fa378471e227cf403b6eef0a5ab0c4fea", "object_relation": "sha3-384", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296644, "uuid": "b6d2dcb6-50be-480e-87ad-01b645f692d8", "value": "T162D5339B08887719FC2716BFEA1B4F4650354D3BF400790E60CB7AA9554D29CFE6E38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296644, "uuid": "b591143d-0366-40fd-a923-660ab0cd3fa2", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296644, "uuid": "07c18690-796d-475d-aad0-2da8f3300994", "value": "49152:iLafGDO8m5xjQYxOtsviUHoLHGDw656xCeJzO4FiNVQmgAjWBp:mtCmY+Kv3Dw6uO4c8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296644, "uuid": "c25feb05-dc42-4325-968d-e1bc776f38c6", "value": 2876928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296644, "uuid": "f102ab3c-f5c3-4a5a-8756-02694f853b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296644, "uuid": "5ec27cc6-ff6c-46cf-96a8-035e370db9c1", "value": "1938fdc1b7d5848c309d44360fd3273b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7f7234-9ab1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646284741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646284741, "uuid": "a5e969aa-1a6a-49a9-86d1-5c8efdd48273", "comment": "Malware payload (Heodo)", "value": "be4932baf044432c3265d0324f477f33", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646284741, "uuid": "83816ab2-25a4-4d17-9233-e1065e6c5171", "comment": "Malware payload (Heodo)", "value": "8dc8df0fcd63c11ea2bc172945b4fcc5fedfdd0b912e791bdfd9cd47ce64c33a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646284741, "uuid": "fd2d752f-8999-4f0c-be70-a79f6c21517e", "comment": "Malware payload (Heodo)", "value": "784496948cf1064bca61a3affad4dcfc3ab23fad", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646284741, "uuid": "f39dd8d0-c857-4e80-abcd-e40fe350f3e1", "comment": "Malware payload (Heodo)", "value": "597deec1413a1b2ccdc5351ee28963a8511056309bacf23d8fa7858fc6e52b2d84fcef0125de9631799bf0f31beb5a6f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646284741, "uuid": "392bbb00-181c-41a7-a499-fbfb764f21c0", "value": "T10093025E932E44BADBF60034B10C95D76E0F9D070009E98904E5B69A5F7A5DA4F2ECFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646284741, "uuid": "d1868b98-cd00-405a-b12b-6c8885ee18b1", "value": "1536:BNrCX2N5nyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xX0sw:B142byVEoBo6hKb4llGsQjbxBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646284741, "uuid": "69beeac2-6cfa-414f-93bd-9171901d522a", "value": 93381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646284741, "uuid": "e876bd10-5c9c-426f-9482-446c826c32d5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646284741, "uuid": "8fdc1cce-4f6d-4e82-9d34-71a47146f344", "value": "Important COVID-19 Vaccine Information.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1545caaf-9ab4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646285878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285878, "uuid": "7b81cc3f-fe2f-41bb-aa55-6ee3c51e46a4", "comment": "Malware payload", "value": "4e37cb17a7683b385680719f2eb0db20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285878, "uuid": "8aad5bd7-837d-44ad-9776-378911f224fd", "comment": "Malware payload", "value": "8e604b70dd6ca05df996f71508ba0c06b89da8c0107b789076617a8664ba4e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285878, "uuid": "9830d476-7eeb-4387-88c0-c334198e8969", "comment": "Malware payload", "value": "b5c564414d7c01334de373095dc77b400866fce9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285878, "uuid": "c14ab88e-2e26-499f-a016-c3fada11615a", "comment": "Malware payload", "value": "1c60738a04fd6e6af3a558edbfc174435f9cf4b6363ba08e9ab8213db745eb52412023afed2695b3a110f057868bf86d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285878, "uuid": "440f16d2-613a-4675-9cc7-cd1bd67536a1", "value": "T182252340F6E70BF7F6A2057502AA22AFE6326225A37065CFC7CD7D0655A39C48C781ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285878, "uuid": "4a7d5723-9451-4a3d-907c-d434fe0cb58d", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285878, "uuid": "2db4fdbf-9958-4d32-b65b-99353f81b97c", "value": "24576:OcvkTOYa160874gky9k53Axm0LxmG4T/6m0LXv1MFMJ60:JvkTl8BPcm0LYGY0LXdjU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646285878, "uuid": "d33b4778-26d2-43c1-9d63-79e047bfb296", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646285878, "uuid": "e3903758-9e4b-4058-aa29-c428a4f7675a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285878, "uuid": "6d152af2-b8ff-4970-9e30-a44b71d889f7", "value": "kill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451f4435-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298843, "uuid": "fb13384c-528b-4d6b-b769-f4fb0aa61099", "comment": "Malware payload (Heodo)", "value": "4968e722b728f58e04b10c58d4042bb1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298843, "uuid": "6da37221-521e-4fd1-8af0-88ec935c82aa", "comment": "Malware payload (Heodo)", "value": "8fa319ee89091c4c0f2a9f669067dd18c3d64ca0ba005b928a982d810fe90252", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298843, "uuid": "29d048af-f4d8-4321-b2c2-fd115ef49fba", "comment": "Malware payload (Heodo)", "value": "95dc41ef6304c86974f97a8dd0fff0be6d09a693", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298843, "uuid": "aaf3417c-96fc-4fa0-b6d2-681fb4563240", "comment": "Malware payload (Heodo)", "value": "65174454969240c9d33e7aaeddeac506ebabed7597e47a5e88c09ed74a89c1ac830f5161fb57eecfb6deaf7655cbfb78", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298843, "uuid": "dfdcb549-23e3-4c5f-9dd4-9c1cb54e8efe", "value": "T1E723D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298843, "uuid": "a2004d37-28a4-49b7-9114-15abce11b958", "value": "768:eeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:VoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298843, "uuid": "eddbf35d-2fee-48e6-b57a-39bca897157b", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298843, "uuid": "6d493b82-141b-4a63-8e7c-f3fd79140ab8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298843, "uuid": "fafbbd05-45d0-446d-874c-6623e53a9a81", "value": "7921757239205355684.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be688838-9b1b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646330400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330400, "uuid": "2cfd1f9c-0510-4c0a-890e-14be0a2eb7b9", "comment": "Malware payload (Heodo)", "value": "3333b200a2d5efc36359d587f2a15ee5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330400, "uuid": "bfe540ad-d8a8-434f-9546-44e4bfacb367", "comment": "Malware payload (Heodo)", "value": "8fa565da622f4e621860ce99737df48e8c250ba789941560a71d03560c809288", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330400, "uuid": "c68f81c7-b4a2-42b0-8f6f-28cc60ef2d42", "comment": "Malware payload (Heodo)", "value": "fea319c9c62a0ed08df7dfd8f55976a602a6a458", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330400, "uuid": "4dc159de-2fb2-4d70-bd9b-a16d904871a0", "comment": "Malware payload (Heodo)", "value": "3e4ac0f1a2468483d8c990a64c61bfd050e201238e64a19785adc157e5c767fb1004390f057d8917df715cd1c0a5d497", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330400, "uuid": "03cb0e89-924b-4a09-b114-45e0be635f71", "value": "T10F23E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330400, "uuid": "838cfc2d-e04c-4835-a3cd-59c385b2168c", "value": "768:K/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:K/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646330400, "uuid": "f1c1b6b8-c825-4969-8dd2-3758a1e1321a", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646330400, "uuid": "8b1270ae-6cba-4898-9067-c46327f22c5b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330400, "uuid": "ba1e6c66-e16b-4de6-be14-02176bcd2e7d", "value": "2022-03-04_0205.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89af36a0-9ab7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646287362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287362, "uuid": "fa0be436-ab5d-4f14-b9ef-d7c283fc91d7", "comment": "Malware payload (Loki)", "value": "9a0f94e1a6186749dc5969688a077446", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287362, "uuid": "f6707de6-6f7d-4c65-8e16-03e2e46f7ba1", "comment": "Malware payload (Loki)", "value": "904ad8c7965b4ea993011c9346ff4b6e3f45ee09e5f09297c35843aba5b4edec", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287362, "uuid": "42be1409-e48c-45cf-8454-aeaab0409490", "comment": "Malware payload (Loki)", "value": "6748ea6955613fd43c5ce2f94232274886f89457", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287362, "uuid": "864ab3e4-87ba-442e-988a-12d13b90b55f", "comment": "Malware payload (Loki)", "value": "41e18860ab110f61c546e96236937bc0318353fc3d9911995e69f50d127023f29dbf30e7ec4cd974d6f524e63c17e5d2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287362, "uuid": "2bd50042-5b96-47f5-8ccf-c55665ac7332", "value": "T1EE041247A012FCB1C9626978C5279015E284BA0CD4B5C01C6674A3FFBBE92DF5F97B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287362, "uuid": "11eefa76-bc5a-45cb-b35b-24419b108550", "value": "3072:gTFnfM3jQ29jH2tYiUiL4z3o5q1mTBjRDyEwQvqmLo25aQutBguM/xSVFW6h+g13:gTloDNMRUiLqx1gBjR1BaBI9/2x1ngMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287362, "uuid": "a7593433-a4f5-4398-b015-4ff3135d5e08", "value": 183961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287362, "uuid": "f5f4f0f9-b9ff-412c-8f43-fec2acf73bd6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287362, "uuid": "229d46e0-18c4-4c86-8158-8dd8d526c6e5", "value": "Payment-recipt.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee888bef-9b13-11ec-9275-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1646327045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327045, "uuid": "a00757ac-8002-4e2d-b537-0dd6d448bfbf", "comment": "Malware payload (Guildma)", "value": "6da39b09f28a3ad86a071b9aa4934242", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327045, "uuid": "68bd538e-0ea7-4acb-bacf-273740bbd481", "comment": "Malware payload (Guildma)", "value": "91195ee9a06a504ec36236d067768ed0ac1558f9e5313c275cc90feccf4f815b", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327045, "uuid": "3c97653a-2311-4152-8cb0-380a42234bf7", "comment": "Malware payload (Guildma)", "value": "2f95737414059c1f56802404ad7b16c7eaec41cc", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327045, "uuid": "d1652687-e768-47d8-9445-a04d95c90734", "comment": "Malware payload (Guildma)", "value": "433d59474660b3a60dff0fbc61ab43a7711a3ceea3eef1f446e86e992fe67f4cf0cef981bc6d050af752fa0e01d3615f", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327045, "uuid": "cb7987a8-5e54-41b9-9562-e589755d9439", "value": "T186E0C05002D117008A7A405298FA47101955E75C56C73442F2E5E803AE8B4C1E44EA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327045, "uuid": "e79391f7-7f83-448e-be74-078951d8add6", "value": "6:SAm/GYPjbDvHkJwz8crlGP9DtcvQz8izeLXi7lyzEuVelEPiGSoN78J9v:zgzPjYQPlwteQwJXi7GPiO78JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646327045, "uuid": "27a03ec8-7eb5-41a6-aa0f-c563bb216201", "value": 347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646327045, "uuid": "88fbe299-ed76-4176-b293-8ebb85d07fc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327045, "uuid": "d5c40981-7ef1-43c7-b604-5ff00f90a9eb", "value": "NFe_7632231486.761992.63753.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9838884-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646296488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296488, "uuid": "8274bc4a-0ea0-4b6a-87f2-4a89860cb065", "comment": "Malware payload (Smoke Loader)", "value": "46d690a3f6dadff9b2825a036150a773", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296488, "uuid": "9467dc52-e319-40ba-a10e-3bfc97b8a04e", "comment": "Malware payload (Smoke Loader)", "value": "91b37b252d8217abb90d1c7c3d803d857d9285388c8e80ab05784ce7c16318bb", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296488, "uuid": "0e0a78d4-9f86-40e1-81b0-fab2b7c8b0b1", "comment": "Malware payload (Smoke Loader)", "value": "2ad3b848b4fbb579c10f08d7f879afb2075f2f76", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296488, "uuid": "e431c9e1-a951-46aa-9bea-07ea91a16349", "comment": "Malware payload (Smoke Loader)", "value": "d4708273ca6533a8cd6b7964eda6fbd0fd33c0d48732247833be575281430b0fd115a0d75f01752ebbd908a9ddeff0c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296488, "uuid": "7450510e-d35f-497f-8309-526a04430b95", "value": "T1C314BE223680C073C19765304879CAB52ABAB532176D8947FBA41BBF5F303F2577A74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296488, "uuid": "e53f874b-5bae-4dcb-81aa-2bfb21d450c3", "value": "0623e16f7ad169cff85e84a96d4a7da6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296488, "uuid": "0b4bd370-a10d-4e4f-8eed-7249f2131636", "value": "1536:FtIAQLQw74MiO7mDZGYzIoFP5xng7jcRaZ6QtS5JI1xePLeOW5w6RPw8693tPQQA:FtKLrGYc5FmcUhxew5jOnrOyT56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296488, "uuid": "90fa96e7-7f36-4b02-8cf8-d38febb3ccf2", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296488, "uuid": "13bb52bd-a1c6-4eac-8f02-4a870683ac2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296488, "uuid": "9c6c09f6-81ba-4d84-8c32-db77de668491", "value": "46d690a3f6dadff9b2825a036150a773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b9260e-9ae2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646305899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305899, "uuid": "124b71b5-f1b4-4e54-83f5-644eae679ee9", "comment": "Malware payload (RedLineStealer)", "value": "21270bccbe10502779f8de63c31bde3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305899, "uuid": "2d6d8240-b610-4486-9882-beabb76ec749", "comment": "Malware payload (RedLineStealer)", "value": "91c607b7aaa67490e08ba2eaa85bffcd8cee98672d9239e1e18e0410c73f81df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305899, "uuid": "7b0ecce1-fca8-4bdc-9893-0dfea0838efd", "comment": "Malware payload (RedLineStealer)", "value": "4d69e41175320b1068009aff2592c394ad05bd70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305899, "uuid": "b98df3c6-ec64-4eb2-87e5-541253479d08", "comment": "Malware payload (RedLineStealer)", "value": "914459ba6433d247537badffba70deaed1c27fb55d4879b3e60ab5c09a1338039b50292497e5ede4a95d59879e102d5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305899, "uuid": "ca01a413-8829-4eea-8a7c-5ff6c22edb6b", "value": "T12EA34BA167CC9624E2FE4F706CB8119487F4E443A402EB8B5DC560DE0F76B80E6967F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305899, "uuid": "a2e307a0-69a9-40ce-940b-59265d1da890", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305899, "uuid": "651acb9d-d60b-48bc-8930-6d469569246a", "value": "3072:bucUJyKCrYi0tJkOJfy5mEQ/z30t6kFON3yF:bucMZR++kkkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646305899, "uuid": "58c802cf-91d2-472b-9abe-2881283c4e10", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646305899, "uuid": "bc185290-e3e2-45db-9d1d-748858e49750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305899, "uuid": "8a259b35-ef7e-46ff-b7cc-d0012490a36a", "value": "21270bccbe10502779f8de63c31bde3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615b56c8-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1646296743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296743, "uuid": "ff9dbd59-fd07-44d2-8d7f-a54ac27c99f9", "comment": "Malware payload (BazaLoader)", "value": "47150e4491090f2ca8ffdb35b2e2bebd", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296743, "uuid": "2a420a58-3317-465a-8af5-30551cbd9791", "comment": "Malware payload (BazaLoader)", "value": "91f1286bf60959ad829879308f97d909f9422a69599dad5b0c1b1fee2c47e712", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296743, "uuid": "40e316df-6221-4327-8594-3680171b4331", "comment": "Malware payload (BazaLoader)", "value": "ec7b95d378be551380f4fb291b2b47ffea42de2a", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296743, "uuid": "8e0150f1-ffa4-4c50-b1db-9869b32e03e5", "comment": "Malware payload (BazaLoader)", "value": "0f27e70c5e4d5394896b455f3ae72f2dc1ceb60b3ecc403b64ad1faf794dfc927d30daf6cd497cce00d4a9cdb522e8fd", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296743, "uuid": "02128d82-e9ce-41d4-b588-2c1a64488873", "value": "T1ECF4D06966A83BB4F0135474CD674A03CAB17C7127B191EB9793324B8D3ABE4173BB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296743, "uuid": "08170363-c90a-4b8a-937c-4c28278c8703", "value": "64e5d7cce23479085f2b5c15b028487f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296743, "uuid": "56650f6b-b236-4db7-bd66-df02c2a5e954", "value": "12288:jb2Z46I1dVNykv7csRVVPRWYco1fQTBYPjffcvAFF5tyS7HZb:jb2o1dXykDrRbPRWPQfRPL0vAFN7HN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296743, "uuid": "7512f620-beb5-4f44-aebb-d5a0d2c38a5e", "value": 729262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296743, "uuid": "24b09ef0-7232-4f8a-89df-ac5a580552a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296743, "uuid": "df9b8651-3328-4cff-8712-258f6ada44b0", "value": "47150e4491090f2ca8ffdb35b2e2bebd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96905b8-9b48-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349826, "uuid": "b4a63261-6470-489a-94f7-0c410b8e434c", "comment": "Malware payload (Heodo)", "value": "276c850247aee3f76bfb2f174d9601f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349826, "uuid": "5d8e3209-98e6-4e21-b89a-1f16c130dc64", "comment": "Malware payload (Heodo)", "value": "9239cf6f9530b1b986aebddf0f603e33ec629237f1ed3768aa6708fb828b7f06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349826, "uuid": "58cd6e77-c448-4423-870b-3b25daae0bde", "comment": "Malware payload (Heodo)", "value": "23cf3054a3186f626e03909bd7831b0bc809ab43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349826, "uuid": "c25c393a-d986-4b56-bed6-9d9e5c6719c7", "comment": "Malware payload (Heodo)", "value": "7414e6506a592451891638ca3eb0787d07579a2821fe3b0a38b2ab72540a3b00324eb72af37312454e5bc4d5c8e2009d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349826, "uuid": "69b3e642-ece8-4658-bfd3-55e8d84bd11f", "value": "T1B0D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349826, "uuid": "ab64978a-5917-4788-9fbc-31550dcf1aa9", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349826, "uuid": "2bf63321-aaba-48cf-a8e0-43b097c2725c", "value": "12288:J1U8sNY8/z0rYebzwd7CoGEAbcVBLku8w:oq6z0rYcMd7VGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349826, "uuid": "fa33790f-e5a4-4839-95bc-d7eced55da89", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349826, "uuid": "9d743230-4951-4cd5-a123-cfae586591dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349826, "uuid": "6fc74f4f-9c5c-466a-9f74-7f76c1d7e815", "value": "276c850247aee3f76bfb2f174d9601f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542a8189-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "f11905dd-3f17-4857-b99f-735b3af7ac33", "comment": "Malware payload (Heodo)", "value": "c908c9bf1d028abc7797374f06f80da4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "03689e01-bbe5-48f6-a676-e3c6d1d753ad", "comment": "Malware payload (Heodo)", "value": "933ee9927043b95e58862275bf231ef9706a3d5a8d8473e05a75cb1e0089566f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "03390e05-5aa8-4f50-ae1a-8f4147bd6d1b", "comment": "Malware payload (Heodo)", "value": "751561089ffcdffec7f3d2d35a922fbc5c6efaf0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265797, "uuid": "386004e2-490a-4396-9139-f3427af30133", "comment": "Malware payload (Heodo)", "value": "a05cf8198efa146c538f83338f0f87882c9e3a9ea8b106721d051fc58d7c97039c2205070c0f76a5a804c94871aecc4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "ff4cacc7-0d04-43a7-b9d7-7ca5f1c88813", "value": "T166D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "160ace90-fb00-4ba8-932a-3065998441cb", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "f8508bd1-6351-495b-bb98-784d09118d82", "value": "12288:ZxpNJJJ2NHPoczJ/OtIhxf3foRXIa5EPwvA:Zx2gczJ/Ff3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265797, "uuid": "1a50fdf6-0aed-4554-b7e9-e93a65da26f4", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265797, "uuid": "9e38e09d-5ded-4132-9999-4ca6b96b66a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265797, "uuid": "3d158664-6e53-467e-ae5d-ae96681adbc5", "value": "emotet_exe_e5_933ee9927043b95e58862275bf231ef9706a3d5a8d8473e05a75cb1e0089566f_2022-03-03__000311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a174d08-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300274, "uuid": "90cce6e9-324b-4263-b033-faaa02ae7ea6", "comment": "Malware payload", "value": "6e6a747dffc7f4bd0fcca8d3547205d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300274, "uuid": "1f57e05f-f8b2-441e-afc5-47d408547cae", "comment": "Malware payload", "value": "934c7ccf26fe121853954d916beedaa760af5ede01cfe54d7776aa6489c29ac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300274, "uuid": "bd80b476-de93-4976-89cd-32af160a385c", "comment": "Malware payload", "value": "77965d904077bee845d5482bdcf149499e5cfd24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300274, "uuid": "d8214dd6-be17-451d-a10f-15b338fa6bd8", "comment": "Malware payload", "value": "aece8a5baff80a578d6b8027ba11aa37b3750f9994fcd2badd299ba8df98cf173e5f56a999082ecd1b9b51f6d51d1531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300274, "uuid": "1fd8bade-b40f-47cb-86f8-ab7bfde50883", "value": "T1E126336AF49D9AB2DE35997A4E7F261DC50B78224473511873128FCC40AB3B90EB7873", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300274, "uuid": "2dc85dd6-2343-4056-b8e1-e6cd46c3f588", "value": "22a7d193681235f08e33cfcfbc112896", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300274, "uuid": "089b0a6b-e68b-4a29-beaf-ba64ed929254", "value": "98304:TedkkwNo6SBPHLH4ZRB8WPdlFn9wvypbt7tWhsOLDL:SQNo6STYZ4WPdlF9wKhWmoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300274, "uuid": "d1ee1524-daea-4c63-9af7-c52efce01cff", "value": 4591616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300274, "uuid": "f1fec430-20b1-4a8b-9c3f-e5e188f89160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300274, "uuid": "1bb435b2-86be-43aa-bf4c-16219e6ed8ab", "value": "6e6a747dffc7f4bd0fcca8d3547205d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858b7058-9a98-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646274040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646274040, "uuid": "caca22a6-4d82-43b1-9307-3e036b2c4993", "comment": "Malware payload (RedLineStealer)", "value": "14a305b37dc32c6e0b45879ded0d534e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646274040, "uuid": "ec360577-0e24-4a04-bcbf-57cd698d4ccb", "comment": "Malware payload (RedLineStealer)", "value": "93640539e9c8428a5aaabe06fedaf6b32aaa33c021477413bb4a86f94deee712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646274040, "uuid": "84f61b18-8dc6-42c6-8f23-66a6965691ab", "comment": "Malware payload (RedLineStealer)", "value": "549ac16c99eb9c80e4021ae2b904906b0720063e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646274040, "uuid": "20d000b1-608f-42ee-b17d-bd6bf9fbd8a2", "comment": "Malware payload (RedLineStealer)", "value": "9365423c44475f6631ab78bd281ad1f55203049942ec5e64080d748d610bb433ae30890c3a82b52ee20a010082a515b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646274040, "uuid": "316c525f-c90d-4ccd-9747-5e453afd3a3b", "value": "T1D89402D17950C032C6827834D466FFA0AF7DA9B4DAA05D0F37B425BE6E343E2636D14A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646274040, "uuid": "962b927b-bcdc-4462-bc2e-3e5cee88d76a", "value": "eabb194c814da30562c2ce7e427fcafb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646274040, "uuid": "399bcd9a-e0fd-4900-954a-6ff4891810ef", "value": "6144:lfrDjdErf1DUMs0Ut1yWajrY5sSr2fKjoq/Uk0cn4/A7ITsq7eX:lTDirdD3s0VTC2SjdN4I71X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646274040, "uuid": "2e734221-88fd-493a-98c8-5fb6611ba744", "value": 413056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646274040, "uuid": "125cf9a8-ee76-464a-ad4f-0feb15769a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646274040, "uuid": "dc0f59d3-22ec-4b5e-9914-bc8603aff560", "value": "14a305b37dc32c6e0b45879ded0d534e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e926dc-9acb-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646295913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295913, "uuid": "b77938cc-c924-47c0-97d6-9e357293e052", "comment": "Malware payload (GuLoader)", "value": "6964c15109dfd8a657fc61c2589545a1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295913, "uuid": "f7250f4c-77d7-4bd5-8e05-cb17dcfc00e4", "comment": "Malware payload (GuLoader)", "value": "94984deb97c45318fcb7b858712a279a633cda2d1265888e6ed9abb69d9f7860", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295913, "uuid": "a44bb22f-f08f-455d-810c-259bbc562438", "comment": "Malware payload (GuLoader)", "value": "68d16237ed55a638edc3f3a1a71c099b0e7ce0e5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295913, "uuid": "ccc64ee9-8fdb-4406-801a-4b3f0f82b64f", "comment": "Malware payload (GuLoader)", "value": "24fbec9f9cc9754c1da47c2d0421260ff9554082a217ff7cb343e627deb36007b45fb9e6b7f2a113f2ffac7343290e81", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295913, "uuid": "4bd4bb00-d099-40fb-94e7-cf7f237065fc", "value": "T19AD3D8AEBFACB470FB11697BC455AD055130312F87B1084BA379FAA10EA7C7047B6786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295913, "uuid": "e73e4269-c57f-4780-b30f-47d31d407952", "value": "1536:AEbcQt/raU/ViM/fgVj/NL1vth6/0Q9h4C8OKVC6mJXunUCbrwhg0opZ:AEIP0/fclNcN+nBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295913, "uuid": "8b30481e-1d1b-40de-9d7b-4613af8f42b8", "value": 141796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295913, "uuid": "17974756-36e3-411f-9835-e8b39a930c09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295913, "uuid": "7a108530-14fd-4739-872c-90d38ef70b89", "value": "SALES-CONTRACT_PROFORMA-RFQ_UYRTR-84747392837_MARCH-EXPORT-DOCUMENTATION_2022.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161b4db3-9add-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646303489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303489, "uuid": "349555ed-c02b-495b-92b6-b49aff5d6012", "comment": "Malware payload (RedLineStealer)", "value": "bc2c936e73872e4a94c0bacdfa64c62a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303489, "uuid": "7f066ecc-cc7d-4807-a8e8-e42fa7935510", "comment": "Malware payload (RedLineStealer)", "value": "951a71c308b5934fbd3c682541ccccf27ecfaf496ea0ec919f4ffc38ff3ff052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303489, "uuid": "31221ccd-d023-4c75-a682-d9b60698ca3d", "comment": "Malware payload (RedLineStealer)", "value": "8cd497dadd38564b736c77ba8b19f7f5bbce472b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303489, "uuid": "e7c929ac-1613-4b1f-b5cc-6c20e02436f2", "comment": "Malware payload (RedLineStealer)", "value": "56e7dea2b132eb4975f4fb9ca67724adc377803c1c677322da908deadd3a39747957476fe6aa8ed989c3124f8e98c28b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303489, "uuid": "a0ebb53e-f22b-4d40-87a1-d6fedd9d517e", "value": "T14B363334AAC9C73ADB9C60745CF9EBE7C9EA117F1060F1362BBB4909951768FC5009E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303489, "uuid": "5857a394-65e1-4b2a-b87c-4198c42c2de1", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303489, "uuid": "288d0697-1733-461b-9dac-f5151eb192f8", "value": "98304:ywaXhdrSwxbHq7dY7K+JDc2ofvmE505yhxmwpiXvh1iduRyJOzzUhPQx:ywaV9bS16Apfb5KYZSvzRyczohPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646303489, "uuid": "23becb7d-a4be-42ba-9158-a3bf467a3703", "value": 4997576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646303489, "uuid": "1c3cb046-b2a5-4e29-950d-346309e0db10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303489, "uuid": "44718eb3-2677-40b0-aa62-31971315bc23", "value": "bc2c936e73872e4a94c0bacdfa64c62a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46e66bf-9ac3-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646292641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292641, "uuid": "64c5af52-8f41-47c6-9242-19a89726c25a", "comment": "Malware payload (Loki)", "value": "1e29f55f0192a01da17d7972d245645e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292641, "uuid": "7b837dce-c560-4deb-b8e2-c04a36ab4e89", "comment": "Malware payload (Loki)", "value": "953a47298999069f538e8ab2b6ec28548973562c3afb2ed4889884666fb2b45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292641, "uuid": "2ad29a3a-3cae-4679-9eb9-4c2d81192d23", "comment": "Malware payload (Loki)", "value": "28482cab8b83ce99e9c875ddd824f65f6e406653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292641, "uuid": "b87b76da-7a93-4cd1-af6e-0d2683cdaf1e", "comment": "Malware payload (Loki)", "value": "3847ec551ea68ee44ccff8c6ee21f2b1449a379c88f3699d0508ec0e44d792c8c0e6be532dc03c379f4bce7ed12161a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292641, "uuid": "aa3b11c2-513f-41ca-bbf5-d07fd1c5f409", "value": "T1F724CF7BA1AB9850C15437FE8465007207279F092267CB1B9AF9321D99B73DBFF42A1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292641, "uuid": "28793319-dcb9-4731-aa49-2634338f32e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292641, "uuid": "ad269f67-8fcb-4cf3-9c3d-c07129fb5387", "value": "3072:n7bMX2v54IjGyznavqNVEy2nH43mpuQqqoETOHbFIbI9eBVSoLS6lIwPWdLPke:7blvyGGNvqjEy2YW9ha99RaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646292641, "uuid": "4d486d5b-af73-4c2d-b24d-bed723f49fcf", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646292641, "uuid": "77aba06d-09dc-49db-bd1b-50a4ad61c76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292641, "uuid": "8732a536-a976-45c0-8568-6a7b32d92471", "value": "Zam\u00f3wienie(P.OR470674)Tapflo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3eb181-9ac6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646293966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293966, "uuid": "ec86e608-ba3d-42b8-b9e4-6fe027178646", "comment": "Malware payload", "value": "39352352579b6480db444cef46157bba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293966, "uuid": "4f1409c3-a64e-4177-975e-4cc59e31cbda", "comment": "Malware payload", "value": "965d39bd840a6aa6b0cd0a3e29d645532b3b18e467404c15b3d60a3669e85a2b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293966, "uuid": "dcd7f318-e4a2-4b8a-847e-46287e58061d", "comment": "Malware payload", "value": "78a9102a9b9fd78b77e25f0d4144774ee1310d6a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293966, "uuid": "2d26a905-e0ec-4587-9800-0809a941e830", "comment": "Malware payload", "value": "39f9d81bc443ba23f85f48b563de38b8879a1572ad28902939ee9496209b39f9b8d151723722ac1504ca2d6b712eab53", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293966, "uuid": "245dae8b-918a-4350-88b3-caa4c30d385b", "value": "T11E936C617A468031DC8E017FC59997E6011E39B88F580DC3F7A6A7AE29F05C2DA7335B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293966, "uuid": "5fcfc917-ca3b-4a4a-8c05-f0f040eec1cc", "value": "d3c0030a08ba79e7a9ee1912bc520bb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293966, "uuid": "853acd02-4a8c-40dc-aac7-f8f5ca1d6c10", "value": "1536:Gir+1quAzgoqObsU+AHCLtPT5+aF4gcbcplbqbdiRlfq5OZOlopv:Gir+1qpgpF/AgtPlcbcubdiRU5OZOloB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646293966, "uuid": "6c9c5359-d18c-4d97-850f-92b3a8e5678f", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646293966, "uuid": "ac01476e-e3d9-428b-b87e-59bd02eb11ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293966, "uuid": "91b08ce3-f9a7-4896-94d2-a97356247228", "value": "39352352579b6480db444cef46157bba.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c54f6f0-9b1b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646330289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330289, "uuid": "7aa8694d-87d1-487d-99fd-bdacaa0de93b", "comment": "Malware payload (Formbook)", "value": "3973f8916b7d474e026eca25abfcd833", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330289, "uuid": "581d1102-b51b-45a8-9808-0ab7bd38e91b", "comment": "Malware payload (Formbook)", "value": "96a0dffa7387628ad30a6d44608812c3b79f6fd07cd8b144ce9bdd8fb4824187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330289, "uuid": "19e2a2f3-ff15-40e8-9795-692350a1e869", "comment": "Malware payload (Formbook)", "value": "79ecdad1d3b09ca5da35c021ccb304835afbc2c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330289, "uuid": "bc47c522-244b-455d-a4c8-b2f86e447c97", "comment": "Malware payload (Formbook)", "value": "cd5f0561d6211ac1263d82ffb0e7750bb2d778a3bcc44fe69a59903089a5491ca26009f1660eb6b328405ad201ccad26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330289, "uuid": "6d46765b-9ec7-456e-a286-26e0c1c918db", "value": "T1E105CF0438E68034F97A87B1CAC4E7F19B7DF625E589B0F264105E147646BBE8849EFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330289, "uuid": "b1effeb8-8544-4fec-87b3-7b86abc73492", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330289, "uuid": "66740690-474d-4926-aad2-ccfab32d258b", "value": "12288:j2WR/IRTRjdGZ7uTVXfVVw2kgibpASZWQSKWu0VbhRoJ6jXz+8n8PrzhfbKG:j2n1RGFuVd5kZbphIhc6ja8n8PnhjKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646330289, "uuid": "54ff3107-f199-48bd-9011-106e7651f7ba", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646330289, "uuid": "bba9d3f1-e484-4e1d-8501-8cbf8b58160f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330289, "uuid": "be0c65b2-1849-4bff-9b3b-5385a8490a88", "value": "pH58nNETsgatzui.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0396be-9b15-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646327633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327633, "uuid": "f0f2e70f-9f67-40fd-aa16-b41b048832a3", "comment": "Malware payload (Heodo)", "value": "d5d031427c82f877dbdc988e95878d72", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327633, "uuid": "7071eeb5-edfc-4a59-8754-c3f071210a68", "comment": "Malware payload (Heodo)", "value": "96c49343cabd6d68e6b2d3e0378f14acbd4e2065cce6cef1b5ffa0f01b337820", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327633, "uuid": "1244c8fb-8f21-4daf-a812-1c0cafe182f9", "comment": "Malware payload (Heodo)", "value": "2a9bd780df55c5e68d600d7aeb86c4dd393cda59", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327633, "uuid": "c9ab37e3-3986-4ed2-a6a7-1c1558ab2cff", "comment": "Malware payload (Heodo)", "value": "9d201f5cfa7a3698ea7249a951ca6f292bdeccfd7a3f541389e61c7e155fd75160b423f23f4021aea920cb97e267f33e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327633, "uuid": "cd77dd80-7305-4d49-9684-0f29c53ebae6", "value": "T1D223E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327633, "uuid": "a671a170-4d8a-4871-a00d-40b16a6c9864", "value": "768:+/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:+/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646327633, "uuid": "9fc69e80-5156-4bd4-9e99-5807e42d4ecd", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646327633, "uuid": "5f1f799d-284d-4d6f-9eb7-0ff75910fa62", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327633, "uuid": "514318b0-917b-4022-84e1-fda7854622f7", "value": "Dokumente 2022.03.03_1802.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3856cb12-9aeb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646309559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309559, "uuid": "edad2769-e1e4-41e0-8245-577f033b6694", "comment": "Malware payload", "value": "d425b5f199de9b4c1db4dc7fe4c4226f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309559, "uuid": "043ca160-82d8-47b9-95df-ac38c55f1dcb", "comment": "Malware payload", "value": "97161d3461f6c1660bce5ec0e259b5bb0b2204405127e9eb771815e31b83f491", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309559, "uuid": "7727dfe2-e1b2-489e-8595-464111f61b98", "comment": "Malware payload", "value": "2265537a30ccea7a7cc2e2a75f191b18f9ee087b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309559, "uuid": "d97ec67f-2757-41f3-b040-9bc988719775", "comment": "Malware payload", "value": "395a8328ec11c8884603988546fd013403179f6fa203635f8cb717a97a06564ce8894256ba4518772c4af8082f6dba9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309559, "uuid": "712dcf3e-d74a-454d-a918-0565ca8105ba", "value": "T12834F7A6C6FC1D07D94BB33854262D1391CE4E7280D6925A0B98BC3AF3FE9E7A4141D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309559, "uuid": "19e2ba37-90b0-4f49-8834-05e6d964df82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309559, "uuid": "eec4ff6c-d664-4d52-a8cb-22a44fcb0086", "value": "3072:bzjapZAXMZUA7TU+wSbZPSj/j+LWrXy2QXea9VSsumMMcZ8JQ:7a9wSVSjCLW7y2QXea9smMr6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646309559, "uuid": "0b614821-c154-49b2-a9b0-fe68a1eea059", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646309559, "uuid": "1d0cd6d0-cf94-4bea-8168-c3ccc5c7f0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309559, "uuid": "933e2465-018d-464a-a8f4-770d3adbbf47", "value": "d425b5f199de9b4c1db4dc7fe4c4226f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1c559d-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646294375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294375, "uuid": "7596073b-28fa-4b9e-ba3a-f3c87f6113d8", "comment": "Malware payload", "value": "adbebe1397ff8c5e4543b8a01e083cc2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294375, "uuid": "8462fa9c-e0a7-496f-9b76-f9cbb95c7f29", "comment": "Malware payload", "value": "973274949ad18cfafb3e4f4fd9e5cecb262699227e05dcfcee9bcce62e486397", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294375, "uuid": "a309cdc4-b7a7-4f3b-97dc-dc109ca3a225", "comment": "Malware payload", "value": "1bc5cb79c40760bcf639e254c13d95bf3ff71f88", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294375, "uuid": "2c4ce269-ad56-426d-85c0-1344dac936cf", "comment": "Malware payload", "value": "5cbde71b5107265826cc214a1574f5f3727772db9e1c339c1f7c9cf33ed7522587648225a8f366fe15fb51b28e7ab1d7", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294375, "uuid": "07954f91-01b0-4d20-97a8-a3c85b07b040", "value": "T1B0734A51B685D946D54917364CE6C2EAB727FC415EBB830B3244F32E2FB36E0C92361A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294375, "uuid": "af4f9c69-457e-419d-9de8-2a47e097a9a7", "value": "1536:pHxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAHLps2zBGSYId5edo3BF0yKTdtmR+hiz:pHxEtjPOtioVjDGUU1qfDlaGGx+cL2Q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294375, "uuid": "2e94d5ee-2a0d-47e3-85a5-1f1578061ee8", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294375, "uuid": "ba890407-616f-4437-b0e4-c00937ba7486", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294375, "uuid": "d74d4ee6-0893-4ba5-a1aa-3bd61e325a01", "value": "SOA_0303.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e6b203-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295274, "uuid": "3cacfa49-56d4-4999-8384-6f911034dcf4", "comment": "Malware payload (Heodo)", "value": "0050c0093c7db591a66c30cf128f5482", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295274, "uuid": "d9962b33-0988-467a-86f6-b1f4149f6501", "comment": "Malware payload (Heodo)", "value": "97a0dfbd4751b06e6321cfbc8bf7a8c787a731567fa31a0af4fbb1cd4f1f7c5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295274, "uuid": "afa7185e-7143-416f-8e0f-023a2c1b607e", "comment": "Malware payload (Heodo)", "value": "dd070ef2945e05a3042684a95133e46b90ce60bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295274, "uuid": "f10bdf06-52f1-4188-a229-6c031d23578b", "comment": "Malware payload (Heodo)", "value": "fb2a76ff519e5c1a22f739b3cef71d0996cff734cec836b9c87a02af5430bbbafefa47d41dd5ab5d6155c924b398d68a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295274, "uuid": "d598f03d-0471-436f-a678-689948770933", "value": "T155D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295274, "uuid": "b8e02171-1ed2-4170-a0b9-7fe810252e72", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295274, "uuid": "b842e977-70a7-49d8-88d8-5cf5e5c220ab", "value": "12288:ZxpNJJJ2NHPoczJbOtIhxf3foRXIa5EPwvA:Zx2gczJbFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295274, "uuid": "c1f54ef0-be6c-4bc8-a1e4-f1b8c62fdbf8", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295274, "uuid": "5e30da25-46eb-4c4d-9f31-af8715256a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295274, "uuid": "fd9dab48-0013-4ade-a8a5-f30c09a60242", "value": "0050c0093c7db591a66c30cf128f5482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8a0274-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300253, "uuid": "6511e6f9-1b0d-4e21-84be-84ae1ff7a931", "comment": "Malware payload", "value": "80531f8ba54af9eab28fb13dc40765a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300253, "uuid": "d552265f-863b-4340-a028-feec2bea59bf", "comment": "Malware payload", "value": "984535d6534de959dae7a57cca5410ef56546d54b36e04c3a425dca9f331f964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300253, "uuid": "eca96b4d-efbb-46fc-9d76-0d64352c0db9", "comment": "Malware payload", "value": "b5e54dd5ea3fd71e97ed19d3651b4a3b07a1b680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300253, "uuid": "7867b3ad-1f56-4b7b-9d43-3bec4783a06a", "comment": "Malware payload", "value": "f7f1d123a5b16b5bd5affcec3a6a1e18da5183e6fad6e28615bc198731e23d3d08e27b2649586686003ff72f7000d156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300253, "uuid": "272a73e4-bbfc-4699-ae00-4eb3e12afe6b", "value": "T11783419D726072EFC897D472DEA82C78EA51747B931F4213902716AD9E4D89BCF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300253, "uuid": "3402abf8-280e-485b-ad17-376f5a0c87f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300253, "uuid": "a10fbce5-fd40-446d-8d67-8871c516ba78", "value": "1536:c+TuGsa4YFA1zF+kKntKbmJyqu5dNqy50p:OZ9+WzitKbmJ1u5dN15y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300253, "uuid": "f6b17b26-927e-4e02-a455-0dcf3f3d9c2b", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300253, "uuid": "383ce713-4be0-4fbe-8791-122150dd2cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300253, "uuid": "c5fe3f71-edc0-4da7-bff4-f40cac0dcd99", "value": "80531f8ba54af9eab28fb13dc40765a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb616c8-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646300498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300498, "uuid": "83e8d3ef-38c7-4fe2-a2d3-3b101a2aff8f", "comment": "Malware payload (Formbook)", "value": "fe19b1cca116f748b3f67788be824c73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300498, "uuid": "0e0a3c7b-2455-48ac-9c3c-4fe0e3a05fcf", "comment": "Malware payload (Formbook)", "value": "988d086b6ca75da2fca905b090c6f20b21749335f7e2ee99d8dab2001d4667e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300498, "uuid": "dd1cb692-86c1-4903-8aa4-d0db4a88cfbd", "comment": "Malware payload (Formbook)", "value": "e58c2c38f33a515767bef275101290f29111713d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300498, "uuid": "a707e805-4194-49f0-8512-8084912c717c", "comment": "Malware payload (Formbook)", "value": "506a4b94b23f581f2870626d8f6407a85a9bf56db3db052e459fef611e8fb62a2b2d63fa70b788647adce8b7d868c198", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300498, "uuid": "6279a9aa-1c41-4287-a50c-de98f914eacb", "value": "T105F48C16F3E2C9B6D32B06787C27B2A558197FC12C249C467AB87D0D6E352D1382DE4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300498, "uuid": "910ce1fb-86ef-4ccd-9c64-808089cc4bb7", "value": "bb8b994ea7204a3a00105e8b9f8cb8aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300498, "uuid": "60971a6e-21b6-4486-ba16-950ad4256c1b", "value": "12288:Pntj1v6o5x1oBghwJ27DKDLu0V9PUECzleUm8OPyzZFJ+:PnhH1tw2uvukIrOPyzZFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300498, "uuid": "f8ffbff0-bc74-4600-9279-ff965fc08aba", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300498, "uuid": "a71e983b-f0d6-4f07-bf48-327554f277ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300498, "uuid": "7b7d62b8-db04-484b-a69a-a09c9a75b2d0", "value": "fe19b1cca116f748b3f67788be824c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec36cd8-9b33-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646340494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340494, "uuid": "cc644e3f-7c41-42a3-bd48-39dc4a04ba8d", "comment": "Malware payload (Heodo)", "value": "24febfb91ff7727ed473cfd0c1965749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340494, "uuid": "e528a05b-192d-41ce-b1cb-9f56f63bbb3f", "comment": "Malware payload (Heodo)", "value": "99337f349070c55b5fd34fc2779ebb2c5757077419e319e29f271eef26f7b712", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340494, "uuid": "a9bbaff4-45b7-4129-8ab1-1e740a67ae2d", "comment": "Malware payload (Heodo)", "value": "561eeb546579d8036e67f8563c19644ad72ad5b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340494, "uuid": "041f950a-0021-44f6-b0f7-61fbeafe71a7", "comment": "Malware payload (Heodo)", "value": "5ee47fbf5cc69885ff016c5c7a0bee976f4786c30ff202f65cf278c5fe50b2da20b67aa96c127a25a65e76724521098b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340494, "uuid": "183acae0-051e-48ad-af39-53eb88699429", "value": "T18FD47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340494, "uuid": "e925ef49-5644-46d2-90a6-75d5a508c457", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340494, "uuid": "914517a3-3ae5-4d40-b0c0-a4dd3333aceb", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLyCjzhmD/bwb1r8Hc:Bg4IqjYTy20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646340494, "uuid": "85088267-fd48-4937-a20a-eecc9ad1dd27", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646340494, "uuid": "df4c33f5-2475-42ea-88ca-2cfbe31953fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340494, "uuid": "ef371db7-103b-48d7-a296-744c18fa37b3", "value": "24febfb91ff7727ed473cfd0c1965749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb20d046-9b48-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349802, "uuid": "746cb2a5-51d0-4e27-b9ec-7329fa295279", "comment": "Malware payload (Heodo)", "value": "0fba57305017d5b04f0f0fcc50862e06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349802, "uuid": "935a37f0-232c-4079-adfc-13565c5b3302", "comment": "Malware payload (Heodo)", "value": "9941be1c1868df74a81ea0e46d3b65e1580387dd07b52388120b81d70dda17f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349802, "uuid": "4322fcc4-8dc8-4112-b7af-040bbb61cd2c", "comment": "Malware payload (Heodo)", "value": "9a91e4fced47f5300ebf8198cd14e6d56d0d34fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349802, "uuid": "976183e8-26ec-4255-92e8-0385f6c2fa93", "comment": "Malware payload (Heodo)", "value": "d429e6b86f9dbd6dfc2d3ce46e13223653707c190de14d61c88f53e9ca8cf10cd939c773f1395693636b4b522fd060c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349802, "uuid": "b818f717-9bfa-4410-b430-71b70d311457", "value": "T1C0D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349802, "uuid": "6d817dc4-4724-4ff6-b356-6d651f743cfa", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349802, "uuid": "d1a78998-7cd4-482a-927b-f8f59cfa2d0f", "value": "12288:J1U8sNY8/z0rYebzwdVCoGEAbcVBLku8w:oq6z0rYcMdVVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349802, "uuid": "3e658a54-a301-4e60-9f5d-144f0bef0e45", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349802, "uuid": "ec230170-d377-4dcb-aee3-7bfb35b1a88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349802, "uuid": "2690b784-6c15-4962-a1c5-1dc47819dea1", "value": "0fba57305017d5b04f0f0fcc50862e06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00007129-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "58d4e5f8-798d-459c-a66c-bf69937a6b17", "comment": "Malware payload (Heodo)", "value": "9df337529517f78508c02bd545cac94c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "44fdf5f3-fcab-4636-a428-57ebbc9a67da", "comment": "Malware payload (Heodo)", "value": "99e5bbf5b48e7e8567676fa3ecfd0e8b15d490fe7b02dccad523acb0ba929410", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "50a8736c-9a9c-490d-a8dd-9b69c8d09914", "comment": "Malware payload (Heodo)", "value": "8dc9881f147b236aabc1f40ab87f049f639d0bad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298727, "uuid": "88d17d17-62c5-42fa-b650-3e4e26995d6a", "comment": "Malware payload (Heodo)", "value": "fe4013804ade8a1a56459711ddf0329e391c668937929764deb8b7d18ed1155bee0b38cdc5a66a5391d5d345fef51181", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "2929593a-5fd9-4d0d-96c9-a4339c3d1a9c", "value": "T16C353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "92217e69-b861-492c-96a2-ba0f9b8419c1", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "9092138b-9a89-40d8-b6d0-86bd76d1a46e", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZ91EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZRytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298727, "uuid": "1c0ab5d6-c30d-4916-a11a-08bf6bcae380", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298727, "uuid": "50b3fdf9-d882-493d-9cc6-13c8050f54e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298727, "uuid": "7617d032-e9f6-4eb5-bbfd-f3c97a12a10d", "value": "emotet_exe_e5_99e5bbf5b48e7e8567676fa3ecfd0e8b15d490fe7b02dccad523acb0ba929410_2022-03-03__091159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fd37a1-9b1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646329735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329735, "uuid": "dcae9cc3-d919-4942-8d0c-18829bc11f35", "comment": "Malware payload (Mirai)", "value": "f54d21a496ae25512bbe5640d498de67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329735, "uuid": "6a5a4e0d-7565-469a-895d-37673b957929", "comment": "Malware payload (Mirai)", "value": "9c00f2b9c84e6d46ad8346dd3a89de33f41a302dc38277fac0ed4270dee2a01d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329735, "uuid": "52abcf0c-e9ca-4ea4-98dc-3095ffda028f", "comment": "Malware payload (Mirai)", "value": "4436b01b5e154d69128fc8147a58f52b05d756b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329735, "uuid": "e76530ab-41f2-485b-ac48-fed42b234357", "comment": "Malware payload (Mirai)", "value": "5b180db1854c831cfe6f2c531767c7b479f830a42bec98ed5a96229038d4089ab6e9aaab7ad2b581e511431e9760c23b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329735, "uuid": "1b78529d-e222-41e9-aff9-7b0b7894b8a6", "value": "T194933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329735, "uuid": "752fae92-a978-4218-bccc-f17d23c22cf7", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Wl4umXxVqDrstKfz9e:Q97vk51RcG7Agl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329735, "uuid": "425dffcd-c009-4e5b-954f-f5aa4f15d179", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329735, "uuid": "24c89cb2-59b6-4b38-8b37-933f535e3a52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329735, "uuid": "8bee47ad-64b2-4f2b-a427-8895e155ae77", "value": "f54d21a496ae25512bbe5640d498de67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eec6485-9b37-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646342292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "4ce73c3d-fae7-4f78-a77f-b944cf695f7b", "comment": "Malware payload (Heodo)", "value": "df20b78595709ccbcc9b09b5b25b14e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "05d254af-d636-4a98-8511-852ea064bc11", "comment": "Malware payload (Heodo)", "value": "9c174175d1e5115a53bcddf4051066e326e63d997c53c12198d4ecce59e8a4b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "08d83d42-f248-4128-9a56-cf92ea788673", "comment": "Malware payload (Heodo)", "value": "17b84de5c2b40c7a1c05f00fca6786aa21facc49", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "3a44258f-a3d0-4209-90a7-a4b24bf40a0f", "comment": "Malware payload (Heodo)", "value": "b707c393e2252de588a5210ad9237b7226681f6f64bc81615084f091641828ef7030a13d3e990169a83ad80042bd673d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "3b010a2a-01c7-4970-b1b8-020df5420d99", "value": "T123D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "0e236114-62ae-49aa-b943-46a8f1a3cddf", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "74f2f15c-8db9-4801-bed3-99827df875b2", "value": "12288:J1U8sNY8/z0rYebzwdhCoGEAbcVBLku8w:oq6z0rYcMdhVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646342292, "uuid": "dae85628-23af-4a89-87db-5fc1d574f458", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646342292, "uuid": "40bcd19b-f107-433e-b136-7781436d112c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "6286ee42-6274-4d60-8754-8fdc194f9d0b", "value": "emotet_exe_e5_9c174175d1e5115a53bcddf4051066e326e63d997c53c12198d4ecce59e8a4b1_2022-03-03__211806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a537454-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1646298100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298100, "uuid": "b51eeacf-5cbd-4280-a8fa-c3e30a0732fa", "comment": "Malware payload (RaccoonStealer)", "value": "020f9b939f6c1537ac3d65dde61ee4f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298100, "uuid": "bbcfe462-63ee-4a7f-a5d9-d4b7d1802f79", "comment": "Malware payload (RaccoonStealer)", "value": "9ce1c2ca453f62552ae1b3562d042bccee069c35f37518bf2be7e6f33efc165b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298100, "uuid": "d48a6310-4762-451b-b074-289e205d660e", "comment": "Malware payload (RaccoonStealer)", "value": "6c322dfbdad84db835e450acffef803aebbcdeef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298100, "uuid": "8d70d535-2079-448d-afdf-649ede118132", "comment": "Malware payload (RaccoonStealer)", "value": "56795bc932a5d024993b570927a885a8bfea9b7a7020b6accc139bf142fed6b6c1a5c09f077c234ea4c43e99b9f969f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298100, "uuid": "de9048e3-b020-496c-9368-4a26a1aee0d5", "value": "T16856338145241B10DFC2263BBED5888589DC3FC632981FEB19CEB9565D3EB629D0B0F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298100, "uuid": "0744bdb6-f645-4146-aaa6-8b7b0a98af11", "value": "3718975ff28c3ea4832c41cc9615593d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298100, "uuid": "4a0d1f6f-2f83-4db5-be0d-2ce634d731b7", "value": "98304:elOeWKZEqbvbpPYWwWxFSA73OIJrrpw/YF4Gq5ncYivlrcSTOGph5HcXW7YD2eV:EFEqLhYW7FSaJrFw/YF4GAcYqrP6GbVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298100, "uuid": "4d486f97-7857-4693-b6c9-5b99f4ab5e54", "value": 6266224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298100, "uuid": "bf447154-78f3-4beb-a914-9bb0ed428d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298100, "uuid": "939c988a-6b5c-40eb-8788-57960ea7a702", "value": "020f9b939f6c1537ac3d65dde61ee4f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cc9649-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1646294920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294920, "uuid": "7d1ae3d6-f01b-4491-9d08-b21303a5d451", "comment": "Malware payload (NanoCore)", "value": "1e811b499214bdf0320ed0e52255f517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294920, "uuid": "1602fd93-5f7d-4cec-9941-149eb9ae0a4e", "comment": "Malware payload (NanoCore)", "value": "9cecbacae003bd0c84b9fc7fa83ea9a398ee337a5090f06b076cbb4aeb687ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294920, "uuid": "4bfa80fd-07b2-4a4d-b208-4fa47273cb37", "comment": "Malware payload (NanoCore)", "value": "d9afc054dda0ead36c3db65f7408c3e512f5c87a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294920, "uuid": "de01403e-4d8d-4a0b-aa1a-03c728a19638", "comment": "Malware payload (NanoCore)", "value": "e4f8bd3acbb7738b2d5f025546c5ee8670d811659ab0625683c56a6640f6332439c9df318f3b50905da7290103fa7962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294920, "uuid": "484fb517-b524-4866-93a3-fcc25eebc3b0", "value": "T1A215D00438E68038E9368BB1CAC4E7F19B6EF225E545B0F754005E257A46BBE8D45EFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294920, "uuid": "535aca1e-59c6-4af9-b4e2-b431189eea90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294920, "uuid": "13610eac-d983-4bac-bd9a-d6c0f40c402f", "value": "12288:tyAmjR/ILTUkRlgH8Utvwbygz66BA3atwz9ytOXBZZ5JQ34AwCCqgi:+0AsJavTge6B2wv+BZZg34Awni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294920, "uuid": "8d133c17-91f7-4a8f-a16b-36a9dd1499eb", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294920, "uuid": "e325bd32-f9e8-4616-9f36-ce427db330f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294920, "uuid": "407c8973-b1d3-4d8b-b553-6ee7f0bc0f58", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e6420a-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320987, "uuid": "21f50565-4412-464a-b053-54bd44d138b0", "comment": "Malware payload (Heodo)", "value": "d99d759b7c175295d41508c4fe348302", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320987, "uuid": "f95bc306-e173-4222-b29f-1a2cc4902f14", "comment": "Malware payload (Heodo)", "value": "9d07e42f1e6ed0cf2ae329895311cba6e756872b908cd23514081eb7df340fb4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320987, "uuid": "98c02ee6-aa5b-450b-bead-a297d68585e8", "comment": "Malware payload (Heodo)", "value": "be7b8ad1e8561f21893b9babd768b3de1db3bbe5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320987, "uuid": "3b19433c-cfc5-40f0-9dd0-3e9252a6d4fd", "comment": "Malware payload (Heodo)", "value": "298ecee48c82115d5d7ce4f260fda4159812b7312d3c29e525563c49164bcde123adc27971358f3386537186b2af10a9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320987, "uuid": "0248f414-72c1-4f18-9e94-3df3abb7b114", "value": "T11323E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320987, "uuid": "8522ce57-fce8-4e4e-a149-43e28b8b2c74", "value": "768:6qLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:prVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320987, "uuid": "bb565ee6-6aa9-4fa2-b1e9-2f32c4698648", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320987, "uuid": "57688024-2eeb-4485-ba1a-f71b30ec6a00", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320987, "uuid": "a723461e-3a7d-4344-967a-f51a7912ca0d", "value": "Omics Journal.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd783813-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320976, "uuid": "2bbd2613-b6f1-4406-ad83-6e4c666e7a86", "comment": "Malware payload (Heodo)", "value": "ca86a4e7fab28a5f762018f2ad213075", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320976, "uuid": "b7528844-d09b-4192-9510-e43c536bab86", "comment": "Malware payload (Heodo)", "value": "9e25d4243e01bcc6afd8119c00e3ae0dec172430c671b01125e93b6d6a769cfc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320976, "uuid": "027259f1-1e0f-4be4-a475-76808ed5087d", "comment": "Malware payload (Heodo)", "value": "f78926b0d6653ba6cdaefba24a979982cc0b1570", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320976, "uuid": "55002dd3-5ad1-43f6-b51c-334bbe1e29d0", "comment": "Malware payload (Heodo)", "value": "73c277c6909e81cab05ac401621e122e135e8ed4e29bbc9f2f551cfbc709b78efefdc19ed647b44604513b28f5b60c19", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320976, "uuid": "91ba173b-ac13-4bbd-960d-229fee2a2bdc", "value": "T1F323E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320976, "uuid": "de3188e6-4546-487b-8a88-48dc9b316785", "value": "768:K/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:K/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320976, "uuid": "ef0b97e0-8993-47be-8590-552e79fe80c7", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320976, "uuid": "bc20de94-fdfd-4ae1-9308-ac01b193d5b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320976, "uuid": "30bfdbbe-925b-4c2c-9326-4b6cde0e5878", "value": "Insight Medical Publishing_3.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a223c06b-9b26-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646335077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335077, "uuid": "ac660de2-7ba5-443e-8c3d-9aaad44859ec", "comment": "Malware payload", "value": "be562628fe311e7f5a23dd83bdd29cf9", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335077, "uuid": "3e539333-0e79-4f91-b742-eb9f73234fb3", "comment": "Malware payload", "value": "9f4494900e36136105082af30b1c9cbfe84fba3e30f302c67407dd4b58cac5a4", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335077, "uuid": "355c30ad-cb93-4bcf-af34-a0b6fde37829", "comment": "Malware payload", "value": "9e4825cc9dcad8b892a872997ded7d46fe65f02e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335077, "uuid": "2f0c2ec5-8f2c-4ed6-baf7-e5e773361974", "comment": "Malware payload", "value": "7e335915d86c9147e794a8b86921a2a674c1fef056797b0f6dd6629db739670f6c07e6e4ffb1db88ac7253894681ff25", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335077, "uuid": "f2bf217a-2da8-4958-9405-c55806c7460c", "value": "T15D44F1DD95D353D8C5B5C93F327B1A6D0808026B59C1B2AF7847AE181F1E8D6AFAC0D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335077, "uuid": "4f5b96af-acec-43fc-bb29-434434dbd581", "value": "3072:rbKz8hzEVPn0/u9NzTdk3nyZYRAKgoqX4xaNPYv0pt2jbkcarJ8hThi:rTW9myZ8NtGs0pt2/kHt8hTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646335077, "uuid": "5cdddb98-7fd4-425d-9b3c-388027c1487e", "value": 266178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646335077, "uuid": "58ef6513-10d9-404b-b111-f77707f604b2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335077, "uuid": "5c799f1f-e9be-4d2d-9e30-c0c480028585", "value": "unlsorosiubdt.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06460d2d-9ae2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646305610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305610, "uuid": "57fdc3a1-9e04-4930-9ae4-280525dcfa9b", "comment": "Malware payload (RedLineStealer)", "value": "df0afa8269bfd8d566391743d7793291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305610, "uuid": "93ec4853-210c-46c3-a2ac-1d9f21d64fff", "comment": "Malware payload (RedLineStealer)", "value": "9f6e71649662dd86ed3b65a8d20ad8c21971cb8087d14eeb34449f04b573b737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305610, "uuid": "2658de44-af5c-4eec-acfb-2d0fafe0fb1a", "comment": "Malware payload (RedLineStealer)", "value": "0f8c754d121b175cdcb60c582a127700e92f74d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305610, "uuid": "99202a2b-fd22-4b7a-bcd6-a1f4467bf295", "comment": "Malware payload (RedLineStealer)", "value": "3eea2c1f7f07e5f67457b0d746da13f3eb11d07807bd7c20b3f45d9cc093ce9633889a06372d4a0c2e5aabeb1a19a56d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305610, "uuid": "35824f7d-da03-41e2-a6b6-83f8d516a671", "value": "T1A6C4235E20CA6600C58F883D21A6F72BB67F8C6064991987F1B254535B2DD9FF93CE2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305610, "uuid": "59a7bf0f-b76c-4c37-a385-c6069057e935", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305610, "uuid": "d305b590-d0ad-47e6-b4fb-d831a8efff52", "value": "12288:SQKpT6qcEVnNoTKsBy8w2UTV/MUQS03ULaHNqrxlKIQNoTHjCL0j9o/1hepF3++T:aPjXq3w2Ul1kEaHNYK3wjoWo/SWcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646305610, "uuid": "d35c0a6a-4ab3-44bd-8118-d9af0646f79d", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646305610, "uuid": "52e3a496-4af6-4a5b-920c-61179c9d4e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305610, "uuid": "198ef5f4-6a8a-4733-bf2a-2a46b12164a6", "value": "df0afa8269bfd8d566391743d7793291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33598c63-9b41-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646346487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346487, "uuid": "28eca9ba-3df3-47e3-8508-0d5682c71e7a", "comment": "Malware payload (Heodo)", "value": "f0997fa1c4ed4dfb9fba17b27368d879", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346487, "uuid": "6744fbc8-fee3-4409-a540-b98837657ef7", "comment": "Malware payload (Heodo)", "value": "9f76fbfa39e5a96bec1a59d626448b7b14b92e798f4ddaef82d2ffc93e443c3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346487, "uuid": "9e239dfa-f53f-4e1e-9024-9007b67045a6", "comment": "Malware payload (Heodo)", "value": "747723796c072fbf55ded1f0624b071378fa68d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346487, "uuid": "06f1f4c0-4e65-4f69-8096-139ada7a42b8", "comment": "Malware payload (Heodo)", "value": "4af2f00916381134e99d75882917e1d2c42e1b84e12878a2de6df27d3fb4c2e356b788ee1dbd5d1ae3f7f2c95a8f0f07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346487, "uuid": "525d6752-f893-44ac-acc4-4f874435af14", "value": "T1D9D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346487, "uuid": "93c2c37f-96bb-4db4-8fba-aa3f9668ddc7", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346487, "uuid": "5de350db-9555-4b4a-9fc9-d918378cecc7", "value": "12288:J1U8sNY8/z0rYebzwdACoGEAbcVBLku8w:oq6z0rYcMdAVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646346487, "uuid": "9fc71083-fb08-4e99-9946-915b75046e60", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646346487, "uuid": "186aee5a-a5f9-4bf0-aa98-69a3a55e88cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346487, "uuid": "ea3f5128-c4e3-49c5-bbd3-b68737e6b99e", "value": "f0997fa1c4ed4dfb9fba17b27368d879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4575ed-9b15-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646327660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327660, "uuid": "a53500b3-3b8d-4bae-8a35-1b7fc71a1766", "comment": "Malware payload (Quakbot)", "value": "14bdd729cbf94fef8a877281720cdd67", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327660, "uuid": "5f4c2316-c2b9-4b29-8201-a7ce7beff476", "comment": "Malware payload (Quakbot)", "value": "9fcca1709802bdb90266eaa7b18111cac550c8393da019495251e338a5455fdb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327660, "uuid": "ec80a544-9da2-479f-8bff-ac4f0454a884", "comment": "Malware payload (Quakbot)", "value": "155c93d7a89dce826b69246763a4912dc402e8ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327660, "uuid": "af0732f3-f966-4362-bd92-9fc1a10d78f1", "comment": "Malware payload (Quakbot)", "value": "8ace8bd1b798c240cd2b817f915c784f661fead84b664e48fa2798acf7f2d4578427fad934ebdbf4cf0c46742d2082fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327660, "uuid": "7f62a1eb-c921-4b7c-870a-7be7f77af962", "value": "T137B4BFB875146CE1E6BF163BC995ADE803762632DE87D8CE506477C709733A1FE1280A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327660, "uuid": "3d865a65-6310-4da5-a207-e1c42739dc19", "value": "0383b6e78c7f005efbff386cee23786c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327660, "uuid": "b42a66ca-a2ec-4272-8908-025065bed69a", "value": "12288:vnKiMBsfsXtxbohL+/JkjFbK5BFHGiIDwqJ6dY2H:vA6fevoVaJmFbeBF5IDt6dY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646327660, "uuid": "aeab11b6-05c7-49cd-989b-7b3de9356a44", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646327660, "uuid": "eba7fe1a-bb74-47e4-bfad-07caaa0e4928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327660, "uuid": "3c15fab5-740a-49a4-aa5b-a170c2d46ee6", "value": "7541495.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cec99a-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646300423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300423, "uuid": "066437f1-783e-45d1-aadf-9d8da523a9d2", "comment": "Malware payload (DCRat)", "value": "513ba2e2e5f1fbffd187fa12e7026215", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300423, "uuid": "c9b25189-8ca1-4a66-ac34-81485f54509d", "comment": "Malware payload (DCRat)", "value": "9fd08a0fe250eb478c6ff482c9b17353a511ddb231265866cc062a617bc6cfdd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300423, "uuid": "fd780f78-24c4-42c1-b884-81f9dd02b095", "comment": "Malware payload (DCRat)", "value": "edcfec4f277e9252d146d0ed9e2437a1afbd6588", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300423, "uuid": "4434fb50-4678-4ff1-8db8-567fa40cc90a", "comment": "Malware payload (DCRat)", "value": "d49a3cbebaf7365ef811f1d1344ffa4547305f4f9e493c0908a904f61563ff024190a12db56f5e23cd85ee836613f164", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300423, "uuid": "7275fe65-cf8a-4b56-b7cf-bbc51bd1ee89", "value": "T1ED3533912F6ABD08F8F60FBADBACDE4BD64A304770244A25D7C96AC40C761F4BD8414E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300423, "uuid": "0a7c87fe-e73b-47fa-bcc9-34d146c64762", "value": "a232b05ab03f849da432ebaa259fc1ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300423, "uuid": "7960f1a7-2af1-4f51-b204-5f2ad1217502", "value": "24576:tkX0nO0nYbwfZ0EVHROj63voRbYhCM2sFK/cRgOnmq9g6WB36rKX6n:/hPTHB6YhducOU7m6elg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300423, "uuid": "9af39aab-a6a6-4d6f-9040-017fe18c4908", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300423, "uuid": "e1a6f5bb-1fda-4339-9678-e17449348db7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300423, "uuid": "30d91008-5dcf-4bea-9418-4868823f5281", "value": "513ba2e2e5f1fbffd187fa12e7026215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59151332-9b0e-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646324646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324646, "uuid": "08357d5a-dafc-4eb4-af81-51672666a62d", "comment": "Malware payload (Quakbot)", "value": "c33554689e4b94d69be6240172b2e0a1", "object_relation": "md5", "Tag": [ { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324646, "uuid": "512ba2fe-eeed-4ec6-8301-d98a0b1dba06", "comment": "Malware payload (Quakbot)", "value": "9ffa5d0c6845944a25dc094e15bd33d1205fd19acce7058de460f14dd51e0298", "object_relation": "sha256", "Tag": [ { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324646, "uuid": "1c76e678-cbc5-4a8e-9b91-e5dae53bc481", "comment": "Malware payload (Quakbot)", "value": "4414aacb4ba640358b0db8842b77b53fcad20212", "object_relation": "sha1", "Tag": [ { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324646, "uuid": "cf88fdc0-fc1f-465c-b3f1-353afc482a31", "comment": "Malware payload (Quakbot)", "value": "19ed09a19c0f254657cd888c88b10ec76852e50ab1ba247245a56630e506a5c3ccef74e844785e095398446f51550d81", "object_relation": "sha3-384", "Tag": [ { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324646, "uuid": "8d2086d6-33c1-4a42-a3fd-711f294504ae", "value": "T1A844021DA158B68EC71D2039E3085EF5DE1F11CE6A40F12F4AC0BB9847B91C35BCD699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324646, "uuid": "ba0db620-c31f-46e6-9732-fbbd45ada901", "value": "6144:QKafQTxwGF4p24e6RoPmj6M7R6SFENKq4WneF:QKacxGgF62PFNJnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646324646, "uuid": "35b8f47a-0513-4fdc-a94b-bf6be92fc935", "value": 273057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646324646, "uuid": "97a2505e-ce74-4a19-b235-07a9b22b888f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324646, "uuid": "dee43bc9-0265-4148-a906-e2961c2c7b70", "value": "REF-307781015-Mar-03.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3767068e-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298820, "uuid": "145c304d-461b-4ca1-904e-865f8d77c467", "comment": "Malware payload (Heodo)", "value": "f8fe20525aad21110809f56eb9801a00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298820, "uuid": "10b572a5-fa01-4d4f-80ae-0723c01872b0", "comment": "Malware payload (Heodo)", "value": "a051e7d40787f2161f07aafa3297bb28dc95286ac9abb68c7fb379036bfa5615", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298820, "uuid": "8a999bc4-a95a-4f2f-a797-e140b01732e9", "comment": "Malware payload (Heodo)", "value": "5e4c0c6c9acf9c58ef4e5e073045b0cc1a5bfdca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298820, "uuid": "1cf79afe-4e4a-4db5-b3ea-a578177835c1", "comment": "Malware payload (Heodo)", "value": "49dd175f58342f457d2982f66a91ef1c7467ee1386a8b7cc673f4ad4d685cfe849bf5c9498d808e076446ac7791430af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298820, "uuid": "72e75cee-1494-4319-9cd2-672c4539fc64", "value": "T10C353942BA48C5BDF04E08B9181EAA69667E1C447B3296D7338C7FDDBB319F90832517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298820, "uuid": "0b54c976-fba6-495c-bae9-3828c24a1a57", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298820, "uuid": "f89777b3-2324-48f8-9856-70aec159abbc", "value": "12288:C4rjnpAeev7HmOsVUCfbWierRcDFtLlirkfrcsMEPe6MpPfXxiDjM+R:5rjpAbv7HmOsiR1cDFXiQfgsUPv4DjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298820, "uuid": "264ee448-b5c2-42b8-b266-181045af3ac1", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298820, "uuid": "1aba6310-a6e9-4679-84c1-0a1b40f0930d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298820, "uuid": "2ee43124-f4d9-4454-a652-74b103727842", "value": "emotet_exe_e4_a051e7d40787f2161f07aafa3297bb28dc95286ac9abb68c7fb379036bfa5615_2022-03-03__091334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585a5dcf-9ab7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646287279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287279, "uuid": "df99ff7d-5213-42ca-a54f-b0a4e129b9e0", "comment": "Malware payload (Heodo)", "value": "6a769fa591fc96ca3b54011b8fd45d20", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287279, "uuid": "0e8eea3e-3119-4238-8e95-3f329f35eadf", "comment": "Malware payload (Heodo)", "value": "a085b0e6a3ef5c985a2477a50f07a2288d49560da4f6694085bc672791ba68ac", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287279, "uuid": "194f859e-2b0a-4b0e-9f3b-8f3a99f2631d", "comment": "Malware payload (Heodo)", "value": "33049c3e9d376b8d2610b95c15ffbc714014b2ed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287279, "uuid": "e56db8d9-1f37-478f-92fa-2454ab969fa0", "comment": "Malware payload (Heodo)", "value": "6a8519aab600a1cd23a583807a212b0daa0db97d8cbfb6c7990958a0fcf91a0878fc70d997c9b4f751527d65fb915c2e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287279, "uuid": "a71f4a54-82cf-4366-be71-cc037e53fbc9", "value": "T1E723D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287279, "uuid": "f96a27de-8893-433d-944d-1b5702ba6c3e", "value": "768:KeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:ZoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287279, "uuid": "87f4a309-23ee-4121-be91-e2ca74d3e5c4", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287279, "uuid": "294c1d42-b129-4965-b590-77270b80f1ad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287279, "uuid": "707e1e11-a7b6-4b3e-9d9c-7c8f8b8e6e00", "value": "INVOICE 03-03-2022_1515.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce4e82a-9ace-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646297353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297353, "uuid": "7298e5e0-f4f8-4024-b3ec-a5e33de6f96c", "comment": "Malware payload (AgentTesla)", "value": "54ff6d2ac49f6241e42a8cadc8fbca43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297353, "uuid": "30648a65-d978-4d9a-97aa-5f1892473158", "comment": "Malware payload (AgentTesla)", "value": "a0f40f8f2b228fae2690ce659dc25da8592d83a46fa1b65c42d8e66814c74fdb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297353, "uuid": "bf04cf7e-a466-4eff-ad57-596759d8ce33", "comment": "Malware payload (AgentTesla)", "value": "121f832b50ba01c6f494e019f0a224326a860c68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297353, "uuid": "8cdf782e-7680-46b0-be5b-5c6634b2d31a", "comment": "Malware payload (AgentTesla)", "value": "80885c636d28bd92f401d476f728cc8307b3b5ad62567113c95bd3118021a85a60e9db2594f6c9e0e13d80c5fe43a2b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297353, "uuid": "fcfab913-4cb0-4ebf-b9bb-d9b5775c9110", "value": "T10BF423F687B6164B0456AE9CFE8506B81C45F4FAD06E7EC3E73019CC2AD2156FC2721A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297353, "uuid": "689eac69-ff31-40c0-a41a-e180c84feadb", "value": "12288:B2a9hMWmU+qtdpne4r+6DGoYbJeWfFsbuTGcXyl5fOX1HAo+Vg/GUh5:Ff/tD2egzxqmi2G85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297353, "uuid": "0e469314-f8c9-4dea-9124-a7be19f7d36c", "value": 737074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297353, "uuid": "396940ef-35db-41f5-aa8d-48ff888cab6a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297353, "uuid": "807c0ab3-11cf-47ba-b6bd-40a84d7fd54f", "value": "purchase order -0034287.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab3fd33-9b0d-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1646324381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324381, "uuid": "61c124fe-a175-452c-9dfc-e751568dd2f6", "comment": "Malware payload (IcedID)", "value": "f9c736cd9c288b66bf284d98c787c329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324381, "uuid": "269066e7-f4b4-455b-91b8-36a394cc8a75", "comment": "Malware payload (IcedID)", "value": "a21d04d53f9925ec9615d2fc818c7836c8a12d874719cb6ab70b3a9b6c3f7272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324381, "uuid": "208fb92c-4438-44ee-8e46-cc29d8234a54", "comment": "Malware payload (IcedID)", "value": "2d935b1e969728e69ef8cbfb4f75987361d4d3a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324381, "uuid": "f2596215-7c69-40d1-972a-b5904fcb0dec", "comment": "Malware payload (IcedID)", "value": "7f93d5b1ffeaaed97f1d867ab9743b5b190ef69e997c34b066f51509fc57012f07d970c914b5911de9d246ff54774cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324381, "uuid": "0ecfb9b8-0d88-45cb-822b-226babd2d850", "value": "T150D45B7A63A601E5E0779034D9521917DDF27CA103B0A2E7A7D1374A0F3ABE0673BB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324381, "uuid": "cc5a8136-0dbf-4fca-84f9-2a5ff3239ab9", "value": "1c59baf310f2350e10dd8476c3f162fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324381, "uuid": "76d4f10b-9ed1-4196-9b87-051bb6ec51eb", "value": "6144:9chMqY+yya01Gks7/bRWTU2dA9AXu9b+ohrnlFV+I9b/AnK3+QKStcGV/:FX+ylbpJ2dAAu9aoOa+ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646324381, "uuid": "c1ef697a-e4cb-4b8e-a66f-bf4d742f919c", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646324381, "uuid": "9c953930-44d2-41bb-863e-85b09054050a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324381, "uuid": "97bc5441-5392-4a4a-9b62-601dfe27a79b", "value": "a21d04d53f9925ec9615d2fc818c7836c8a12d874719cb6ab70b3a9b6c3f7272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eec227d-9b37-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646342292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "082896e9-d31d-4019-96cb-d22cf464d00e", "comment": "Malware payload (Heodo)", "value": "5b27f8f57eb18a5516fe83b95ce8cc3d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "d12055ea-9130-487c-ab4c-509932dff80b", "comment": "Malware payload (Heodo)", "value": "a23c0a7598c719164fd7a6dba57a7043b04cae308a9df627e78bb5c578d8e614", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "6d912e0d-ddc0-412e-a135-b72943023239", "comment": "Malware payload (Heodo)", "value": "bded40b560da01acf42969de62589db9ade3734c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "0bfee289-cdc5-49fa-b502-487ee7d8a258", "comment": "Malware payload (Heodo)", "value": "85496b74da2b0e581a0d892865ca04c0500c2ffa1ae2656fb746dff98037bf3c085cbffd481b231af6b8e676ed20d065", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "ab23e70f-b803-4c24-9b1d-ad4f79e715e3", "value": "T136D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "069839de-b4b3-4d2e-b29b-0a22bf884be6", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "f2bfc751-dd85-4917-8f2a-de5e12b4a4e2", "value": "12288:J1U8sNY8/z0rYebzwd2CoGEAbcVBLku8w:oq6z0rYcMd2VGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646342292, "uuid": "e0511aa9-8f5e-4200-9ad6-34d2678e9f18", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646342292, "uuid": "76ce89fe-17e4-465c-b079-ec4c5b90523d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "cfdb22e7-0552-4e9a-9c2b-d8c9fbecbdc6", "value": "emotet_exe_e5_a23c0a7598c719164fd7a6dba57a7043b04cae308a9df627e78bb5c578d8e614_2022-03-03__211806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1937ff-9abd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646289921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289921, "uuid": "caec4184-6724-4949-a4be-f71503eecff5", "comment": "Malware payload (Heodo)", "value": "827325cad91633469230e32c872772e5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289921, "uuid": "1167787b-a63b-4eee-b929-fd12e038ac4a", "comment": "Malware payload (Heodo)", "value": "a259a46b7c9007072670d892237dc5db98c79a16a8d3919cf14fdd8322e566a6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289921, "uuid": "3d4e0fc5-a04e-4c92-b662-d657ca1898d0", "comment": "Malware payload (Heodo)", "value": "c459f6c484bf01b955db3e2e69a232e101dee9e9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289921, "uuid": "9a5c5cb9-e6c0-4318-ad6a-3a2949d21d01", "comment": "Malware payload (Heodo)", "value": "8abf03fb0c27da256e30b1957df6b5b051b26836b7d330934bad0425f3fd5e97bb4600f8540172cdfaf24eb555411019", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289921, "uuid": "d0bece9b-c416-4d9c-a493-9d95b0482aea", "value": "T14123E116C9346C2EC73E8C75420839A171596511A8CBFB5932947F0D3B86FCB67AE19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289921, "uuid": "f770e1bd-69fb-44af-b5cd-c6eb759d862a", "value": "768:H5WHFKfQzXTmbfRzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+UP6UCIHcX:HwF+OXabfFtT5fTR4Lh1NisFYBc3cr+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289921, "uuid": "b0211d4e-6abe-4e6b-a9ec-68922bc13e8a", "value": 47898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289921, "uuid": "5beff572-66e5-4a66-bd3a-52bad2ad6fb2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289921, "uuid": "6db1e61a-f423-434c-93f0-6e2ef2c6c73d", "value": "list_PO_03022022EX.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d44ace-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298903, "uuid": "f9189267-2922-4de7-90f4-c847917382f6", "comment": "Malware payload", "value": "5d7095af987d84ed49669bffc9f49ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298903, "uuid": "d549f9e7-ccdb-4e58-95cd-eb5840f97b00", "comment": "Malware payload", "value": "a2ab9acad51433ee88a2558ad59f5171b8bc3da7ffe80818423d478f94adf618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298903, "uuid": "750a9115-e410-4117-8d96-70e99759522c", "comment": "Malware payload", "value": "267e49c4cca6fd5e468fbb453d9e5bd0bf9705c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298903, "uuid": "85501f4a-bfa7-4754-829c-4a2d5054bb4d", "comment": "Malware payload", "value": "6b12b88e657e6447128b6a9a91cd7011be2dca1fbcb020e900268230da610264b6c5ff259d8fbb685c1cd45a4b80cc38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298903, "uuid": "181a0a31-95a5-40bb-9960-fb9c345d8ade", "value": "T11AC4BE17E6428076E4632430265D9B7649BD76300A2655BBF3C42E2D9EF02F2AB35F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298903, "uuid": "e9424ef9-691e-40c2-8c06-c03237f6d53d", "value": "06c6e92acd3ff57b00b3132976b3f6d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298903, "uuid": "6c957f3a-c5e9-4366-8a45-cfc8d9049b8b", "value": "12288:F7vT8cGUCZmxIwNjVGCXZqmmJUL+JHkdIUnjoqhwHw4d:Fz4BUCZmxIw1VGCXZ5mJdkdZnBhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298903, "uuid": "8eadbe4b-c1c9-42c7-890e-ce5b3ff8accb", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298903, "uuid": "b362a7dd-ae7d-47c9-9726-245dc449c302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298903, "uuid": "800b239c-586f-44f6-89bf-94b14bb09ff7", "value": "5d7095af987d84ed49669bffc9f49ff4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00723846-9a95-11ec-9275-42010a9c0029", "comment": "Malware payload (LockBit)", "timestamp": 1646272528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272528, "uuid": "df251a97-fc7c-41d4-8cee-e43e4a3dcbc5", "comment": "Malware payload (LockBit)", "value": "cb9c03e731d41c65ab0662b6a69e5a5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272528, "uuid": "923a598e-333f-412e-b9ba-481ddf2aec65", "comment": "Malware payload (LockBit)", "value": "a2ad5cc5045a1645f07da7eab14ba13eb69ab7286204f61ba6a4226bfade7f17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272528, "uuid": "aad22c04-2e2b-46f0-ad67-5c9e67e42cd1", "comment": "Malware payload (LockBit)", "value": "7000c5df7707a6891850df65ba61f8ad2415666d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646272528, "uuid": "c36bc4bc-0961-4ff3-8f77-f7663f7c7e8f", "comment": "Malware payload (LockBit)", "value": "6552533ecf8b79b7a570e7d21467aaccb4ca3b7bf06606c4ac0f02d714b42c01c760219501afad58967b2fae765bda02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272528, "uuid": "6aa3600c-28ec-4b65-a51f-308beea5404d", "value": "T167253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272528, "uuid": "dc9ec3e8-0763-44d8-a81d-24303eb5e9f2", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272528, "uuid": "16e15fe1-08ae-4425-a536-cced159f7857", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdfF:Ujrc2So1Ff+B3k796N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646272528, "uuid": "68dd9f65-6eec-4e4a-804a-0db4381d71f7", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646272528, "uuid": "a3df6a3c-fd94-4cc2-8f09-5a53e9daec11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646272528, "uuid": "eeed90b0-5635-41e7-a57f-ef1e84823e2e", "value": "LockBit_0B28E0E67E50561D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0334d4-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295284, "uuid": "a67c18a5-f3ab-4d74-a426-bbc3cd4b2be0", "comment": "Malware payload (Heodo)", "value": "e14ef7027d3e379954ac493e4da12c32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295284, "uuid": "e941161b-fc23-40a9-933f-8392334cf454", "comment": "Malware payload (Heodo)", "value": "a2fd5dd40ed81bf447ac09ed07926d0a12834b81607205e1b58e82d36de26f0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295284, "uuid": "a74f97e8-1acb-4ee6-a39e-b432f0f026a8", "comment": "Malware payload (Heodo)", "value": "802421d426ea7fc4cb65a5ee5b175feb6490ec4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295284, "uuid": "52033809-df9b-4932-b288-4c8191cdf7dd", "comment": "Malware payload (Heodo)", "value": "2baa09689f7dcd38b0714d556112e8aae92229bc7922659880032652a795eaf98b332c42ae439e1db7ce3710dd1e14ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295284, "uuid": "7dc1573c-9398-4a3b-9c1b-3719824acccd", "value": "T17ED41B017498F0B3E38918B04A858AFB724B5DB296117073F2ED378CA7725F15CE766A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295284, "uuid": "81684203-3916-492c-bfdd-bc32d6be8d96", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295284, "uuid": "4654dc5b-67ae-4aa9-a2f8-2c7be6194998", "value": "12288:pao0Se86lloPxHHVVIjqxEqRVoQmiIII999tLLLdAkkJoFLZZWbClgluPcRBATfW:AqxETMJ777u3OmONFqNJtN1v96TOAnA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295284, "uuid": "9ca8bfd3-c84c-4e2b-9bee-7f4a76df79f8", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295284, "uuid": "e6ccfb71-c5d3-4a64-900c-510ea8784b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295284, "uuid": "660c17c5-d8df-4daf-b267-621e1f2a4336", "value": "e14ef7027d3e379954ac493e4da12c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14333ed2-9aed-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646310357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310357, "uuid": "0eb2f2b6-4d6b-4686-853f-5ac2e50bd7c4", "comment": "Malware payload (RedLineStealer)", "value": "ddbba6c01d510b9b07d857fded704024", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310357, "uuid": "41c00cd7-595a-43ac-ad3f-1fda0ee28125", "comment": "Malware payload (RedLineStealer)", "value": "a30174f8bde06331b948c0fc87e51d5b470cffa6484aaacc42fa373e9e2910e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310357, "uuid": "cc23ef5a-0ae5-4010-a87d-7661ce30100c", "comment": "Malware payload (RedLineStealer)", "value": "51830800c03716ba234b422d7d52317fd33ae1ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310357, "uuid": "625a99f7-9def-4f19-86fd-a77ed6ab2660", "comment": "Malware payload (RedLineStealer)", "value": "98bf0cf7478c2e97803aceff01b3bfec5f13db3056d59ceb7579bdcb40f68272096586223d6edb8d97d05983e7e15eef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310357, "uuid": "73a7fbe7-bb14-4d72-a287-15e402d4a1ea", "value": "T13626333190D0FF96E4C6C33D0A39AB50103AD3F6EA95E192A4C89DA159EDB39F1D3076", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310357, "uuid": "6d515621-f4cf-4403-96c7-8e74b75ce3ab", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310357, "uuid": "043e3513-f7e5-4c54-8fe5-305a2cc86478", "value": "98304:QNol1GATXnezuV7QgF45JsMsYfNrP3zRpkMD5fhjwgHK:QqQATXn7QEamYfNrP3Np9VZjweK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646310357, "uuid": "20725d72-ab9a-497d-8d2c-31f9447fd15f", "value": 4426240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646310357, "uuid": "a641fa36-4105-4c13-95b3-5f58c0365c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310357, "uuid": "9f448e98-c4ca-4c50-ae65-d673d6600939", "value": "ddbba6c01d510b9b07d857fded704024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da07f4dd-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1646296516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296516, "uuid": "8adb4058-2b3e-4968-94ff-0f71d320444a", "comment": "Malware payload (RaccoonStealer)", "value": "3d138dc3450076910b43c8db0d3bf96b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296516, "uuid": "3300ec9f-84f7-4c11-8eb2-c99c5b08fd9f", "comment": "Malware payload (RaccoonStealer)", "value": "a35f87212af6714fc468f21e32b7f9e599fd00d27ae5920344a9d3ab15e54ecd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296516, "uuid": "fd055efe-1ef9-402e-bacd-61f2fdc88deb", "comment": "Malware payload (RaccoonStealer)", "value": "fcaaf2c89c4b8bb4b09b5cdff4d6c8bf10c2d1dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296516, "uuid": "7d6b4d71-4e70-4449-9a0d-dab6ca00ca64", "comment": "Malware payload (RaccoonStealer)", "value": "f281d56ef88131ee0f95f5d8c04c9235aa50ae7cb9d57a621a8c1bdcf69c0020775917f6afa5866033f24f8015b78c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296516, "uuid": "e87d7895-099f-46f1-9c57-db69489b46a7", "value": "T150D4E000B6B2C038E5B716F4787687B9652E7DB19B2451CF22D63AEE1A346D0DCB131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296516, "uuid": "cf202e2a-8a7a-4c42-9443-45ccd69a5f1b", "value": "d157c0a5c61be6cf8862631968209884", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296516, "uuid": "356dc06c-3348-4bd5-a101-55566d37df6f", "value": "12288:DkesKw3m97V85A0PCaDzi9KVJSDjMSwZXutnwp:dy297V506aD1yo/ktnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296516, "uuid": "931ab41a-e9c8-49eb-a228-b7e873f54ce9", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296516, "uuid": "d5d01a51-30c6-4f93-95a0-721e3c830e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296516, "uuid": "442b4e96-3d59-4b13-92eb-10f74469357e", "value": "3d138dc3450076910b43c8db0d3bf96b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fa748a-9a88-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646267273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267273, "uuid": "a1dc18e8-a8c4-4ecf-8898-bc6f64e72ec6", "comment": "Malware payload (Heodo)", "value": "b8f4bdbb39fbc2dcaabc477820ffcd24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267273, "uuid": "37069cb4-072e-4f18-8b90-12a9b160a61c", "comment": "Malware payload (Heodo)", "value": "a3984c8786ddc9d4113e6f49823d6d2d4f1241a7be97c1cd016b5d16041e2115", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267273, "uuid": "3b7cdd19-dd03-4909-a505-1c98ffb69e2d", "comment": "Malware payload (Heodo)", "value": "c04b55c2278d71d335fe7fe7408d145b98364a99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267273, "uuid": "0f665517-747f-4262-b02d-a70c0a0640aa", "comment": "Malware payload (Heodo)", "value": "6cefce94ef0672e88f557c9832ab8ab6bce50a992a046f971e877f23d62bc5c87fd0d0c2fece9ba8528a921a6b6ef735", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267273, "uuid": "3415c4d2-d877-4922-a301-597195179554", "value": "T18ED41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267273, "uuid": "b303a3bf-7c8d-416a-ab13-c65f4b7a703a", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267273, "uuid": "3ffd4781-633a-4228-bfdf-a827c6077005", "value": "12288:ZxpNJJJ2NHPoczJVOtIhxf3foRXIa5EPwvA:Zx2gczJVFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646267273, "uuid": "08afb410-5311-4d3f-952f-bab8fbf7edc2", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646267273, "uuid": "caf1ca9b-508c-4553-9591-6b9425115bb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267273, "uuid": "74f62448-eb11-46ee-8f98-2a560b63b53d", "value": "b8f4bdbb39fbc2dcaabc477820ffcd24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a2733e-9ac3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646292380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292380, "uuid": "e136948f-7de5-4c0b-832a-6249c13c89d5", "comment": "Malware payload", "value": "d824fffc39c7c5c6e480fc76a8e441d6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292380, "uuid": "fde13b38-039b-479a-8269-e5ee2fdcf5fb", "comment": "Malware payload", "value": "a41abb8c7636e8a3ce2bd5f25f9f0595facf3334d30c3df5de24f86bc889a819", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292380, "uuid": "c5ce77f2-9351-40c2-9bd5-0b6d2a0014df", "comment": "Malware payload", "value": "67f52329a279457d57caad3bea76650dbbe34aa3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292380, "uuid": "ee2beccd-fedb-40ce-b59f-1e1dd761f9fa", "comment": "Malware payload", "value": "4ed62b9a292aaab126e0cfe1cd4c6454ab72eb8ef83a195dd45c75d17de105a5be38b74ecc0dfda3105eca3dd135bbdb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292380, "uuid": "ee16e529-e631-45e4-863f-600e07568a03", "value": "T1DAD2E1D5B246BD23E05A0D7CC81D32F5F1486F17625A617D1A4CEBCC9AA08EA8274FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292380, "uuid": "542f01c1-2eae-455a-9a3e-60b29d2d7cd9", "value": "384:ewmYfGSLebHUfbeffIAM/1JF7dwDDZyxlGMjXFFcoN+0ehBHLcTSyNAkz8sprN98:F/Gp6efwB/F7d4DZyxZTcn1HVkz8s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646292380, "uuid": "5098af58-b47b-4760-942d-3da14fbf20c8", "value": 29666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646292380, "uuid": "897d662a-7df7-4f57-b845-78190916b62c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292380, "uuid": "04999336-a2b7-451f-a6d8-08403b1d408f", "value": "2022 NCAA Bracket Pool.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8341c222-9b04-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646320422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320422, "uuid": "51aa191b-c923-444d-8953-1bcc8d3e7308", "comment": "Malware payload (Formbook)", "value": "a3db3121e70a7f14f148112cf9c2b354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320422, "uuid": "85476932-d736-4598-bddc-5c5f00ea45aa", "comment": "Malware payload (Formbook)", "value": "a4e3ba6772cc6a006c061a0fc86fafdab1a11602004743018eb2d21524ea3f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320422, "uuid": "4e6c9bcf-b363-4577-b9a5-e3bc6df6a256", "comment": "Malware payload (Formbook)", "value": "9e558cbc0c8656cde57e5aeac354828c7792ed3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320422, "uuid": "e67bc5a9-f5c7-4d87-a940-25e5ccdb264e", "comment": "Malware payload (Formbook)", "value": "c6f38e6fe8fe25c783433a4e706898931cf473271147937bbbde0f15687c3ca496182d220639bd9aa862e40c486f2101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320422, "uuid": "14596764-dcd3-4048-a850-f3bd88c5e4bc", "value": "T141B48CC5E98465A0DD59AB716A37CD3582237EFDA874A81C29DE3E273BFB2D31025013", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320422, "uuid": "74e36754-c119-4fc1-9c6f-30d2f6c22364", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320422, "uuid": "0f1baa39-3d55-4c7d-a600-9856cc7e3bbf", "value": "12288:nP7r9r/+ppppppppppppppppppppppppppppp0YOcrRa3w+jxx1PQ8tAQEt6i9:n1MOYRX+VrxMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320422, "uuid": "58b73a4b-a36c-4cd1-a95b-b60b49ce33bc", "value": 521337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320422, "uuid": "85840e8b-90e5-4383-b1c7-fbccf668743c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320422, "uuid": "0b6ca0a2-d66e-49ff-a769-5811d43347d5", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d45d72-9b35-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646341334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341334, "uuid": "a58922e5-7376-4acf-9d13-a7f38946887d", "comment": "Malware payload (Quakbot)", "value": "20517496cf2ad748adbd0aa4cb7e58c5", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341334, "uuid": "34f5afcd-480d-4337-b844-f98e4dfd67ee", "comment": "Malware payload (Quakbot)", "value": "a50fe17b8033af32822f5ebff53aeb28ddea88b573882dabf64e12897461feb2", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341334, "uuid": "79c23eff-0dcd-41ad-b52e-4886d3f51eba", "comment": "Malware payload (Quakbot)", "value": "d001904d7967c5014f751dcb974970db21d1d723", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341334, "uuid": "126a295b-79f6-462e-8e5e-440508402cbf", "comment": "Malware payload (Quakbot)", "value": "01bcbf338ea0e9f2cdc11bd5e015dbee59754bab8170fea5960aa5379f68b748aa34814e30beb976159f90c2d55a3f60", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341334, "uuid": "491d683e-132e-419d-b6b0-71b1126e98e3", "value": "T1C444021DA158B68EC71D2039E3085EF6DE1F11CE6A40F22F4AC0BB9847B91C35BCD699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341334, "uuid": "5049466d-8c70-4a3f-92c7-ef35a3024b74", "value": "6144:aKafQTxwGF4p24e6RoPmj6M7R6SFENKq4WneF:aKacxGgF62PFNJnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646341334, "uuid": "82810ca8-2b48-41cd-ac41-11aa3b725f7f", "value": 273057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646341334, "uuid": "08385b4c-1cdf-4ac6-ad8c-a4622cc77c2c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341334, "uuid": "eb884307-48e8-4b63-9059-ae657a417ada", "value": "REF-463128215-Mar-03.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360faa4e-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646300106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300106, "uuid": "88a9f457-0abd-4b44-9de1-1db0de23fee2", "comment": "Malware payload (RemcosRAT)", "value": "fa64c8d30fd19ecd3875d7a1d2c2285d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300106, "uuid": "2b071337-2805-40d7-99dd-c48afa815b49", "comment": "Malware payload (RemcosRAT)", "value": "a549ff6df2c758aaf25162d062493daaa8360f831e64a1505ce05f33d5d57d7f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300106, "uuid": "48bf9edc-3aa2-4300-8ec0-8c6dc2dbc6c6", "comment": "Malware payload (RemcosRAT)", "value": "8f5563ae70b12e870481df16dae82466418258ae", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300106, "uuid": "b8f9f5ce-8265-4265-8bae-f686393dc2e6", "comment": "Malware payload (RemcosRAT)", "value": "2e7f7a398e3c0f08339f5731b66fb8fe3ca789b7781b8871529367c334271b68293c847d8bc4ee58471f92bddaf84605", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300106, "uuid": "7c2f1b76-8fe4-4de9-9e9c-3086c6450b3c", "value": "T1DD510E0E3003B06E79326EE2FC0B546D95716756E37980A07A0CD7D50E3666CEF82D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300106, "uuid": "ebce2af4-6e51-4940-9da5-383d82ecb1be", "value": "48:HgO2+8NmBCfaQmx2ICcIAlig1uo/e/A7naNG0QG1AyzqqpykVEjGP0BdO:HgO2+8NmBCSQmAIVIA9uo/e/A7nYASkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300106, "uuid": "6e4e6938-5165-4d59-971c-e2682d525e69", "value": 2588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300106, "uuid": "485b8291-da0f-486f-81e3-1b998ca6edbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300106, "uuid": "d7252739-7bba-44bf-90e6-841a0d064a3e", "value": "Document 234352313893.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3f1c00-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (MimiKatz)", "timestamp": 1646294315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294315, "uuid": "dfc749d9-832b-43d9-828f-2c72d0317c79", "comment": "Malware payload (MimiKatz)", "value": "36f89f2fb621a74f956e4fff35b16b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294315, "uuid": "87620e28-be68-4a19-b675-b7de67bd78aa", "comment": "Malware payload (MimiKatz)", "value": "a5c18a8ba9f44789611b8f2a9f2caaf30bd7d2298505695a8e5f9ff896bf096a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294315, "uuid": "f2afdb57-7832-4262-a3cb-2c5a02843fb4", "comment": "Malware payload (MimiKatz)", "value": "0e02ea4f1d26fb34d975d5beb8a3cb1e6d8fa376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294315, "uuid": "e9d700cb-04e7-424b-b6bb-915909c00969", "comment": "Malware payload (MimiKatz)", "value": "e0a657ce0b3edca1618326e17cff35688a52ac517a8c87104bbd53e652f5659dec531787b3275714956a4fb2949930f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294315, "uuid": "73316a9b-8ab7-499e-83a2-2a206dc24ec6", "value": "T1C8551941A7E90098F1B79AB59EF29117DBB378D61934C30F01A88B5B1F73F619D29322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294315, "uuid": "3ec5c92d-8511-4dda-a18c-fa44e9b315a7", "value": "5fe35a974638ad1c7a8a57bb04c9b01a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294315, "uuid": "7a2cf97c-6125-4f88-8d9d-2b5d68b5af16", "value": "24576:IOP0unuJVWzarjsrnBqCkZjYQcb9HN+XwscPI++QcDFj9EuyqS:IOGMrYPBcht+g1g++QchBEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294315, "uuid": "2c8de49e-2faa-48a7-bcab-cb90575ee6e9", "value": 1291016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294315, "uuid": "c9fb7210-3321-4717-ba2c-38eb6d2fd5d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294315, "uuid": "47be649c-f5b8-4504-97b0-e26432751843", "value": "36f89f2fb621a74f956e4fff35b16b63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6982b5f7-9aff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646318231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318231, "uuid": "cc871128-ef48-4a79-8c8c-3a23220ee2af", "comment": "Malware payload", "value": "2c99ec5e15ab188685b5fc701d2268d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318231, "uuid": "41257774-c7ad-4558-9cb4-0108b401627b", "comment": "Malware payload", "value": "a62f79ad682834e0d7c180f0ba81de30f30dab8aaf703dec90ca7cd515db925c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318231, "uuid": "e27a4e85-47a7-4d6b-b7f0-613980aa832a", "comment": "Malware payload", "value": "60365b7f4962ccd953cf710a3fcefde8a2d02ca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646318231, "uuid": "1d00c930-f313-4811-99c0-216405f61d04", "comment": "Malware payload", "value": "012bc4e27584dae68dafaf6f6e246a85243d1ed826d2d8981c57f86239480903e754e0667b7eea097c89c0030a15db80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318231, "uuid": "23f96f17-38da-4472-96bc-50b5cbb6f57d", "value": "T1B375010BDDEB116BFC552B71D02548B310FBF9F60F464722B6E1E60D2A70FA166384A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318231, "uuid": "1ac2c8b2-ab88-45ad-97bf-d26ead426ee5", "value": "2f095340e94ca508e3b83fb009ebf4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318231, "uuid": "32f04e44-7092-419b-b3fa-2aa7eac93ba9", "value": "24576:ScCT67wHqWis4l+jIACFr5hqjiLDpSJDN93pqb6W8cU4gLQz5A:jCpn8t74iA3qb6W8cU45i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646318231, "uuid": "7293bd31-af9f-4392-bcd1-8b47349c173b", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646318231, "uuid": "12b339e2-bb56-4375-a51c-0aae512dbbc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646318231, "uuid": "5374c136-fb4e-430a-8995-debc0972709b", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2aa4372-9ab7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646287484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287484, "uuid": "d98b6d97-35f3-4ddf-b9c4-b23a64dc991f", "comment": "Malware payload (AgentTesla)", "value": "c817e0e27fd76ad5b84ae8a2e41bbb40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287484, "uuid": "649bead0-6d8e-4499-bfb8-ff86e5bdc146", "comment": "Malware payload (AgentTesla)", "value": "a6401cbf0ffa5c2bd2dadcd2f3c177bcd92a676216d227c6a0c9e40b834c1ff1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287484, "uuid": "077ffb49-fa7c-4278-94c5-489e509f9e77", "comment": "Malware payload (AgentTesla)", "value": "f90de0eacde46b84cb8c2e1083833b89ba16bee3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287484, "uuid": "84e6f7fe-55d2-464d-b855-0f04f7056da4", "comment": "Malware payload (AgentTesla)", "value": "8472ee72c785484f3cee27b269b7a7f31a9e74016a6fcb686cea7bb5da8c77681c15a5f791b22e4de984e3edbb2515b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287484, "uuid": "7accc889-25c1-4764-a21c-790c45aa938c", "value": "T17F03F150134C333FB518C22D153D5623D2E2824EB244AAD9D1AB989E7717FCB4C887E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287484, "uuid": "38a3df7b-103c-4704-80b8-36036752e3a0", "value": "768:RN147cV0/60Si6przk64sT9Cl+G6A4gESED+ON/aL3nigYJS0:Jf0Fn6BzxhIBXHJOFMigYJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287484, "uuid": "c1f06675-7a48-4c59-b2e9-cb659f39201c", "value": 38150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287484, "uuid": "c10ed3a5-74da-4c3d-8f61-029622ebd612", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287484, "uuid": "a5807fea-d3cf-41ed-9a38-df8d651053d9", "value": "WaybillDoc_9151243522 PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c7c6c9-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298255, "uuid": "c5847082-806d-42d4-8acf-00316235f8a8", "comment": "Malware payload (RedLineStealer)", "value": "2dfddbcf851bcf2794df434c000d95c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298255, "uuid": "987d0c70-be20-4568-8cc4-a251e5cfb624", "comment": "Malware payload (RedLineStealer)", "value": "a70e4487b1342707ba6ae5a1b51796542f65f904d6778780f324c459e306152a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298255, "uuid": "a3e2c704-7e40-4b3a-a0fc-1620f8d616a3", "comment": "Malware payload (RedLineStealer)", "value": "c9ba49e325ee03a39ab3b4de9f056cef1fa49b18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298255, "uuid": "6804cce2-b3f8-4b99-b560-86736d2ec1c9", "comment": "Malware payload (RedLineStealer)", "value": "7260fe3e62a1b8a9cabf7ff113ab4c2a1ca8dc599ddec18532a931e75201b41a0bb3e737c73bcdebd40e4768220c55f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298255, "uuid": "451afe78-592d-422a-b420-e3e340d35ae0", "value": "T105D4011132D0C432D5F726774834C7B94E7BB87629255A8F7BC927BE9F246E29B20309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298255, "uuid": "4aecf77a-342a-457a-b7a9-9094a61570ca", "value": "fdc337a25282d3662375292d95cfcd8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298255, "uuid": "958d4696-4001-4ae8-8b3e-365525c183ff", "value": "12288:AvMNXZr3JORqzzRHLoav7QjwhXxuuCKlRqpdhefG:AuXZr3JOwzV0K8jwREwluOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298255, "uuid": "8147d226-4675-4835-99e4-fb19a949df3f", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298255, "uuid": "e4097a9e-84cf-4006-89f4-01488268c92c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298255, "uuid": "b8933bd8-e765-4662-9d96-3c45287a077b", "value": "2dfddbcf851bcf2794df434c000d95c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2f3e61-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320971, "uuid": "b12d2b01-fba1-4ffc-9238-8b831622d260", "comment": "Malware payload (Heodo)", "value": "27f92539848510f4058134d9e536b0f9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320971, "uuid": "715e0d1f-014e-47da-ba15-c575cd3c0497", "comment": "Malware payload (Heodo)", "value": "a74687a54c6c023d4c6a19804558a776d6ef8a6eeb0b98fba347cc38f4749bbf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320971, "uuid": "95e26f3a-2696-449d-bae7-3d9473da4546", "comment": "Malware payload (Heodo)", "value": "7559f9da7c3b30ed55c2993bbd2058bf91ad80b1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320971, "uuid": "ca6ee830-b324-4570-ba55-36721f92959f", "comment": "Malware payload (Heodo)", "value": "f3094191aad29395986682a79a936991a4bdfbb08e50924bef68676690140c73ea6b8b8d4d660600c5d69d9a0d86d1d9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320971, "uuid": "88105494-08e8-4e4b-8586-2b14653a0a23", "value": "T17F23E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320971, "uuid": "6e5f18c5-d081-4164-a5df-d907baa6ba2f", "value": "768:aqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:JrVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320971, "uuid": "10267d8d-6f7c-4fab-b468-3c112fa65b98", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320971, "uuid": "b37a4cb8-0526-4b6c-8f91-ee6b668e80f7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320971, "uuid": "76bdf558-eeae-4926-8c1f-21138f9bb337", "value": "imedpub.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bb89ec-9abc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646289419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289419, "uuid": "cea818b9-76ee-4432-9365-de3402ab33d1", "comment": "Malware payload", "value": "64c477772ad01cd3b21539a59505f117", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289419, "uuid": "6285c211-17fc-4a7f-ad07-db0a2a157f78", "comment": "Malware payload", "value": "a7f54f8e2fe407687afbb734f368d0c40441664a7a288fb35f1b009e90b5f5ec", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289419, "uuid": "ef831c12-5137-45da-999e-d4c32d269961", "comment": "Malware payload", "value": "f3407dcc648fad1e2b2f87784e562c158698ef80", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289419, "uuid": "6f87f10f-29ef-4a43-91ac-58f7988ca4fa", "comment": "Malware payload", "value": "67eee4916b7b4cd680c5f85c65ffc9348225b4ba11671da6205a246bb02e16ef2487f5a07cd86d5886668502888149c5", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289419, "uuid": "633bc3d2-f1f2-4945-b666-daf32e1cec73", "value": "T1E9525CBCE6A80EEDCF4990F5A735FE1801DCFE1A53C19996377CA270D7062BE921A041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289419, "uuid": "9ec95356-bd27-47ec-a060-ea083cb28f39", "value": "384:mSCsFY964ZHjE+oPAxdHtpbXZ3H1XEAL3j:R3FuHQFPIH7bX91EAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289419, "uuid": "09698ba1-b217-4c98-9895-a008c2f0ed29", "value": 13602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289419, "uuid": "85d971dc-b202-49e0-8d1c-c61430be57f0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289419, "uuid": "86b8828b-25a5-47c7-92bc-f80d7b8e2639", "value": "Purchase Enquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd80c985-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "5c597243-0e9e-4935-9fa3-6c924559a47c", "comment": "Malware payload (Heodo)", "value": "a04bdd3affe40b0f9b9b8e0288e79717", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "ee0685e8-3c7f-4ef6-9998-6d62582d1b98", "comment": "Malware payload (Heodo)", "value": "a82ca480fce220ec3dece3d0ad977d0122a9102db85a4e3fccfac98064b648cb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "84b4edfb-e481-44d5-a9c9-93c7082ffb85", "comment": "Malware payload (Heodo)", "value": "a369986c4e8a7958f672776498198ca95cf1156d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "dd273aea-339d-41a3-b507-0e293f458ec0", "comment": "Malware payload (Heodo)", "value": "8124df10fb8002b7ab93a789d61bf7299e9eb2d38fb284e3f03996c792a4789064c9dd57adea9054a323bfaaed4e1137", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "a6271733-057b-46e8-93f1-f3e1ad4dfb6c", "value": "T19ED41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "a8401dc2-d3e4-436e-993e-b3d00b4ffd24", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "d74e1a73-b1d6-4b99-928e-33cf2dfb2ce5", "value": "12288:DjN/Z2wkRrA9CRDCdElAjHDsndSyHOrNvEP0Oua:dEHR+CRjyfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265652, "uuid": "c3674940-16a5-4dc0-abb1-941a36f6e8ef", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265652, "uuid": "40715700-f5c6-4cba-8ad0-a226e6d66e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "1653f615-2325-403c-af0d-d123149fe9ca", "value": "emotet_exe_e4_a82ca480fce220ec3dece3d0ad977d0122a9102db85a4e3fccfac98064b648cb_2022-03-03__000044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4c151f-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646296494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296494, "uuid": "3b12fe19-fe38-4f5a-a02d-17aa2e71fbd4", "comment": "Malware payload (RedLineStealer)", "value": "3dd8de2068a9bd1e5f5df58a2c9d23c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296494, "uuid": "d480e4c1-d2d0-453e-8670-9cb649389d3f", "comment": "Malware payload (RedLineStealer)", "value": "a834bb0a2c49bd8a1920f754ca1788eaea57d3218e3bd0fd5770e5fa091a3736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296494, "uuid": "0582b2bf-f1ad-495c-8757-35d1be3d5430", "comment": "Malware payload (RedLineStealer)", "value": "77e2df1ee6b939dbd6e1c96cbc22520d89ab08a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296494, "uuid": "88f55b77-df9f-478a-917e-c9b8b654f7e3", "comment": "Malware payload (RedLineStealer)", "value": "4418d244f12affab5771213aeefcc32b824825e3cb7a90afefcdfb405876fc2f264f4a9ac4c6a55d4f018678cecdb2b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296494, "uuid": "4fe37b56-6323-4a37-a914-930d1e465808", "value": "T1CC3633E870C90A0CCE48EAB838F9F191757020A1D9F716672ACBCEC19B75D669C46D4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296494, "uuid": "872fd33c-d87b-499f-9fb8-dca426d1c289", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296494, "uuid": "3ae9c49c-d485-42a6-a314-c6ea3898a6f1", "value": "98304:10E9th5IPQoMwvzQauN2D5Kyd41PotJJ2wzurzXoPtDEtTI22hegBNG:10Q5iQauN2VKy61wtr2iMYPt9j8aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296494, "uuid": "38455269-1791-4c4e-ba0a-6a9f3e6a39b8", "value": 4871472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296494, "uuid": "52f97d9c-ce21-4350-bd68-73a606ea61ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296494, "uuid": "3a9dc2db-dcc6-4571-a078-1a6a70273ccb", "value": "3dd8de2068a9bd1e5f5df58a2c9d23c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf5a040-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646320975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320975, "uuid": "69dbd705-363a-4f75-8ff4-5d04b92a3aec", "comment": "Malware payload", "value": "31cd6242c24a0893a8c6221821543570", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320975, "uuid": "3487b04a-ae1c-4949-b5c5-89b645ae09b5", "comment": "Malware payload", "value": "a87968576acba229c196682fdd63171052de42d703a962e04f62d0819e503be8", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320975, "uuid": "b20c9f11-58b5-494d-9229-96a9b0e73f7b", "comment": "Malware payload", "value": "d1d7e4830f1f4cac4c865fa9e4971ddbc5fb3491", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320975, "uuid": "bb6b5a83-fe86-4227-813b-fbf529c5be3e", "comment": "Malware payload", "value": "154bc766fae08716ef8db98f63522ecf5346b65d79d98a94fcd8605f658251a7b9f84e01bcb445589c68e9cdbc7f1963", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320975, "uuid": "99e37ac4-af1a-4b22-ae48-f3e7b5150c09", "value": "T1D473F14CA746E560E73B1079DBC001A32A4872744AD5D98E4FE4F1BE37445E723AF25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320975, "uuid": "af237fbb-1116-4819-bb44-751235b7d4c6", "value": "1536:xOsBbzyTzHdOCMLJABK4v5D3Ytt36v6DFaDdJNN4MBnU:TbzyTJ/MLJ2NNc1muFm74D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320975, "uuid": "9d25ee41-bc39-4bb7-8bd1-30b3ce393e4f", "value": 76174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320975, "uuid": "bf0029ae-ea7e-4fe5-9e2b-2d75a903aff1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320975, "uuid": "a789271a-d8d5-4ebc-88a7-02780e9a7f64", "value": "T-12 Financials (Consolidated).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c88bae8-9a8d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646269354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269354, "uuid": "de568b78-2aaf-4601-a9d7-8dfe2bcd6f90", "comment": "Malware payload (Heodo)", "value": "b9cc598228a974ad7c66a5ddff6f742d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269354, "uuid": "3b6770d8-70b0-4cf8-a980-3e9ecdbdc761", "comment": "Malware payload (Heodo)", "value": "a8e257f9e7e34c781487c28559dec6e36916e2da9b62bd521c62d0882fdfd82d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269354, "uuid": "184e7455-3979-4c5f-a671-17058a1abcb2", "comment": "Malware payload (Heodo)", "value": "400b1cbb42283198a2b73ec663d16a3c4baec916", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269354, "uuid": "985928b1-44e4-4e2d-ab39-7166399a2ca7", "comment": "Malware payload (Heodo)", "value": "5e1c8d3f0f03bfd9691a3791c54924a4219e56f57c7429b441819804dd29a98d4a91ca0fe6f343a07663eda61c41d187", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269354, "uuid": "17a969ff-b86c-428c-8b14-0915bf0edbd9", "value": "T1E1D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269354, "uuid": "5718ea15-73fd-47e8-89df-11f3875a8ecf", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269354, "uuid": "4488c15c-f8d0-4bce-90a8-734e1bf59345", "value": "12288:ZxpNJJJ2NHPoczJxOtIhxf3foRXIa5EPwvA:Zx2gczJxFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646269354, "uuid": "589f480c-9d75-4171-82d2-62f9f19cfbd5", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646269354, "uuid": "b7bbd7d2-508d-4d94-97ef-22f46e59bc53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269354, "uuid": "341aaf70-8e5f-4a6f-82de-b41262c0d1bb", "value": "b9cc598228a974ad7c66a5ddff6f742d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c4e2ba-9ae2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646305896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305896, "uuid": "5d4ec15b-4554-4c17-9a5f-7849df43b95c", "comment": "Malware payload (RedLineStealer)", "value": "e2085b363d82af732a4226309217377b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305896, "uuid": "d13255bc-3cb1-401a-a7d4-a6814b9aa318", "comment": "Malware payload (RedLineStealer)", "value": "a903b038cc4e1bb726d0c8567c1f7cf41da3208ca97cce4eeb5877a7d9ac7b34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305896, "uuid": "07ba0691-bcbd-4be9-b03f-b55a83abbbb6", "comment": "Malware payload (RedLineStealer)", "value": "a15ad309fa9019f3d32b3509702ffe7eef3096ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305896, "uuid": "340ac4a8-0b3b-4778-bed8-1631a013d609", "comment": "Malware payload (RedLineStealer)", "value": "67db28aa01825b0375436c8079f787265ef5f6babf27842281bf310e67ecaa59c625bf25bcf806d008b7983dd9e74972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305896, "uuid": "41a3b3e3-3ad7-4e3a-9b0b-32af12323f1d", "value": "T119A339A067CC8624E2FE4F71ACB8109443F4F443A502EB4F5EC960DA0F76B42AA567F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305896, "uuid": "79beab2a-e8c4-4523-ac23-ba83bc3ca069", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305896, "uuid": "0af90db8-d238-43b0-af9e-fc35b4047d49", "value": "3072:ZucUJyCCNYn0SuObfyPhFiU0cLH1Mvg9mS:ZucMbo3fj1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646305896, "uuid": "e283a6e8-9815-4c9d-8091-62068b637335", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646305896, "uuid": "1e21ff07-1b70-4560-babe-463a3c6e6a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305896, "uuid": "cb97918c-337c-459d-a6c2-2a07e3f6344d", "value": "e2085b363d82af732a4226309217377b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca2929c-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (PandaStealer)", "timestamp": 1646296950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296950, "uuid": "1d281d45-a310-442a-8f72-4f0461299001", "comment": "Malware payload (PandaStealer)", "value": "43c72a273a4c430c9fda1654cb9be2cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296950, "uuid": "e89d9b85-e581-4788-8c30-005e65b074f7", "comment": "Malware payload (PandaStealer)", "value": "a97397b1d9ac7e1b1aab153d2529680c0d6f0977c9e2f68c3febd1661629dbe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296950, "uuid": "61775348-7ed2-49cc-9a72-fdf25dd29608", "comment": "Malware payload (PandaStealer)", "value": "5fc4ee57193abd315a5910035cf8ca7f7d06c50b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296950, "uuid": "54a76805-2281-483c-a114-f1d0f140ea1f", "comment": "Malware payload (PandaStealer)", "value": "0eefa9a6c9a6dfd37fd191a331e2a309acc1bba5fc0cb943dfb93978a73e4ceed98d0b745cf429e446e6fdc6bc9078f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296950, "uuid": "e6b10546-e8d3-4ad7-b7ab-830ebff09c2b", "value": "T119C4BE17E6428076E4632430265D9B7649BD76300A2655BBF3C42E2D9EF02F2AB35F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296950, "uuid": "86b371c9-f2af-4cef-8236-0660cf4ed413", "value": "06c6e92acd3ff57b00b3132976b3f6d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296950, "uuid": "b2ff8793-5049-486d-b1cd-6bc6b1f612de", "value": "12288:F7vT8cGUCZmxIwNjVGCXZqmmJUL+JHkdIUnjoqhwgw4d:Fz4BUCZmxIw1VGCXZ5mJdkdZnBh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296950, "uuid": "c6611015-b091-4c28-b754-71044601c9a4", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296950, "uuid": "a4d55f2b-c2fd-4814-b12d-aff599574be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296950, "uuid": "35ec60d3-f663-4b15-87b8-c4479b97ef0f", "value": "43c72a273a4c430c9fda1654cb9be2cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd6a89c-9a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646268736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268736, "uuid": "0d4a80a3-05a8-4bbd-8899-6152ecab325e", "comment": "Malware payload (CoinMiner)", "value": "7b2c3a86376b02607c6903f53c9f977d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268736, "uuid": "d02c738e-4ecc-4d25-898e-3594209ea452", "comment": "Malware payload (CoinMiner)", "value": "a984daf88ca5b95be07c38888abaac8d0f4241cc67b3fc5e8e798a5fed89bc6d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268736, "uuid": "58e03fec-b14e-48f9-ade2-5fe498306118", "comment": "Malware payload (CoinMiner)", "value": "6caaa72da28bcf0e0f0d8d2fb1b9ff1145dae19b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268736, "uuid": "f75b6532-ce04-47d8-bd48-9e4e4096ef9c", "comment": "Malware payload (CoinMiner)", "value": "38f9c3305a6ffd00cbc36072765f07e807a1607f07781640e8fda7e208282e515a1f22cc142da0f65f263fdb05ee87ae", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268736, "uuid": "54a4d025-bbbb-4f7e-b905-b02748de41bf", "value": "T16893291973DC8E26C2EE96747470021503B5E6672427DB8F6CC8A4BD1E637CC4A62BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268736, "uuid": "a8f80acb-c798-4b2d-94fc-eeb8e3470283", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268736, "uuid": "ae4226bb-e55b-45e9-903a-b2727af24d96", "value": "1536:AE4oaDsKIHZSPHf9oHEMu2jwRzAC4aLpApb37drMHfRx1b/gvwVcl:ABILHZSffqLuHib37drkMvqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646268736, "uuid": "7ff54b7d-3aa6-4b23-80ce-92b421d7a75d", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646268736, "uuid": "f014ac39-a9c3-48dc-8f82-f90132f91724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268736, "uuid": "86e4c506-8a44-4354-a1e3-0d001c03363a", "value": "PunisherMiner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db65986d-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646294371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294371, "uuid": "a6960619-fc56-4e38-a572-91c41cb8fd20", "comment": "Malware payload", "value": "6bfb1a3e73e5af07ca20d725e7742e9d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294371, "uuid": "e627a7ea-743b-4867-ad24-b42f8477106d", "comment": "Malware payload", "value": "a98536cb74fa83a55cfc9355b8a861084bb6f59091b3e99ccd49324b179a9e33", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294371, "uuid": "c74dd0f2-c3d0-44ce-a1d9-e3010129fb94", "comment": "Malware payload", "value": "9a41f738c49e507caf58a402d1070ee1d5665457", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294371, "uuid": "d4605804-e299-4646-9d8e-f83a7222553c", "comment": "Malware payload", "value": "4f21890b081bea627efcd14710e024c98a597a1208cebfe96431a6f96063b6796b880138adcdb61aaa2ae7af3f4a9ea0", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294371, "uuid": "726babe7-1f23-46e8-9963-c52ba084e76b", "value": "T16C04DF81B586C416DA9807B61CE6D6D57723FC249E7743873684F32F1EB7AA0CD22217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294371, "uuid": "b6578825-8511-4c8b-bed2-33b9092c1b77", "value": "3072:3rxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAH1/U8ITUxViNSt7TqkcfqGWJjF8F/TZ:bxEtjPOtioVjDGUU1qfDlavx+W2QnAWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294371, "uuid": "481ad1fa-5847-4597-8535-3522f7a9b53f", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294371, "uuid": "8eeb7d3b-230d-4c72-8d16-649cc53207f5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294371, "uuid": "46fc465d-c5be-4c5b-88e3-efb1abb5aa52", "value": "Pago.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c947eeaa-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320969, "uuid": "42e3a283-aadc-4958-806f-0ee538eed341", "comment": "Malware payload (Heodo)", "value": "7ffda671fd611cb1f8a019e7fd0d32d7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320969, "uuid": "6e9f0a44-9aa3-4ef6-aef4-7c8e960c2232", "comment": "Malware payload (Heodo)", "value": "a9cf13cd57afb263cf00b0d1c0a39ca8245f976dad53eaa5f1f2b70ae0660a1d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320969, "uuid": "5383eecd-144a-4541-914c-31e141a90748", "comment": "Malware payload (Heodo)", "value": "070c78521206d2c02267f4ea30c26ae73185efc9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320969, "uuid": "d57a4869-4e76-48d9-9ece-ab21e774f4fe", "comment": "Malware payload (Heodo)", "value": "396933b48e1d53ff41e6407180efcd8e96e0fdba63a8e789e7a31708b91ec99cb59c71377741011551d55fd85dcaea08", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320969, "uuid": "a192373b-19e8-4a90-a216-6495b4f85ffc", "value": "T1F523E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320969, "uuid": "daaf2409-b8c8-4d60-8261-bdb0fb09e309", "value": "768:u/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:u/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320969, "uuid": "d2eb632e-9771-4d90-88ee-e82c319470a8", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320969, "uuid": "744706d2-ae83-4c84-8535-a41ee8dea445", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320969, "uuid": "955d00a3-0f53-44c8-af5d-2849e702d102", "value": "iMedPub LTD_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97309080-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298122, "uuid": "fb6c2368-f8cf-4568-b41c-ce02c62894ad", "comment": "Malware payload (RedLineStealer)", "value": "2d465f705ab0d5c94621bb2efc34e309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298122, "uuid": "aaf71c51-87fd-4d79-9cd6-fdf24d12d741", "comment": "Malware payload (RedLineStealer)", "value": "aa9cee19ccf716d1b4f552ebff91542776e2b17b9a8b4aaf5b1a99ac07771969", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298122, "uuid": "8b1bfe53-d0e6-4d62-80ab-1cdddfd1de6b", "comment": "Malware payload (RedLineStealer)", "value": "07110069bbcab9c370d67bc133693bb7125de77a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298122, "uuid": "5ac39a35-9b2c-4adc-96f6-96e78b828be4", "comment": "Malware payload (RedLineStealer)", "value": "dd3b3e0598d1b272423ec6ca63a9dde56debd9b35dcbee049044b17266341d83ae0d73fc3307e292bb2e34223e8fe2e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298122, "uuid": "33bc4a3c-d917-4630-874f-56241186f149", "value": "T142657D0122F5E07AF1F31978912B42688F13BC5555B6840F3F3CBD6C2B76E45893ABA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298122, "uuid": "e0c09de0-0484-4db7-8d1b-24599e8f499e", "value": "bdcfbd355ded2508ece8f7e349dd7c8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298122, "uuid": "1f449d65-ca35-4b0c-a7e4-57cb9b914598", "value": "24576:GqnOJ/ZKBn/TliaIfs1ZxXUgzEHVINrxPSDemB:GqnFLlxIqjzFrxPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298122, "uuid": "c718f8a1-d461-4696-a48e-41a25be70e46", "value": 1519776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298122, "uuid": "99164cbc-8713-4e88-a5a2-dfcadc2da87c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298122, "uuid": "bc781698-824d-4842-ab57-8f8f0137720a", "value": "2d465f705ab0d5c94621bb2efc34e309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5887f737-9ad9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646301882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301882, "uuid": "74fcf896-089d-445d-802f-d3009c3df4ae", "comment": "Malware payload (AgentTesla)", "value": "d8e4286fb7598f2abd4ff8fb87a15bc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301882, "uuid": "dd17e17f-f605-4459-b231-8136f4ce82a9", "comment": "Malware payload (AgentTesla)", "value": "aae422a27a4130b55ecba08c9b6f0a022c7be5be5bd11dc1e27fada2ae511dff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301882, "uuid": "8e4a98e0-960b-4f19-a272-b11d42a0c2ad", "comment": "Malware payload (AgentTesla)", "value": "6da187cbeabf2ba0043b367855bd6b96ad2f195d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301882, "uuid": "7dbbad2b-f774-4984-877c-26a991dd2126", "comment": "Malware payload (AgentTesla)", "value": "416a9edf570996423c407cb31842a4c64cd69a82128883c3a91d7d991dd21595301420f64d0871210a14f88885726c37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301882, "uuid": "e29e9a05-b6d7-4c1c-aafd-b23e074e3bfb", "value": "T14D03E51A7892965DC5D47BF869B1A19366367CE10124C08FECF97F2AAD33223DCC216D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301882, "uuid": "d7531ae6-cdf7-4bad-aed4-16545284c407", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301882, "uuid": "a08bb633-889a-40e9-9fd8-5e26cc047295", "value": "384:Lm5Nb3nzUeZmwQ6ulaiJMwCKTH2S3dd0hUADka9T:LIbwq9ml7MwCKt3deVDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301882, "uuid": "d8b1b341-b0d9-4bf8-a492-a570e061db9e", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301882, "uuid": "1705a544-aaaa-427f-980b-bd08ef1e0e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301882, "uuid": "060325fe-8e68-4869-a300-e047130c34ce", "value": "70921578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f52804f-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298055, "uuid": "b8cfebce-966b-40b9-9068-9697c9827b8e", "comment": "Malware payload", "value": "00f02de5e169d8bfce1ef60cb59df7ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298055, "uuid": "90991cac-5cc0-4524-a714-d9846ffa5dc3", "comment": "Malware payload", "value": "ab137f6379fdff534ffe92a8522189594bfa7f3ecb88ff3198472985f827157d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298055, "uuid": "740a2c72-aa76-4ad8-9c72-960bdb209880", "comment": "Malware payload", "value": "720dd0269c5cf925ac23dcb303d6d0018bf67317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298055, "uuid": "8a666103-1e58-404a-b476-d1c1250f4438", "comment": "Malware payload", "value": "4546f18700a5b7ce7d21af82d99353e321b4c32e3db6b3f3e50e73f08e0eb38a7247d909ac60a2fd3e32bd9b86d5e677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298055, "uuid": "81beb8b3-1f3a-42e7-9f3a-7eccd14df222", "value": "T1642633ED03289501E6890AF83DDE619FFA05B699E899518FF1DD72AF8E406434D0CC9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298055, "uuid": "633d3083-4210-4ca2-8d97-0ad7512c99b6", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298055, "uuid": "0d99c8a3-034b-4775-a010-81ad217337a9", "value": "98304:So+BtKQfcDnGN4b8F6Ix4RQVjS5YwmCuZYrT3yqixfFagtS:S94lqN68F6o4RQQ5YwX8Yv3fixfFav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298055, "uuid": "482303b1-d41f-4336-90d2-a5360c2c5f45", "value": 4538880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298055, "uuid": "3bc9e6e5-fc1a-4f9a-94e0-523320cd5202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298055, "uuid": "7027a276-3a22-49ce-8f78-e706d4ff0172", "value": "00f02de5e169d8bfce1ef60cb59df7ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dceb4087-9adf-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646304681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304681, "uuid": "bb8f00fa-4aa7-4e15-ba64-6ec97da2e1b1", "comment": "Malware payload (RedLineStealer)", "value": "d01b20ae9840cc1feb6349f79535a586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304681, "uuid": "ec567220-8928-455d-a976-9f02a59f45c1", "comment": "Malware payload (RedLineStealer)", "value": "ab2d09924c2d12b36a67daf32bcf6c2d3e34938a36e69365a0339e7f2d73a9a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304681, "uuid": "d2b82678-1a72-40e6-a03f-95c95f8a43c8", "comment": "Malware payload (RedLineStealer)", "value": "176e31504f340e917dee64995d2b558cb04985a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304681, "uuid": "3385f3b8-3895-4088-8b64-e98529540ae0", "comment": "Malware payload (RedLineStealer)", "value": "b5e83abb5468bc1f33c12f5c0c0d06cf983ae01c13a2c7dcb8f138ba9ed2d899cfee24cfa73a19a1e31f348bb2dd38f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304681, "uuid": "660c73ca-a215-49b9-b540-7a65a457a0fb", "value": "T13F26237715680062D0D9DD3BC63BBFE231F626B68E43E9B8B8D8ADC11A168F1D611D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304681, "uuid": "f1ddc2a1-16ca-4d4d-b472-e5fd8d0e04ab", "value": "b2ec5e305a410e6442f3911ef61575a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304681, "uuid": "78a751a4-a50b-4454-be55-6600dd0d804e", "value": "98304:8P7QhJjHrOeDsLIWo4pcFae0zCQK+46YEG6e7RBuvWP:g6jHTDoICcIe0z0/vX/z0WP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646304681, "uuid": "77512abd-83c1-44d3-9d45-c741eecd67ab", "value": 4753048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646304681, "uuid": "3027bcd9-bc6b-4cbe-a567-150401e5a077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304681, "uuid": "bea5a66f-f9b8-4575-93c8-60184a387e11", "value": "d01b20ae9840cc1feb6349f79535a586.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69daf62d-9ae4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646306636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306636, "uuid": "65fe562c-ccca-4e24-a55a-360e7875af20", "comment": "Malware payload (Mirai)", "value": "ff8cd18d9f745b5f9e6fcbf19ca3b3f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306636, "uuid": "e997503e-1df2-4f41-b8e1-526bac98fa64", "comment": "Malware payload (Mirai)", "value": "ab3394398f271e16825d63ba6498c922a811e09a9ade80cd09919401c1aa7610", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306636, "uuid": "be7df126-a0ee-432f-93ed-bd45f0a685fd", "comment": "Malware payload (Mirai)", "value": "ced7b811957e422ace45a4a2542ce6360b3ab02b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306636, "uuid": "1b3fe3ca-660f-4bbe-8678-09cabf40c9cc", "comment": "Malware payload (Mirai)", "value": "eb474887003d030fa443050bab341c2a76fe5596a0cd1f2410b3d0cc0a711db062d2a8e013e2d88e437a5c62d639426b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306636, "uuid": "16dacd80-a8d7-47c9-a3ee-5c67ef68e793", "value": "T11B93751AAFA05EF7E8AFDC3346A92B4524CD54162588BF75BD30D818F60E24F15E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306636, "uuid": "83186199-1e8f-465d-b622-b46cb40037aa", "value": "1536:WBmeds039ZBL/tS7Bp6/C3uqShpkzFjSAlX9DZy7HCPB:imeds039f/tMBp6OdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646306636, "uuid": "c7f762ba-31e7-41e4-802e-c703a2f20ab6", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646306636, "uuid": "a1026938-93da-4e19-ac4d-c2da1ad4e7d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306636, "uuid": "e9fa8be1-54ba-4f30-adea-95f6c60341a1", "value": "ff8cd18d9f745b5f9e6fcbf19ca3b3f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ece501c-9b37-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646342292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "33d7ff37-39cd-40ee-a891-123b4fca39ee", "comment": "Malware payload (Heodo)", "value": "6767db2a8af7b144f58cc1995c1d7353", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "77f73900-91be-46ef-adfd-4326ec05b201", "comment": "Malware payload (Heodo)", "value": "ab4f913a6ea3183a084b2fdde7f24dc03c7eeea346ed78138c7dc3c66e5cc06c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "a71f2093-ec88-4433-8549-2153137a9725", "comment": "Malware payload (Heodo)", "value": "93550c2f930b065c66bea266f250e651a70b4489", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342292, "uuid": "51bdb0fc-0dd2-42e2-b480-7f2d46c6354a", "comment": "Malware payload (Heodo)", "value": "6f8ee44a87cb2f20b5a52959795920e6b2e0cdd89ecdeb08734856a46d2de3d4d607fa111d73772e3d26109a628c4555", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "07346146-0690-457a-b4d5-e5f746dd1389", "value": "T1D0D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "508f2721-db03-4139-8ac9-d2d293e27239", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "c59484d4-2871-43e9-8a78-9adad2638d5b", "value": "12288:J1U8sNY8/z0rYebzwdOCoGEAbcVBLku8w:oq6z0rYcMdOVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646342292, "uuid": "58cf7219-25c0-4f9b-a1da-59eeacf702ff", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646342292, "uuid": "7827a503-07c6-41c1-953e-c6cd98c52213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342292, "uuid": "2d95e170-2228-4875-afb0-8c4de66fabec", "value": "emotet_exe_e5_ab4f913a6ea3183a084b2fdde7f24dc03c7eeea346ed78138c7dc3c66e5cc06c_2022-03-03__211806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5e1ed5-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298667, "uuid": "cf0be033-0121-4c2c-9a4b-00932d388b9d", "comment": "Malware payload (RedLineStealer)", "value": "6fc69715ac4c5622d71da0c7787f3c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298667, "uuid": "a9dade5d-8ffb-4b19-9647-715e658c1eea", "comment": "Malware payload (RedLineStealer)", "value": "ab641dd1be68180384781bbc81d417c6de2025981e0777199b404e15f46516b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298667, "uuid": "85ef150a-8601-48f4-8de8-ad9c382fb942", "comment": "Malware payload (RedLineStealer)", "value": "2a2d4e6c10a28a4cbad37ac66f647143b03df62e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298667, "uuid": "7f45f0f1-0f60-4538-ac5d-a2a8ac601f24", "comment": "Malware payload (RedLineStealer)", "value": "6a9f27d6e0b32fa7e58b68786f39cd82fcfd16ea79f16d3fc725c8f77e54de1d52657c49164043267fe5122b3bbeaee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298667, "uuid": "4497bef7-564a-4866-8588-30af0ecb08e8", "value": "T19F1633C211A09DC3C0D16EF57E927A8AB0BA110396D8E74DE9F34674DCAE6D6C5B80F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298667, "uuid": "1f3d1a32-d573-4d73-89f3-ececf1271383", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298667, "uuid": "0b4b9bf4-be09-4d5f-83de-e72df57e8ab9", "value": "98304:7k5KokIGjifuHc0Jil2TZKax9dCUia10WrbniOy4SCTewCX2w:wxNv0cCZKax9AUia1Tbir4STw+2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298667, "uuid": "7cea3a38-f927-48c5-a14d-50860fffd5fb", "value": 4048328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298667, "uuid": "bad09145-6656-4b9a-8eca-d26fcbce08da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298667, "uuid": "0cbd7757-8427-4104-91ae-50e16d6e7c8a", "value": "6fc69715ac4c5622d71da0c7787f3c3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4390183b-9acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295834, "uuid": "e2d450ec-d544-43d4-bbd0-50dbaf1cc2db", "comment": "Malware payload (Heodo)", "value": "cc8d777653e7ed6e223ad238c44bd961", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295834, "uuid": "102c23f1-7f83-4cbc-ac8d-d488df662ab9", "comment": "Malware payload (Heodo)", "value": "abadb7954d3652af6f07c906377a42f3d7a135ce659fbefb69d8747b8952e6eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295834, "uuid": "c791fe71-5401-4b61-9bfe-a7eaff9ddbd2", "comment": "Malware payload (Heodo)", "value": "6f4586fd6657ef86fc9e5e7853fe0879decf6fad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295834, "uuid": "aaea1b5f-74d8-4ec1-af98-aed373a850d1", "comment": "Malware payload (Heodo)", "value": "e51844257f85821943ce885ad64e8c9227a8e76ddc1d3598fab8e88d83fc39ca437ae25baef46be3d8dca5df16b08773", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295834, "uuid": "ac922c62-6f19-4a46-ae75-1ea0cb131727", "value": "T186D41B017498F0B3E38918B04A858AFB724B5DB296117073F2ED378CA7725F15CE766A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295834, "uuid": "2b1ab035-91f8-4430-9244-8ce1965cac43", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295834, "uuid": "446cbb81-0d09-4e7b-892f-c1cc7c2e2493", "value": "12288:pao0Se86lloPxHHVVIjqxEqRVoQmiIII999tLLLdAkkJoFLZZWbClgluPcRBATf0:AqxETMJ777u3OmONFqNJtN1v96TOAnO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295834, "uuid": "ff700994-4b34-469f-bbba-404d081b4ac6", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295834, "uuid": "059ae76f-c2d0-432f-8d96-e22e77070b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295834, "uuid": "e0992bad-5b74-4d57-b71d-b33f02c45a15", "value": "cc8d777653e7ed6e223ad238c44bd961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ff7d84-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646294544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294544, "uuid": "56f74dd3-013c-405c-9ef4-5fc39719ac80", "comment": "Malware payload (AgentTesla)", "value": "8f81bb127b83c6db295a660eab8280e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294544, "uuid": "cf11d640-80c1-4753-8599-95e13dd75652", "comment": "Malware payload (AgentTesla)", "value": "abe90e7017d88949712a492973c19c7143d107a8e699a8d25439cc27cae17c26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294544, "uuid": "0e37b797-dec0-46c3-aafb-c18c19a81a3a", "comment": "Malware payload (AgentTesla)", "value": "fbd7eb49aecddea2a94e408a94e7a59ac3404cdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294544, "uuid": "6f44cf53-85ca-4cbc-af5a-5ea40a234b55", "comment": "Malware payload (AgentTesla)", "value": "75b1fff820b82585d9f85aca3d209adb2cc07e92edbc17d2e610171e47db6b7c47d739968f3b68b39ed31b469a06e934", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294544, "uuid": "8ec8e749-9f45-4f98-9d8e-b334306155e4", "value": "T10514120E2952E8C2DF9F993700302B25889BFE8798D190DE7838BE3597777B851A355C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294544, "uuid": "11ec0431-4bf7-4967-9edf-03c2cb8e2563", "value": "3072:LG+aipt6ZXKSuV5+XUjtzu7SQl8IL7j7hZhqu/POcDzD0RU/4eFO1/WwoLuN:Da4Uc+XUjtzubW6dPfcRbv1OwoCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294544, "uuid": "3f43975c-c8f0-418c-8b5c-498df000a0a3", "value": 191368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294544, "uuid": "fd736e5b-ec8c-4d17-8d08-ce6a4e63d6c0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294544, "uuid": "c9bebe93-d75e-4c47-bc14-573beb754f17", "value": "new order Sapco.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cb613b-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646296854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296854, "uuid": "e7e7169e-9188-4b8b-b9dd-339a8c426d58", "comment": "Malware payload (RedLineStealer)", "value": "3cea89e3d37ef863e7b72daf7c13b925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296854, "uuid": "644603c2-729c-4681-990b-6d43ec934b30", "comment": "Malware payload (RedLineStealer)", "value": "ac11513e0ae44da690d7456df22d6874e0b29f97b5c0aa9286d7c59492f323f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296854, "uuid": "3f1080db-f6af-4fe0-af61-72989d1503a7", "comment": "Malware payload (RedLineStealer)", "value": "900c2cadb9633d0d6cc6b85fafcfb09c40a5775c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296854, "uuid": "77184ba9-1b3a-407d-a30a-2ca5b56470b0", "comment": "Malware payload (RedLineStealer)", "value": "eadb1ca51b7dce29de1b1a4484f687dcb22918a84741c82b1080ae9fa5b1f14403468e59758f4d7b867e8c292533a0ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296854, "uuid": "97fec167-8bb4-468e-a5b8-7a877ba25832", "value": "T15B94DFE07A81C936C0412E308416AFA549AFFC11ED67D603F7B9BB4E2A723D152B525F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296854, "uuid": "edd345c0-7723-4bb7-9ffd-ba6c0afe81ad", "value": "ac28fe22f41d923696527394756551aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296854, "uuid": "1385c31e-7290-4c8f-bdb0-60ac258119e7", "value": "6144:+A1nsRF6stwN3p2oNYvhHF9/29oAmf7ITsqxeigapKgQ:+qnI6stwN5lYZPZ7uThKgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296854, "uuid": "1d40e644-af0d-41f2-86f7-c88de94ebf54", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296854, "uuid": "4299eaab-fe8a-47af-83e0-1bfff141b50d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296854, "uuid": "ca9ad263-7109-4371-9ea7-227831bae1a0", "value": "3cea89e3d37ef863e7b72daf7c13b925.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ecbbb1-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646300247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300247, "uuid": "ea1c4640-20dc-41d2-bf65-5d4b325d9a5d", "comment": "Malware payload (RedLineStealer)", "value": "827f6f2404843facd637d9ab47133720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300247, "uuid": "4ea965d2-909f-4ea0-a692-04146d05ef6d", "comment": "Malware payload (RedLineStealer)", "value": "ac4487f0af2eaca1385383f99011fd7b81659f5b4426bbf86e6afc9ff9a1dcc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300247, "uuid": "639c1b0d-813f-4c7d-b837-c7890b0097cf", "comment": "Malware payload (RedLineStealer)", "value": "c845a2087ebe14c5351d062aa4e1a09281059121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300247, "uuid": "a475fef2-7292-4a2c-b164-871771564489", "comment": "Malware payload (RedLineStealer)", "value": "1517362317350cc86bab9cefb2a3f5bc7a8f1aee1e5af524f219c1aed96cc45ce6cb5790b0e94ad95e5443f5d8636739", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300247, "uuid": "d0f4dfc4-7a8e-44da-9ec4-b09c8fd66830", "value": "T146C423287807E3D7E8C76A762B36E2286692118A1CD78241D7EC37C9F4EC515770E1AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300247, "uuid": "4272552b-937a-41df-b169-0f6543874939", "value": "a46b056f1965aa9a62c3f21951e41446", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300247, "uuid": "fa717982-dfbb-4aaa-a91c-d5d5941273ac", "value": "12288:6qTyHjuoEb8+Om8rExawx0SkFK/lGRgOUqmq9kR6lhKX+FxRpBI4YzBjH8:LVoPrExawx0SkFK/cRgOnmq9g6hFDpy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300247, "uuid": "7ea10f57-687c-43e2-97f3-0f9145e5ecc1", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300247, "uuid": "39f01939-abda-41eb-b892-1bab85c2c4c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300247, "uuid": "fc2af718-a7ca-43db-a1ac-6e4e06ffbc6d", "value": "827f6f2404843facd637d9ab47133720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3600a9b3-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "b7c5ec8c-f1c2-4500-88f2-75a1a95fe8c4", "comment": "Malware payload (Heodo)", "value": "1f42826db7bf504f3e1ae0f69f968fa1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "798d58ba-c69b-4c4d-9f26-e4788abcc97b", "comment": "Malware payload (Heodo)", "value": "ad1880b1b74a10227bcdd2cc8d1617cac0fbf94106bddb82a63d4af4ff626499", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "bb94014d-4d87-44d0-97ab-fbfbf95c27be", "comment": "Malware payload (Heodo)", "value": "0e9920611b8b91c732b8d470100d1921ccab0d1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298818, "uuid": "282d8477-ef13-4fc1-9958-7166d574e2bd", "comment": "Malware payload (Heodo)", "value": "f2c76933ca9c5c0603500ac77539f3eda3fa8cdbeb46d0f3cdadc3133135505723b33eb9670c85b13f0a5d8ce22d3ab1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "a59d4add-bc38-4e22-b301-934aa7ace136", "value": "T12D353942BA48C5BDF04E08B9181EAA69667E1C447B3296D7338C7FDDBB319F90832517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "3a8c92fc-0d3e-48cc-9e2f-80c334346e7a", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "63e017b5-e9c4-42e7-a13f-f9f98b02d62a", "value": "12288:C4rjnpAeev7HmOsVUCfbWierRcDFtLlirkf0csMEPe6MpPfXxiDjM+R:5rjpAbv7HmOsiR1cDFXiQfJsUPv4DjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298818, "uuid": "6eb20975-03b7-440c-ba10-59c148088ffb", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298818, "uuid": "5bf164c2-cb5c-4714-9d76-74e3eaf85539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298818, "uuid": "9421081a-0de1-4cfd-9eef-5774e2886930", "value": "emotet_exe_e4_ad1880b1b74a10227bcdd2cc8d1617cac0fbf94106bddb82a63d4af4ff626499_2022-03-03__091332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d86d03-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320747, "uuid": "ea1978af-f237-4aed-9a8c-c1bf97625cc8", "comment": "Malware payload (Heodo)", "value": "bad83b848c148bca6fcbd1b0298b7e06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320747, "uuid": "fc967be9-3d80-462e-8e16-a4d18cb50058", "comment": "Malware payload (Heodo)", "value": "ad47e82fd670e82b240420a7d9dc8c3e44e7ba11180936c6e106740e816a96c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320747, "uuid": "f82596ce-dbde-44ca-a2b8-3c56ef131ad1", "comment": "Malware payload (Heodo)", "value": "1fd0eb0a476be04345da99a240bbe890df098a1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320747, "uuid": "c72f691e-a116-46bc-83f8-15b62b831e7d", "comment": "Malware payload (Heodo)", "value": "f5e25b5277df246bb1a89afe26f676e6cd838677bd6f03b41b48204b4f12fc6cc852b6a17aa1e5ae25e058e249620115", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320747, "uuid": "e9d98371-876e-449f-b0f0-189becc03ef3", "value": "T17E353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320747, "uuid": "2fac081d-10b0-4310-84e5-a92ec874d61b", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320747, "uuid": "b6a48189-d918-4d0b-9fb8-ad14a8c5044a", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZq1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1Z4ytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320747, "uuid": "b83ddccb-7a55-40e7-90c9-770d5036d605", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320747, "uuid": "b7ed62fb-f74d-4d3b-a101-27ae0ef94d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320747, "uuid": "61176f23-aaa7-4f2d-8642-8b35efcbd4a2", "value": "bad83b848c148bca6fcbd1b0298b7e06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4cf2cd-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "d34eecd4-9239-4838-8175-a6d7214fb091", "comment": "Malware payload (Heodo)", "value": "ea3f3b788342764bd8cf123c4086c5ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "c2aa68e4-ea79-436a-804e-9d28e2f2769a", "comment": "Malware payload (Heodo)", "value": "ad7e1df7cd7dd17f53c5a17379a42ed79c75628066e10c2d17e608879f32c307", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "614aa795-dac0-47d1-bb7f-3785b6d4b744", "comment": "Malware payload (Heodo)", "value": "75c3b1d1964a716f9387752aa059aa7776a11393", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298726, "uuid": "83ea30c8-3107-43a3-bbc0-5ab81102fdb2", "comment": "Malware payload (Heodo)", "value": "7c365c00ffc66bbc0206a37c2730d34ca702986d42929d4dad9bc2ce7c9bb6b20f1dbcbe081347b9dafa441241314fa3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "76cdc6a8-cf54-41f7-855b-b981763b8815", "value": "T181353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "844e380a-68e1-41fc-bed8-6c33afb557cd", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "1a3cee00-8ae5-481f-8458-aca63c41f990", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZQ1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1Z+ytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298726, "uuid": "0830d176-b5ea-4be3-9bea-91f6a7c6574f", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298726, "uuid": "b0e3e264-02a8-4f35-bd36-5c1d75695bd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298726, "uuid": "42b99000-b252-4ca1-9179-a781251cde36", "value": "emotet_exe_e5_ad7e1df7cd7dd17f53c5a17379a42ed79c75628066e10c2d17e608879f32c307_2022-03-03__091159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53224ac7-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "6b099d3a-96cb-4e08-8bd4-bbfdc5c3ebfe", "comment": "Malware payload (Heodo)", "value": "ee589258c669cf1db96670c224a34d32", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "522d4b8f-c004-4a6c-a518-3d147a0d29e6", "comment": "Malware payload (Heodo)", "value": "adad86997ada05344b33b229efaf749ca84b18eb4ccfcd81ed0608f62dd4ddcb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "61e1b261-d7cc-455f-8864-557aef13b1b0", "comment": "Malware payload (Heodo)", "value": "2716d592ba03f0dd12c1e357560c3d5a09490ed0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265795, "uuid": "827125b9-994a-471c-ae13-36b6f7366b33", "comment": "Malware payload (Heodo)", "value": "a251eadb56c6f1e40b0891a699d4a367de315f3f207c68e2bfe4bb1892930ab91b5a7b0546a66eba4ce9823fdd6fb237", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "90b7fc06-fc3d-45a3-bf4e-6c09acfbc7ba", "value": "T169D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "a298efcd-6d99-4446-8690-b70a0cf5df35", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "2fe130cf-34b6-4545-95ff-8da647b436e0", "value": "12288:ZxpNJJJ2NHPoczJJOtIhxf3foRXIa5EPwvA:Zx2gczJJFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265795, "uuid": "ad8cf242-ee0e-49b5-9964-82edde53cdc7", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265795, "uuid": "a51da76e-703a-4a4f-a9ab-9ad47c8758ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265795, "uuid": "d083abba-7ce2-4ee5-bceb-fb840cd9d148", "value": "emotet_exe_e5_adad86997ada05344b33b229efaf749ca84b18eb4ccfcd81ed0608f62dd4ddcb_2022-03-03__000306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3601e28b-9b41-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646346492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346492, "uuid": "02a2a2f1-da1a-4947-acfe-10e86319dbeb", "comment": "Malware payload (Heodo)", "value": "f81c3cede61433e632c6fe9dc4c5669e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346492, "uuid": "206536fd-19b0-4ac8-8289-596b98f25225", "comment": "Malware payload (Heodo)", "value": "adc8ef97467e7e33018d702a893154e0888e22a7f1a87006d9413497d549266a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346492, "uuid": "6ea15cce-74fb-491d-a41e-2d4a4b479529", "comment": "Malware payload (Heodo)", "value": "5a50e50dd82896d2ce8700d10f95d0948abcc5fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646346492, "uuid": "0106a8dd-1038-4eca-aa52-ba4e15a8e054", "comment": "Malware payload (Heodo)", "value": "ec08f199ab4affb00ed7794571a64e1b956518c6a06b43fcde949fd101bc68f4be421af3bc706421e8f3165ce330cf5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346492, "uuid": "36d28d6a-4602-41e3-98bb-93bddb24f792", "value": "T129D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346492, "uuid": "4fb4524e-3134-4745-b38c-f5d0c1737590", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346492, "uuid": "e339ba2c-40d2-4777-8cd1-dff87274de7c", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLhCjzhmD/bwb1r8Hc:Bg4IqjYTh20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646346492, "uuid": "023f4b9c-34e1-4348-a484-427ef7c6a4e4", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646346492, "uuid": "073462b3-0c37-417e-8df4-58f02314d30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646346492, "uuid": "0108f023-1459-4f0c-9326-0735a4322a72", "value": "f81c3cede61433e632c6fe9dc4c5669e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc72b48-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "3efc1900-044b-4b21-bd38-e6e0aca95d0f", "comment": "Malware payload (Heodo)", "value": "6859c1f6905a877620122555eb1795f7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "c6d0a96e-4ff5-4e26-90ed-c534af3b9465", "comment": "Malware payload (Heodo)", "value": "add1122428999b4f7b2994005564f8eeef6234435cdc92f53e11a4e7e8abff5c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "a6e4b612-7a88-4af0-b79b-0e3fa756b940", "comment": "Malware payload (Heodo)", "value": "9df0e9c371cb51bcc9c4b3a206d2406b6ceee4ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265652, "uuid": "7ce39f61-5837-487d-854c-76eccef3456e", "comment": "Malware payload (Heodo)", "value": "67cd7da6bdaaa7853b0eea61141c454b60c8fe95520855fddf36b3052dc7dffeb196792258d6a85fbc1d45996a643bbf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "15c6eb8b-f363-48c2-a310-4364273ef930", "value": "T1A5D41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "f5ddcd72-dbd6-42a9-b3fd-d4b4dad9d3ea", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "47380d0f-54ec-4235-b011-f6d593dcceaa", "value": "12288:DjN/Z2wkRrA9CRDCfElAjHDsndSyHOrNvEP0Oua:dEHR+CRZyfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265652, "uuid": "8451bc8b-70f9-4fb3-9d23-715ce8dba762", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265652, "uuid": "77d707ea-8cfb-4f38-acc7-a6154606e292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265652, "uuid": "cf166588-a047-4f9e-8511-08fdbbb8e061", "value": "emotet_exe_e4_add1122428999b4f7b2994005564f8eeef6234435cdc92f53e11a4e7e8abff5c_2022-03-03__000046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384cd5f3-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646300110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300110, "uuid": "b6248439-b621-4568-83ff-48cbad00a820", "comment": "Malware payload (GuLoader)", "value": "f362e659c24bc3ad5ed45a2d983cee82", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300110, "uuid": "dd336baf-de73-4192-a101-9929762a7c17", "comment": "Malware payload (GuLoader)", "value": "ae3b44c3c1a5b94606651868e91fbb4136e2cfb8385a71dd4665de1c6ce8094c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300110, "uuid": "e6b0d938-b14c-46f5-8108-b75f2682c1c5", "comment": "Malware payload (GuLoader)", "value": "5fba8045cea103b41d0110c5ae1a9b64d18a8775", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300110, "uuid": "5f9614f0-63aa-4b05-aef8-70d89254c7dd", "comment": "Malware payload (GuLoader)", "value": "09aaf69c589fd20e84e28fad86c56e1de333875523eca44289a4e937507cbd9e07a45a4df0cb778a583e59ce70a61694", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300110, "uuid": "4478d45d-bb88-425f-b0f6-383b229c0a00", "value": "T1F104909D541D5B80CB34E841ADED3BC23109F6B212EC0A834EF1286F4F5E9E8D65B59E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300110, "uuid": "75b8f18d-a14a-44c0-b0d7-224df3111dc6", "value": "1536:ZenTiKupvrMjedwMFXw1UtNAa6qFPwrO5VHOY1/HQJbyKitzsXu1GA3/RYyuFow2:0TiISBtNQQPrHdn13Eb2lvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300110, "uuid": "0ffe4c3c-3d62-4821-bd0d-423ed36e82c0", "value": 189335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300110, "uuid": "abc23c5f-46fb-4bb4-a2a0-becba69c6c3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300110, "uuid": "a32dd4a6-ec14-41d7-a981-527771a13aae", "value": "Sales_April_shipment_requirments_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ea21f0-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646295001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295001, "uuid": "aeb61ee5-4930-4bd7-9991-88dc920ee09d", "comment": "Malware payload (Formbook)", "value": "14d06d7e8788097308afd153f54f0de8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295001, "uuid": "89c869de-fe81-41fe-a219-920f675270d6", "comment": "Malware payload (Formbook)", "value": "ae5f0a0236ef19007a937644c17b5bbc5747a99942b439c419f887a7865d973c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295001, "uuid": "d871af39-8600-4590-a4c3-b4f0d05de48d", "comment": "Malware payload (Formbook)", "value": "cbfe58c22275eeed9e9cb705075fa13be6705289", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295001, "uuid": "c12d59e0-c1a6-4c7f-aef7-368ba8c94a42", "comment": "Malware payload (Formbook)", "value": "a1febd6b0d8529d9d5877fb7ee6d67a1fa2c1bb41cde93fa305bcf3981ea6bb395388c03340dccc1acfc893846b8898b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295001, "uuid": "fb77daea-9046-4be9-a3e2-61b4b7db75cf", "value": "T1A3F41201AB98E516C7C999B4D6DD90084972AD1E2F42E293C9B1FF9637C37F38C16293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295001, "uuid": "fe0f2c9a-2269-4625-8657-2b202bc50351", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295001, "uuid": "4a08af00-bcb2-4b7d-af6f-014ffa50776a", "value": "12288:EBF4bx++kDo2xhL9rPLk845oPlIpKJdLLC2tsxkePw+x+dtp5GWQaIfI2h3:pbgxDo2xJJLBqUGmsx3xx+dtp5Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295001, "uuid": "8d46a024-9c55-4f15-b62d-585d90871da5", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295001, "uuid": "1f06aab6-0bac-41de-9e77-d659cd25007f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295001, "uuid": "ae624cf9-29a6-474f-81a2-0a2c26c90afb", "value": "DHL AWB032675490 - Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6893b5-9acf-11ec-9275-42010a9c0029", "comment": "Malware payload (LoaderBot)", "timestamp": 1646297760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297760, "uuid": "d167a7ca-f11b-419b-a181-a39a136c76b3", "comment": "Malware payload (LoaderBot)", "value": "3a1b0cf20a31556d2372c4e16026ab0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297760, "uuid": "0389e2c4-732e-4512-b6cc-cf50af4e1686", "comment": "Malware payload (LoaderBot)", "value": "ae5f1fd094029b7e60c1d7998501d17b7585254e1b0644f151b20bd83bf65e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297760, "uuid": "b9b6ffe5-413b-44bd-9a91-c85feb9e2b17", "comment": "Malware payload (LoaderBot)", "value": "2efabc5b1eb697113b90d30c8eb165a2086776ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297760, "uuid": "7f98175c-8605-4323-a248-2b1eee7b00aa", "comment": "Malware payload (LoaderBot)", "value": "f459969e8b70de7c4381ab012b191af43d0cc645c9b3e3e768f41edb052a324697b71b3b8eaa212cfa7b170abead9771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297760, "uuid": "5453231d-6348-4bc4-87b7-1cd9f9d1d10b", "value": "T17616AE12BBD58F2BC5564B388AE783647379DC904B43575BA34AB12D3DB23E02B871D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297760, "uuid": "e27555b4-c3c1-4ae8-ab46-2cdce8454536", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297760, "uuid": "6b7d2bca-c442-4d32-9bb1-78fb3d4f2e1a", "value": "49152:8NDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:azP88fBsnZTgOtqB3m1RC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297760, "uuid": "e36b6de2-cc7d-44ce-9821-64b61cd5ed99", "value": 4156928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297760, "uuid": "8e560cbc-120a-46d2-961b-188faf53f9ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297760, "uuid": "0bab1a3a-3036-47e1-afdd-5313a5410096", "value": "3a1b0cf20a31556d2372c4e16026ab0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c59f2c9-9b12-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646326262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326262, "uuid": "7a92fd66-d4c1-440b-bc97-8d20d11c96ef", "comment": "Malware payload (Quakbot)", "value": "216fa65b0f2b137eb7a63be790f5aeee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326262, "uuid": "8c9556a2-bb45-4a1a-a785-a3b07f4337aa", "comment": "Malware payload (Quakbot)", "value": "b09754e9577d21d16f9323a399fe8cde1e51482defdc2901bbf2763d2ae58e31", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326262, "uuid": "4c331a53-b545-48e0-85dd-ceb796172a26", "comment": "Malware payload (Quakbot)", "value": "c3e0fdd3b5cd59c1d8deeda071a4037d6b1fc6b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646326262, "uuid": "6c9b29c2-44c3-4d87-b58e-8f0ab7d56f19", "comment": "Malware payload (Quakbot)", "value": "716b35a3b9201ae8a744be9f16a99d6fc007b505407734f1da0466506ba877030493beb6a4d0acd28270efbf4ea890ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326262, "uuid": "51e46f58-cf60-4e28-b06e-e8efc05ddbe2", "value": "T159B4BFB875146CE1E6BF163BC995ADE803762632DE87D8CE506477C709733A1FE1280A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326262, "uuid": "fede6059-eb9c-4abd-b4b3-950b062c10f0", "value": "0383b6e78c7f005efbff386cee23786c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326262, "uuid": "b9da531c-7cc5-4af7-b495-9e3420faa6c4", "value": "12288:vnKiMBsfsXtxbohL+/JkjFbK5BFHGiIDwqJ6dYKH:vA6fevoVaJmFbeBF5IDt6dYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646326262, "uuid": "7fce2e65-ebb0-4e8f-ac20-98bf5073ad4b", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646326262, "uuid": "89062a63-58ef-4a4f-9df1-0fa1837eba14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646326262, "uuid": "81cbe329-9aeb-4fa7-9e96-5ccc8562b5fe", "value": "2703680.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad60e627-9abf-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646290857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290857, "uuid": "0e7c558a-4dd5-4716-9ac1-3d2325dabba1", "comment": "Malware payload (Formbook)", "value": "b420b8c7af4aa5b35c0b2572b97d9868", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290857, "uuid": "17c9447c-b85b-4709-a9f6-95667fc4ec5d", "comment": "Malware payload (Formbook)", "value": "b0c3add03225ac43f5ec819be3dd70ad8106a98678181abc437294daeb86cbda", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290857, "uuid": "df1a3522-8063-4699-896b-88cafb5c7b6c", "comment": "Malware payload (Formbook)", "value": "fd7de51c077cde8f8241a505f38ad2ee132bc85e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290857, "uuid": "41ad26c2-e1ba-4f1c-a2ed-99d36f432057", "comment": "Malware payload (Formbook)", "value": "adf624e8961d4b6132c3dc1d1623973dc9f62a002f1b8f649644d9fd94f483c41e09bc08aa6238582a4b5e4a11689890", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646290857, "uuid": "377a6c75-4802-4d22-8136-2f1ddd1627e6", "value": "T187B423326655FC97EF880397D1DE81ABCC600B7BD37C8F6863605A0BE8ECAA55C145D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646290857, "uuid": "5bb15d05-92d6-4820-a237-52c4da3e2015", "value": "12288:BczUAcRmM/DDq2tFLwTI388MjW1h3i3/H0xE2kQco:Bcz2RmM/q2tFkz82sxE2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646290857, "uuid": "4e55a59f-514a-499e-aa84-e8db38fdb6b1", "value": 523911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646290857, "uuid": "afe6533c-98ef-478e-a958-53348a11a210", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646290857, "uuid": "51fcb2fe-b52b-4060-b24f-2cb39a800885", "value": "outstanding.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d49b8e-9acf-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646297762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297762, "uuid": "53f5fa1e-05e6-401b-a3b0-5b82ba95bc52", "comment": "Malware payload (DCRat)", "value": "221cadc16ab57788a488166be7843c40", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297762, "uuid": "cffc3c67-0f6e-4646-a886-f551a6b27adc", "comment": "Malware payload (DCRat)", "value": "b0ea56f9216503168db950e055384ee9d6c58063f27b3b967fa9ad2b5c692841", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297762, "uuid": "0c433c99-f71a-4756-9e76-a84183318bbd", "comment": "Malware payload (DCRat)", "value": "c7499b579e63de540c2591f9ad91cf6b879102be", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297762, "uuid": "df99ef40-037e-4678-8352-a9110df506c3", "comment": "Malware payload (DCRat)", "value": "ba37f6de9e112456c538917c11579c23d2b8635829b72154726d7c7a5ba3b12342bfedf6ee9f36bd5196819f4d088e2b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297762, "uuid": "23a79d8c-4d80-4a4b-9334-a260907f90fd", "value": "T1FCF417027E44CD02D4651B37D4EFD81863E8ADA36A6AD71A7E4B33AC21523A75D0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297762, "uuid": "0f330802-52cb-49e6-abf0-9f2933cc171e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297762, "uuid": "7e6ab09e-861d-4efc-abb3-4d017b1d081f", "value": "12288:SDY1QSwEn7TzFahpxuxeKqAy/tFpp+W89j6NWDNHYlZE5Sryx:SM15HAx8XqAyBwp9j6s5q68mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297762, "uuid": "418e96dd-f38e-47d8-862e-d08c6abb7257", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297762, "uuid": "edf0a3de-fea3-42ee-a176-1c337713f239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297762, "uuid": "84d97d13-42ed-4e40-9e2f-30656b2d01c8", "value": "221cadc16ab57788a488166be7843c40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb11690-9b17-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646328704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646328704, "uuid": "2edb34af-100a-474d-b44a-714d0e5c7e57", "comment": "Malware payload (RedLineStealer)", "value": "1c26a863c485ee7040fed5cd60d502e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646328704, "uuid": "e1b5c8ea-72df-4a5f-aa40-0987f6003314", "comment": "Malware payload (RedLineStealer)", "value": "b148fae05d0312b5e92ea0c05955b3939c7ee6351aee3dc83afffbd292790d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646328704, "uuid": "25eccf0a-d317-48da-8321-1f1f8ccbd14e", "comment": "Malware payload (RedLineStealer)", "value": "50803bd691ea7615b4a68d00312d247db5b91311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646328704, "uuid": "fb9ffb7e-e6b7-4eb8-ad99-4a971a78a7e1", "comment": "Malware payload (RedLineStealer)", "value": "39ea86031d036c087beafc2a4412997f9f2a06c84081354f83db43b91b538a3cf5a75d892824ff4bacae74d8ac9a6ee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646328704, "uuid": "06a6917e-d1f4-4be9-b71a-ca0d9b4c7756", "value": "T106C4239B4BC1BF18C85F4F752C0AF95709D8AB6DE1A45856B07FD28C2BA503BBC1206D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646328704, "uuid": "def0ceb5-3f11-4b62-8048-3bb5ab1bb481", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646328704, "uuid": "fcd6cba1-4241-44c0-a7e0-102413ebd949", "value": "12288:uylTDM0XkU6e4LX3WJumdLPnv1QS03ULaHNqrxlKIQNoCZ0nFQYVvVSKU:K0vJPLPnv1kEaHNYK34FDvSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646328704, "uuid": "4fd1be1b-b907-41bb-a1c4-477b12fbb868", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646328704, "uuid": "aea56d42-be60-4d69-aa56-6f653c0126d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646328704, "uuid": "02148872-1ca5-402f-9121-0c6283e3ae96", "value": "1c26a863c485ee7040fed5cd60d502e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf3ee05-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646300091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300091, "uuid": "9066daaa-b007-4322-b1d7-1a67bf07aa23", "comment": "Malware payload (Formbook)", "value": "5ae28cffc29b9c1b2bd84a55dcff8343", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300091, "uuid": "47291a3a-d526-48ac-8cac-73dad12c9aee", "comment": "Malware payload (Formbook)", "value": "b1c26a7a6b1460f1344f78af9b9bbbcc95e395ad1621cd5a32c62e78d50d4b1a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300091, "uuid": "fa912bc1-1aa8-470f-b912-0c93b508245b", "comment": "Malware payload (Formbook)", "value": "e6828a928a79c6f07eb8daaf7c3769b580017911", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300091, "uuid": "3fa5b934-e7d2-45bc-9939-595ab477b1f7", "comment": "Malware payload (Formbook)", "value": "a96c57370075017b2bc33bd69007d089f8f5fcc9544a202915f3ddfd3f1790eb42c9c90745b2ae699ad71076126fc9db", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300091, "uuid": "baa67275-90d4-4d0d-a669-debcb598cdaa", "value": "T196141210392108C6FADE7FB00DE01A6ED156DE9B0A224A5834FDB31C7D76769426DE3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300091, "uuid": "dab56d23-46d9-4183-b4a5-6b0732175761", "value": "3072:LzWkAc59/YOkP22mNLXLoZ5C1j66DXO88yEUBJyjvcPZ5OqttHXXoWymiWhL1nKz:+kT/YOkO2mNLLo256J88yEUDyrcPHHXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300091, "uuid": "31855be6-8f10-4059-9348-4f3ed307646e", "value": 190520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300091, "uuid": "45f29cb6-62e7-41f0-ae8a-a97f61ea4c37", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300091, "uuid": "a54b0ade-3978-471b-ae16-45d2c0b44818", "value": "specifications.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41440372-9b1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646329760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329760, "uuid": "3466af24-9645-4557-9b00-908b20e69065", "comment": "Malware payload (Mirai)", "value": "f81ebfc58e1cd91d170e175e03ff9f7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329760, "uuid": "147023be-39ec-4929-929f-9f0d5a009bbe", "comment": "Malware payload (Mirai)", "value": "b1d195b49a28747ccd235bd2f437671254c7e0434a24af455aa099bc8d2d73a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329760, "uuid": "6ed25a5c-9a18-4f49-9092-539f3da2123d", "comment": "Malware payload (Mirai)", "value": "8dc83ee6de4b3e25fadc905539b937d62ce0be5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329760, "uuid": "4f3ade9c-98ff-459c-992b-4efc40a5367c", "comment": "Malware payload (Mirai)", "value": "f64f52d12f560b1cc28978b47992c595f9501952b458cd47418d6f16de56b9bc3545663fd1c0575d3b157d60fae62946", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329760, "uuid": "f2f61aa4-a364-42c9-be00-a2d679a7bcbf", "value": "T131B31845F8408727C3D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329760, "uuid": "f10b6af7-3574-4e47-83d8-cee305f0cceb", "value": "3072:MSY+46m1qOzsshFPPKNy+AmkZrQAhPDCXFke:06mgOzJhFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329760, "uuid": "24b68f5f-ad34-4349-978b-4fd776b9a06b", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329760, "uuid": "e7f00f7e-3fd1-43e2-aaa9-6a53a4995754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329760, "uuid": "ea218db6-5dcb-44b4-81db-a848848051f3", "value": "f81ebfc58e1cd91d170e175e03ff9f7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3046982e-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646300526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300526, "uuid": "d04148b9-9253-473e-8f2c-4dc87d3ddbdf", "comment": "Malware payload (Formbook)", "value": "7207b3611d02596aa7833c79fae0846a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300526, "uuid": "453e46ea-648e-4aac-b0bf-29033be57ca0", "comment": "Malware payload (Formbook)", "value": "b1d74737f5430e16cb2ee4707ac986ba21fc2252d50315d2b4a77e4f278b1741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300526, "uuid": "5e91918a-b8b7-485e-b81c-a844ef7a47ba", "comment": "Malware payload (Formbook)", "value": "b5252ac6eae3e6d6625f8d94a52018050e9ae004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300526, "uuid": "c788f83f-7239-4ab7-aab8-352649b9df95", "comment": "Malware payload (Formbook)", "value": "8aec03bebf4fb16e7278fcd13c5e89b122100fb200338c1330e3788e3453767b167e50757b0aaa23dcc2d7e0844e5f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300526, "uuid": "e448acfa-d3f2-4ede-bc4c-cd549fbcd483", "value": "T16E74221BF0D0C476D1D2443367BEA731D374BAAC12362E835FAC6F7804A26B67B49616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300526, "uuid": "b00ab154-ba2b-4959-b4b0-f1f3e025bde5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300526, "uuid": "84175983-7f31-4ec3-92eb-83347ef010a9", "value": "6144:rGin4oA7VQZLCVSQlXQKGnIo1Z0Tap+aqWF/PjMiGcirKKWUo:r4oA7KZbQlXQKGRZ0TTWF/5cto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300526, "uuid": "81f0d261-6c78-4c10-ac2f-f02580d417e0", "value": 344165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300526, "uuid": "ac01b41f-c49d-42f3-a61f-f807f1a0a0cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300526, "uuid": "06ec117e-28c9-4fec-a3bf-08d3095c6e18", "value": "7207b3611d02596aa7833c79fae0846a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a459f8e-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320756, "uuid": "356342c9-7e50-4b21-aa1c-78edde37dfab", "comment": "Malware payload (Heodo)", "value": "ce38df84113456ade2ec872393ecb696", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320756, "uuid": "c787d590-8165-4b04-928a-5a0fb879d584", "comment": "Malware payload (Heodo)", "value": "b21bfa10eb764189d44617b9dd5075c35ba12d8ed1ec4609c6661e1614cc438b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320756, "uuid": "bb227cde-fae8-4425-a738-c2623582e67d", "comment": "Malware payload (Heodo)", "value": "36b3e1bd1882ec27f608e688e0fd3e360d328564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320756, "uuid": "fcc6d593-a917-4ee8-af0a-43ca43f82a3a", "comment": "Malware payload (Heodo)", "value": "de44e9d20783969393f30a2461dc1a736bc4159d52f0727843e8a89afa0cf1e5724e92b46c60900da2d66127d8533cbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320756, "uuid": "bea5f8cb-dce7-4654-9535-e46b83b55600", "value": "T18F353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320756, "uuid": "70755017-f955-4ad2-8cd7-44393d788d9f", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320756, "uuid": "c65f109c-68c9-460b-961b-0438c95ec4bb", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZF1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1Z5ytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320756, "uuid": "74f3ec9a-b77f-49c2-8a0e-b097c449ebaf", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320756, "uuid": "f8346b44-7c7c-47e8-8272-b40080846cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320756, "uuid": "e09a9fcf-bb71-4dc3-aa5f-5269f37ffd7d", "value": "ce38df84113456ade2ec872393ecb696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d4991d-9af6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646314593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314593, "uuid": "4c3eda33-ee06-46e3-a59f-f0fd9e0f63a4", "comment": "Malware payload", "value": "5202712b7f27dea51d89c5be74772e38", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314593, "uuid": "9a2503de-86b9-49ca-9576-a5b06b1d93bd", "comment": "Malware payload", "value": "b2c28f3a1cac87fe0c3735b75573af925eeb822b10f1fdf0cad1191da0d3f54d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314593, "uuid": "73e427a2-5b3f-4c66-94c6-71ca5f19f62a", "comment": "Malware payload", "value": "a5fc2d91376bc32105a519d52e4b41a2634c976e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314593, "uuid": "79920ada-26d5-4a0a-afee-a5ba55f4f45d", "comment": "Malware payload", "value": "89f2c77cda5df716d5760025c4e8416f56f7dad6441f4157918b750841dd4c6118c192e38c31b310272e07ffd4c84a41", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314593, "uuid": "b1f2f190-efef-412a-9b48-a45a1838d763", "value": "T12F7145123EDFC837683335504CCA4766989044314BB2947E06168E4D5BEC6CFCEFAB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314593, "uuid": "afadb3f6-edf3-486b-9b0d-ebdab1dae61d", "value": "96:sQO3M+LaVgTHYghMPVsr51FURcqcXv+0TJqfzl1YlZs4:sQO35LFT4gSPVs1cRce0TJWBajB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646314593, "uuid": "3bc33921-6b97-4180-9fe1-28496448480d", "value": 3770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646314593, "uuid": "51b0315f-02a9-4ee2-84b0-226b387cb50f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314593, "uuid": "6a8577f6-d837-4e3c-95c4-a666a003ae18", "value": "b2c28f3a1cac87fe0c3735b75573af925eeb822b10f1fdf0cad1191da0d3f54d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45aa1331-9aed-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646310440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310440, "uuid": "ab15c92b-0b10-41dc-9f1d-a38bc855cc70", "comment": "Malware payload", "value": "7f8bc64494aa6c4f669d62bbb126a584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310440, "uuid": "fd39578e-08d3-40e2-92d0-3f5ff79b6c53", "comment": "Malware payload", "value": "b32accc5aaae16cfb44da3c42686acd589c78f43094e6d3af7ec136991862d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310440, "uuid": "19273233-7a7f-4742-afcc-94c84d835822", "comment": "Malware payload", "value": "540c695022d5208de089efa7c430e77f76c32e8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646310440, "uuid": "fcc1f7fb-57bf-4be2-8921-0fed2460b3d7", "comment": "Malware payload", "value": "b8952cd4774dc9e36cae04a4c1ac8ec0495a91798ece0af45a237431c648a9cecc6141519c7aee1839f76c8b87f1f8f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310440, "uuid": "94418c71-ab8a-41be-913b-5a4f256dca92", "value": "T13633081A7C5AA649C5D47BFCA9B1A5821275BCA10120C28FF8F97F19A933333DCC615E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310440, "uuid": "a1552a15-c80b-46d3-9e36-da88b3d7a1cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310440, "uuid": "946e5271-1fa9-456e-a9fe-e24c88db9cea", "value": "768:msnXrs1emR6y8Qs6GbmpgbOVsxlmMwCK/3deVD7:mR1emR6VbbmpgbOVs630VD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646310440, "uuid": "e7aeb572-c9d9-48e1-a9fa-990df844a3fb", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646310440, "uuid": "89e46c10-eb20-40d5-9ebd-13d1b1d90c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646310440, "uuid": "d14f6040-4c3f-497b-a44e-5ff67bb52c22", "value": "Revise Approved Project Ref. DJ 285-JAFZA LOGISTIC PARK MULTI-TENANT SCHEME-MAIL ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43369bca-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298840, "uuid": "49d60b69-a8bd-4d5f-b8fc-16217f20b978", "comment": "Malware payload (Heodo)", "value": "d6390ff942ef0075978c5ce9045547ec", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298840, "uuid": "455e444f-f7b7-4b2c-9cdc-f1e28efdb7e0", "comment": "Malware payload (Heodo)", "value": "b3469bc397381fc0e8280290ea37f9432957b5cc288aa278baf6f35f89c1be74", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298840, "uuid": "97e62172-84a7-475c-b490-bdf0114d7f91", "comment": "Malware payload (Heodo)", "value": "014348ee39ac9a5e1d9d3e719bdcdf95feeb7f9e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298840, "uuid": "9f2588c4-1449-4bd9-9576-4f3406437070", "comment": "Malware payload (Heodo)", "value": "9692de79505a7ed1d2bb71ee0c342966e9292e5396bd5fe9606109b2004731b92eb16cc7843a09dcd3721d5eacf684fc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298840, "uuid": "0b57c6fa-f2e5-4ce6-ae33-7da445e0534b", "value": "T14E23D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298840, "uuid": "8e95064f-d91b-455b-8db6-81265619b8fc", "value": "768:+eoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:1oPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298840, "uuid": "55749ec2-785b-4ba9-ae99-c22271b15732", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298840, "uuid": "91fc1199-fbf2-4f1f-a2d0-6efdd75e853e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298840, "uuid": "8014dea2-afbf-4142-9fac-ee5183eeaaba", "value": "1007740245711330295.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185e709a-9af1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646312082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312082, "uuid": "14e972c3-1b38-498c-aaa0-50fa56cd2c96", "comment": "Malware payload", "value": "cc1ecee7965e97ea99bb34d57876a19d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312082, "uuid": "c6a892d1-0038-4830-b339-8febbc9d1a40", "comment": "Malware payload", "value": "b37d67621c039efd925d92cbb2c03d0c604bd9c31d02d48e4fca9763259f0232", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312082, "uuid": "fae5d10b-df80-4f87-b62c-579b6a9a7ffd", "comment": "Malware payload", "value": "44176472da91bdbe3c54b6c90ed5bdbfbf00a5bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646312082, "uuid": "0f86d8f6-c1f7-4458-9c28-f804fea684cb", "comment": "Malware payload", "value": "987f7682089b9881a73c1460a801b76e387da00c7837fb7397197a5c2116ff7eca91526063f7c99eefc9a9436e10d39b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312082, "uuid": "f3deff0a-2fda-4d45-af93-883bb23e7896", "value": "T1CA648D916BC694B2C36330B14257633AA6ED96701B396BCB9BD41C319F341D2EA3C71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312082, "uuid": "602078d7-c388-4e26-ab07-2c866de9e4d8", "value": "6144:JzyKSPnEifm5GB/bl6xlWhWYxPS3aRXysKu0kBwFIybjx6wN3UKGv08:JzpSPnEifD6xu1XRiTFIy30ZKm08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646312082, "uuid": "40692885-4e07-474f-b351-3de23cc62b41", "value": 333966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646312082, "uuid": "e34086fb-586c-4217-8104-8dbfb9df883d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646312082, "uuid": "bcd7003b-bccc-47da-8bea-4d3d0879b76f", "value": "emotet_exe_e5_b37d67621c039efd925d92cbb2c03d0c604bd9c31d02d48e4fca9763259f0232_2022-03-03__125437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101222b2-9ae6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646307344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307344, "uuid": "e2f00775-1ab0-4fff-9420-fb2a660439ee", "comment": "Malware payload (RedLineStealer)", "value": "342df897b15e5b63f8ff54a22e4abdd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307344, "uuid": "aa79dc42-6064-479d-9af7-ed43fe9dbd62", "comment": "Malware payload (RedLineStealer)", "value": "b43e7a9c1a85a3718b973c64d92bff82e39ed7b5eec621b01f78c779c08cf7fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307344, "uuid": "0f2e7350-9335-4c4f-97ec-15dc92e6dfa0", "comment": "Malware payload (RedLineStealer)", "value": "ec956b5ca0edd5462f33742bb26abbcfcb2676de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307344, "uuid": "16916ec3-2cb2-42e3-97cc-aa7f43fa3c3c", "comment": "Malware payload (RedLineStealer)", "value": "fa88d441ad5850abbdfac12d133a4d200e395a45d4fbe0c8a665bf71a0688b63faae4c0727d388130b8ffff6707a19a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307344, "uuid": "d84033b8-86db-4eca-93bc-7e073edde3ef", "value": "T1D9263399930ABA5BE48706372FD5B954919A63F07FC01483943EC1DB94FC8EE9318CDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307344, "uuid": "320161ac-7e0d-4217-a1b3-ede9691d201c", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307344, "uuid": "0fcdbe0b-cdd3-4819-8956-27712aa25184", "value": "98304:rp1+qObINy5mVkYasVssNSU3BMR6vrL04z0BKUZexdtb4GBBUPTUMz:rp1+2ygqYa4SUxlNwKNxfbfeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646307344, "uuid": "8e942a66-add0-4880-859e-6d9b49592506", "value": 4531568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646307344, "uuid": "9b03b955-f9d4-4fa4-be32-54d7ff227fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307344, "uuid": "a6fc9622-91b7-44e2-bfe2-5071643fa302", "value": "342df897b15e5b63f8ff54a22e4abdd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db28e1de-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1646296947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296947, "uuid": "40b3bef9-008e-402a-9e3f-0250d91a00ef", "comment": "Malware payload (AZORult)", "value": "4c6d3ce81464988264cf356090b04c5e", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296947, "uuid": "8880928b-a9bb-4dab-9581-d966f0818b45", "comment": "Malware payload (AZORult)", "value": "b4eb20d605f8598e0b330d458403886fa2c80dcd22b6ce1177d1cb74a521bf55", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296947, "uuid": "94326370-b32d-439a-9652-3d8a8a032d21", "comment": "Malware payload (AZORult)", "value": "2eac5c7d7a4b9704aa732ac14c716e030d8e1b77", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296947, "uuid": "836e8fa2-f242-468c-a1ac-57edac0ea40f", "comment": "Malware payload (AZORult)", "value": "0ad0c7ebb61a92819adf7b056c7ed74d30142fcb6b50beef34b08203bb209dbc66b84091c0fed9104b6430bb817b3b8b", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296947, "uuid": "eb2c86de-17db-4486-bbc1-11cfa215cc94", "value": "T1F205CF0438E68034F97A8BB0CAC4E7F0DB6EF225E588A0F654105E157656BBECD45EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296947, "uuid": "6b4e0187-5bea-40e7-8b39-aa479f9de08d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296947, "uuid": "9c606284-28a6-45b4-8384-6fa823cbd414", "value": "12288:zQR/IKTyxDH2oTYVYJ3c9jLW9inLLCUi84xvbeepyXt3gMy:zS2H2jYC9jLW9inL27HxvbU9QMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296947, "uuid": "313ead7a-4fc6-4020-b550-8c92a454ae81", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296947, "uuid": "6f330a65-ad62-409f-914e-48c87a2a49d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296947, "uuid": "c581bf0d-b251-4662-88c2-0452e3d6a3b7", "value": "4c6d3ce81464988264cf356090b04c5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d0fff2-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1646295106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295106, "uuid": "2ad6ed84-d963-46f0-8134-f3785028d1f9", "comment": "Malware payload (Matiex)", "value": "e8f24eec6de28ac481876ac5e8c39b53", "object_relation": "md5", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295106, "uuid": "17fdec50-764f-4fd1-a63a-303f38c3271d", "comment": "Malware payload (Matiex)", "value": "b61135c1300d75395161127afafb71130bd1930db014cac9262ebda8ab38acc7", "object_relation": "sha256", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295106, "uuid": "69ea7d51-3e64-4658-91ba-7ff921551fc1", "comment": "Malware payload (Matiex)", "value": "89734c17e9d54a4b638d84bf3c60202c046feda7", "object_relation": "sha1", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295106, "uuid": "7dab7c24-888a-4f88-8419-394329fdd312", "comment": "Malware payload (Matiex)", "value": "91fa25d85287f2ce0aad2267fab4ded3c0db209058e0d01d3c063770fd0738ff4a32f72b106d8999409d9fd154045fa5", "object_relation": "sha3-384", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295106, "uuid": "e586ba04-a034-49df-80e1-ff17c994f748", "value": "T158756913BBBBCD02D4EFCEBC480B04FA1B936C1925BD42098A7570D52F795AE25AD1E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295106, "uuid": "1aea8aa0-89b2-438e-ad7f-d1b720042d6a", "value": "24576:7rrOeWXUy766ZhX50cjSGx64R3hXLAuZ9i:bwJZhX53jtH759i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295106, "uuid": "50818e2e-a6db-42a0-8013-589e163fde08", "value": 1659682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295106, "uuid": "cadee99c-ec18-4e81-9c87-5757b2558a0a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295106, "uuid": "441154be-dcfc-43e6-93d7-a2874f533d1a", "value": "Order QW1502 pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c4548d-9b35-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646341287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341287, "uuid": "3083843f-6776-4675-af6c-c93c0e0cbeb0", "comment": "Malware payload", "value": "a423b2a80d6e2416c00d54ac7b253164", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341287, "uuid": "f44004ba-b789-4ccc-8e80-b7183a03c16a", "comment": "Malware payload", "value": "b658baaf1973ddc021827605102eeaf001fc5266d6771110f7bb04a2c0b98794", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341287, "uuid": "cde54659-f1a9-4f16-8f8c-a23ca5424138", "comment": "Malware payload", "value": "80ec38ee90c164df84b13ac62a3f9a2f01ddb5bc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341287, "uuid": "86888f47-3a34-4da3-b423-a725177e5354", "comment": "Malware payload", "value": "31354fb21dcec88db503fd2da20482966d534ec7ce1b61ee01aab65b6777b7938b2fbc8d3f01cbcc92a6ef3f93f81827", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341287, "uuid": "4eb0abfd-7059-41c6-a7a5-de94ef5225f2", "value": "T1CB44230690BC868314F1B1AB631AD1B2F1B712D1C68AD927AED35F7051E2BADB001DF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341287, "uuid": "6bd67d1d-3188-46ae-af8f-fbf29fbaff61", "value": "6144:zIHZ9YefOzxwGF4pBc7Z3P+BefbMESGWqYSNz1dm0:0/BMxGwJbMESGWqO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646341287, "uuid": "e57294c0-eb79-4995-a8b4-5da7cb37580e", "value": 253479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646341287, "uuid": "dc0b0418-5d15-4e8e-8a7e-ec0241d58fa3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341287, "uuid": "1f9fdd83-e683-4e04-b2e8-c1207479b532", "value": "REF-463128215-Mar-03.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005fdfbe-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298728, "uuid": "c207e429-1a5d-4dc5-9775-8835db4b4b5d", "comment": "Malware payload (Heodo)", "value": "434d0ed38441e81362589a40b282b7c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298728, "uuid": "511c2683-2462-4c3f-997f-389fa961661f", "comment": "Malware payload (Heodo)", "value": "b705231e59b61c003dea99c0cb4a5b07f278bb7cba62640ac0749fce4fe53fea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298728, "uuid": "d98e7e15-6b2d-4756-8d1f-59b089517687", "comment": "Malware payload (Heodo)", "value": "3f49cf1367f9cf658e8b6f9daa3b820c015851f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298728, "uuid": "f8019a2d-0fb0-402f-8ab8-b3d1ada31fcf", "comment": "Malware payload (Heodo)", "value": "8a3d1ef6148e0eb3149db092c5b2c64552cb358aa47e62fbaac6d1b3fc56ce1545a841f227d185da746488de95e460ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298728, "uuid": "e08e372e-c76d-49cb-b1ed-1370bf4a2736", "value": "T142353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298728, "uuid": "23b6ad93-f967-4995-989b-db02b61b1cfe", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298728, "uuid": "395a5e01-9b7c-4cf1-a0d5-0159f70cb1a6", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZT1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZvytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298728, "uuid": "6357e199-2862-4e14-ba0b-f272a044e042", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298728, "uuid": "2bd3d66a-4777-489a-8ee7-27a790a19f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298728, "uuid": "7010c0af-3033-4966-9efa-97daf5a8c7a3", "value": "emotet_exe_e5_b705231e59b61c003dea99c0cb4a5b07f278bb7cba62640ac0749fce4fe53fea_2022-03-03__091159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536f16bb-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "452fbe10-60d7-4dfa-8330-19b906feef11", "comment": "Malware payload (Heodo)", "value": "527f26b99ad9b93ff4c1096f059756f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "835dc8ab-f68b-4991-b4be-603f442c5f79", "comment": "Malware payload (Heodo)", "value": "b71e4dd3a2713d6c6dd9574d06718f96241a1a83bb663a8e00484034b7dfc606", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "281c03e1-6cac-4968-b03e-18e7bdf6f5df", "comment": "Malware payload (Heodo)", "value": "066a4c8c1fd03f4456160e63028ad81ccdb94b34", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "69b95928-57c9-4b87-be83-4ed21ae5a6f6", "comment": "Malware payload (Heodo)", "value": "063172b09dedd98191625d27b88b39782b45dabd394837a24396f26763737f752abf132e05c690647f3cca40602c52aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "0b65fe32-3a4b-453f-8233-e0fcfffa214c", "value": "T1F4D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "1eccfe85-73e6-4c84-8ffe-38e541b6143d", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "c08074f3-2980-4d54-b3a5-b0f9c9367d98", "value": "12288:ZxpNJJJ2NHPoczJWOtIhxf3foRXIa5EPwvA:Zx2gczJWFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "c0ed2912-3d1d-404c-a4bb-082e701ef93b", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "ba110283-2f6e-4b18-b668-b901f0262588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "515bb8af-ae55-4a4e-8684-18424751c810", "value": "emotet_exe_e5_b71e4dd3a2713d6c6dd9574d06718f96241a1a83bb663a8e00484034b7dfc606_2022-03-03__000305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694607b9-9ade-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646304058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304058, "uuid": "f0da1da5-1849-4c2a-933d-c7a47dc05a71", "comment": "Malware payload (RedLineStealer)", "value": "c48014f19e07dc7be56f5b40c0f33e80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304058, "uuid": "196d019b-dcab-44dd-b946-48085b301964", "comment": "Malware payload (RedLineStealer)", "value": "b762c5106004bf9683bd668b800cf26c6f32dfae8373a8075837b7186eda0809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304058, "uuid": "c16c07bb-489c-4a2f-aa6c-346e2a05f7d7", "comment": "Malware payload (RedLineStealer)", "value": "aee67b073576f0374c28e185b583674b43ce2ca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646304058, "uuid": "0272aa85-8c6c-4c89-82ac-eb0b9f212ced", "comment": "Malware payload (RedLineStealer)", "value": "965faa4a589d486816a7b7e7c130f0f592a2d4c459c1ec4457ae5c5affc641efc077bf6b5449e7d93e368bd05cbbb828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304058, "uuid": "135d4b88-329e-4180-864d-810ca0d0c240", "value": "T1D3A34BA167CD8624E2FF4F706CB8119443F4E043A502DB8F5DC960DA1F76B90EA667B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304058, "uuid": "287b4a12-2b72-4317-97a0-f11525db643b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304058, "uuid": "74575303-8626-4bfc-8c9c-154d801a4030", "value": "3072:bucUJyKCNYi0T6OpfyIG8zrXv3+JkRL4UOa:bucMX9HfuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646304058, "uuid": "e5a7285d-0d8d-4217-91ab-7ddb9fa0bde9", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646304058, "uuid": "2bc8c926-161b-4cef-91a2-80e71c914222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646304058, "uuid": "9f4182b9-bf7f-47e9-af77-214012be0b09", "value": "c48014f19e07dc7be56f5b40c0f33e80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630b9c5e-9ab6-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646286867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646286867, "uuid": "9cbfa81f-31a3-4466-8507-2d4b601a5cb2", "comment": "Malware payload (AveMariaRAT)", "value": "0c5cbea1237e2262ac6d4cbb459acfb2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646286867, "uuid": "5fbc1fda-dd09-48d7-9265-6e7e6865ef67", "comment": "Malware payload (AveMariaRAT)", "value": "b7954b71caab224fd99f6283922051868f2fa42d9a15206afc11119b98ccb1ed", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646286867, "uuid": "7be74e06-16e9-4d2f-bf55-823c7c7cce7a", "comment": "Malware payload (AveMariaRAT)", "value": "7bf0e4bd1e804a15cee37307843c623810d6eea8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646286867, "uuid": "bd9e6784-0b64-4636-9c51-aa459e444410", "comment": "Malware payload (AveMariaRAT)", "value": "c2ceb7f6ddad8e21e3136d507de583011810c6ea51f9d95ef94699e310c747cff1e53fc28fc79d5698e52cbc9be80e1c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646286867, "uuid": "e7f06050-c289-4e29-bd63-f8a143c892ec", "value": "T19315F3B62BD9C034E93687B3E98097B0C71FA615D84860B2EC329E00767277D8D57DAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646286867, "uuid": "65b7d02c-463c-4928-bf7b-c95fe7dde4fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646286867, "uuid": "07d5ea0f-e30a-4048-baea-2a6245b7e2a4", "value": "12288:1W1R/IpTLnixhXvAs6d0DLgWgdIujhBQpPy7FtDzGgdVsCBxEC5:QUXnohfAs6+DLgWqjAeFtDzGgBiC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646286867, "uuid": "caa08352-3218-476a-a578-9e2551f5f90e", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646286867, "uuid": "fc0980a2-c0c8-4c80-af0f-d23c65d86f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646286867, "uuid": "51b5e214-3b71-4752-a792-221163115560", "value": "NEW_ORDE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47f6c3e-9ae4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646306814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306814, "uuid": "1701f315-605c-45a9-8143-3585eee1a650", "comment": "Malware payload (RedLineStealer)", "value": "efe5028524fc46e23c0e979db93d9aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306814, "uuid": "2f47616c-eeaf-4c60-aac7-667c2c194e9b", "comment": "Malware payload (RedLineStealer)", "value": "b8375ccb89ad7aeb0aa80b77660760dd96cca93173e14163d4ff1d7a9e2d69fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306814, "uuid": "575fa35a-6e24-43c3-87ab-df5ffc677d8b", "comment": "Malware payload (RedLineStealer)", "value": "21c39312c025e892fc311d2f1159e4fd5b99f4ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306814, "uuid": "9e0398df-0b20-46f8-9ab6-563d50b11d84", "comment": "Malware payload (RedLineStealer)", "value": "1bddbd716b4a5112e3888a848908eb74a2ebab20a8d34f2e7bcb21c864e4aa2f196efcc169f3e4d74f4b86a73e07e4cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306814, "uuid": "6cc9983a-a028-4fe5-b0f7-31c0a3955665", "value": "T1E514CF257A90C072C48715705435CBB56A7AB93217A58B4B3BAC27BF3F313D267B530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306814, "uuid": "d15dae44-3631-44d1-9a94-c0faf76c5c28", "value": "8a269732848c56383a3b405379a00c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306814, "uuid": "4c779233-62ba-4513-b096-043a4a2de636", "value": "3072:DN4LsG4UAO+ndRdRUeQ31RG/5T9V9gbK:WLoFx3PUjEVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646306814, "uuid": "2dba4498-8d9c-47c5-9ac4-871ff596fc8c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646306814, "uuid": "51898c03-3b3e-4d84-86cb-45f16e3713f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306814, "uuid": "5d3ec2d5-eef6-40ca-bb46-2f74b720c42d", "value": "efe5028524fc46e23c0e979db93d9aa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cbdba7-9b04-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646320502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320502, "uuid": "0bd3f113-ffe1-49df-a8c8-72bd182c21ab", "comment": "Malware payload (Formbook)", "value": "c647bcdc5fab6aadf1022aac02afe718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320502, "uuid": "b1b23b45-fa5c-421f-905b-eb3b48b5e6eb", "comment": "Malware payload (Formbook)", "value": "b855f93b22fb9340b6c59343ea357b6cc8041f8949386d54165a98a6b9c0c796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320502, "uuid": "86af295f-f819-4968-ba28-49e9699416b0", "comment": "Malware payload (Formbook)", "value": "38ece060086fad422ff5f25e19aa6d94a9e241f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320502, "uuid": "c491affa-8d2c-41b5-b735-dd7d276ded9c", "comment": "Malware payload (Formbook)", "value": "db797c3e69267a942499e2e593990f924c3f2fb3d0007bd53b46bb3e881828a2865aeb389fb64b4315e37f6753a9a0c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320502, "uuid": "c270e18b-5f13-48b5-a934-f6ecfb154830", "value": "T13B64230FA8D3589BE0E340345937E57C93F1DA88153B499B9B749F323BA72D0C726692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320502, "uuid": "69dd2bc0-6472-4e80-9b5b-49f197aebcda", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320502, "uuid": "59f52458-3c15-417c-9e63-f090a151bf3a", "value": "6144:rGiD3ndNFaPhh5PAUFuxD+6/23P+Zxp691skryTvR5:X3ndNIPJ4dh/2/+jp691HOTvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320502, "uuid": "f2559b0f-faa4-4a02-93e0-f4ac31824d7e", "value": 311142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320502, "uuid": "f030bd9a-36a3-4a2b-adbc-8d335c8e68d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320502, "uuid": "022e6241-d160-4cf5-900b-dc49e2e72b47", "value": "EUR 18064-51402032022-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62fbe98-9a86-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646266471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266471, "uuid": "83928ffc-4e23-4afb-84c5-4c2f7b1eac39", "comment": "Malware payload (Heodo)", "value": "6437804f2ce2ff709f012eda13269a3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266471, "uuid": "6712317a-717c-4570-8fb7-1623d59a00e5", "comment": "Malware payload (Heodo)", "value": "b8dc54aa94613dca8bd0ca93b0d85289b2ec3778d4ea5babc05566a2dd197bb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266471, "uuid": "143bcf86-4c3f-4ff3-9aeb-dc7e7d2489f4", "comment": "Malware payload (Heodo)", "value": "a91ad580a1c4c32c637cf9dc320f414ed09ee46b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266471, "uuid": "0b7bec77-6892-48bc-a235-de582ac559ae", "comment": "Malware payload (Heodo)", "value": "695491c22b076f82f1c8751d3bd4220666065b0be170327c543bbe2abe0106f6a7d2551e478df1aedcc5960e43674f7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266471, "uuid": "ba49f4cb-35e2-41e6-baae-722428bd14dd", "value": "T1B9D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266471, "uuid": "f880853d-3189-4296-a244-2951c5d05510", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266471, "uuid": "35f5bb08-beed-472a-9463-d567cd73de77", "value": "12288:ZxpNJJJ2NHPoczJDOtIhxf3foRXIa5EPwvA:Zx2gczJDFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646266471, "uuid": "985e8de8-0065-4ada-9129-3c683d986d6d", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646266471, "uuid": "f58cc109-7b93-4eb7-bf46-3fb55f4ecce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266471, "uuid": "e547d939-d5ce-4625-91cf-895075c05415", "value": "6437804f2ce2ff709f012eda13269a3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee95257c-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646300416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300416, "uuid": "280ef806-3617-4b16-aedb-cc2a0469f612", "comment": "Malware payload (ArkeiStealer)", "value": "5d6b0f84f6a6b5a81d058b8a585c642c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300416, "uuid": "15ebd66d-4822-4695-86de-c0489c835c07", "comment": "Malware payload (ArkeiStealer)", "value": "b952b22d2aeed7c501be6307e66ee2719ade4a6bff13ee932c5c29aff104c629", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300416, "uuid": "ddaebe12-7e48-40e0-83c3-9fdcc46fcfb4", "comment": "Malware payload (ArkeiStealer)", "value": "1df554c37c7f3c01c1168985dbc261ab663cc48b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300416, "uuid": "0149a04b-6041-4c26-b46c-4cc32324c1ad", "comment": "Malware payload (ArkeiStealer)", "value": "6709501597aa042ceca9fcf483cd964778269f8c95c66e04825815bff4bbe29664c05cee6ca6359994ca968187a594a0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300416, "uuid": "caf3bb13-70c9-4db7-9a9f-6e1a55f5bc03", "value": "T1AC357C01EBD66837E5FA2B3199F147A03D32FC1469E6C61B2D70E81EBCB16909DB1316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300416, "uuid": "93bb7517-4823-4e47-9d9f-fb0f4f90205e", "value": "a86eab439690bed71371436f8a7294fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300416, "uuid": "01cf5dee-9250-4ac3-b123-9550cd70f39b", "value": "24576:d+zmv6UimnLnnnfnbPRnnrzGYOa3xUZ2d8Wa2Y8t:I6iUimnLnnnfnbPRnnrz3OZ2uWrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300416, "uuid": "fc226527-d2c6-4c76-bde1-e0df3a5b3422", "value": 1113760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300416, "uuid": "353ceb25-658a-4e76-a87d-457f4ba414be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300416, "uuid": "aab7da11-6934-4b73-9da3-c4d1a3e4875d", "value": "5d6b0f84f6a6b5a81d058b8a585c642c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed45476-9ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646293813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293813, "uuid": "3d68a040-52e5-4351-9fb6-174221d3e7fb", "comment": "Malware payload (AgentTesla)", "value": "b15be882d8234aa01a2d42874efc8739", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293813, "uuid": "50e06818-92e2-4995-9815-37fab7f1c760", "comment": "Malware payload (AgentTesla)", "value": "b970a6c6ceb71957fa81dd6bb7c8dd6d9af99706a1db183ffe13039a6df2f637", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293813, "uuid": "f1b4e099-ffca-4a9a-9aab-2e90339024c7", "comment": "Malware payload (AgentTesla)", "value": "d28425ee004e9eded5e4cb68a8de8b36cf95d71c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646293813, "uuid": "baf92232-cbfd-479b-b710-7ccf0cbee049", "comment": "Malware payload (AgentTesla)", "value": "efa47caaeca927185751da6085ee0c09684974fdcf381324b75ecad1b4298e4853cf6f4900a8f699ec6cd08c985cf2e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293813, "uuid": "5b31120d-9dd7-468d-8941-ce4566ee6d8a", "value": "T16125D00439E68034F9368BB1DBC4E7F09B6EF621D189B0F654105E15BA42BBDC949EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293813, "uuid": "ca098e33-b251-44dd-855b-4cc08477f22c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293813, "uuid": "7697e635-5e17-4130-914f-ad01491598f2", "value": "24576:7GqAxHaCQ106UjumDdW+gg239cRBgtBqjjlG:v+gEWBb9cRBA0jjlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646293813, "uuid": "2ab55471-9b61-4832-9c09-302e130c7514", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646293813, "uuid": "73487485-98b9-48bb-ac42-eb104ade4b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646293813, "uuid": "1bd53686-6e58-44c1-9d17-7956a38634e7", "value": "DHL Shippping documents.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a857a9-9b3b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646344104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344104, "uuid": "941f796e-873e-4622-bd98-7297cb4004ff", "comment": "Malware payload (Heodo)", "value": "22e505b04ed9dcf59730e904bc767700", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344104, "uuid": "33496887-406a-4548-a3ad-f066421041b6", "comment": "Malware payload (Heodo)", "value": "b9d11112008d982a7aa1a82e01e0d9a1644c4a78183b654afc1690fee5119685", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344104, "uuid": "7cbf98f8-4ca1-46ea-8e2c-9d92fbf596d5", "comment": "Malware payload (Heodo)", "value": "b61ee47721f0d0d2f633ac36597200a99c93f700", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344104, "uuid": "82222f94-50fa-4b6a-97ef-44dae97a9bf7", "comment": "Malware payload (Heodo)", "value": "812c954042c95db6e45aab66ab469f4f34ee640e011c544218718bf34ffb61fe14ec12993ac59fd519febd862e0680e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344104, "uuid": "f50bb02c-683b-4a39-a23b-563e261e8c49", "value": "T1E7D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344104, "uuid": "9fdef277-71b9-4d58-b5a5-861baee985e0", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344104, "uuid": "2e292404-fa61-45c7-b994-75c62dde7d63", "value": "12288:J1U8sNY8/z0rYebzwd2CoGEAbcVBLku8w:oq6z0rYcMd2VGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646344104, "uuid": "be5a4ea6-8c12-450c-9646-d00241ed8c3c", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646344104, "uuid": "b2eef2c2-8583-476f-a2b1-03b6414acc55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344104, "uuid": "0f5db418-c18a-4037-8a91-18bc825273a1", "value": "22e505b04ed9dcf59730e904bc767700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce59e94-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646300440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300440, "uuid": "d0cd1dcd-2ebd-450c-9d2d-06c68ad2ce1b", "comment": "Malware payload (RedLineStealer)", "value": "821fa6aab23d6becaa80644e25d9e5e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300440, "uuid": "2920478b-9161-4a48-a0da-a149873f4a89", "comment": "Malware payload (RedLineStealer)", "value": "b9f8b4e6160b8cae38918dfc11b166102cf2d9ac47cf8443879eef4da81f7366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300440, "uuid": "3a617ddf-477b-4e31-bbaf-f225063421ba", "comment": "Malware payload (RedLineStealer)", "value": "5a5c60841475761cc8e5cfc94db6d236756f1070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300440, "uuid": "dccdb96f-6754-4e3c-ba29-a3e812693e56", "comment": "Malware payload (RedLineStealer)", "value": "1d06fb7e15c560d00b41dab9b64c206ca7f045387505eee2e72a76a99d9a5de362e0f8def4727575b134949c4130adee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300440, "uuid": "8760bc8b-517e-470d-9efd-a64197e2655b", "value": "T1163633ADBB1DD1F5D8ADC17905A7FF091A7317BA6487141B0DEE4883EB7400DAC2A29C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300440, "uuid": "e512c747-e20b-460c-b434-b4ae712c4afc", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300440, "uuid": "d747db47-6556-4fc6-89b9-0175b46bb27d", "value": "98304:rXnNjeWU4lSINKl7AMahLHg2lFJesSnMR6nJ8GvGUVwHl+zd1Y2APQQ:7nBeWdlSeKl7ApLHtgsSMRQJ8KVwFImn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300440, "uuid": "8afe6813-9ef9-42af-a92e-3e0d70877892", "value": 4875928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300440, "uuid": "9b8871ea-c80f-4d7d-ba1b-91528ed86e66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300440, "uuid": "c7dd8ce5-725f-4281-a95f-a930be13e151", "value": "821fa6aab23d6becaa80644e25d9e5e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0a12fa-9b1b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646330428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330428, "uuid": "e71b38c5-6a5a-4b89-a74a-37be7f27d5a7", "comment": "Malware payload (Heodo)", "value": "97f5d8fcf78c857dc750600a79b3172d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330428, "uuid": "8acab682-a642-4328-9cb3-d55be2b3e69d", "comment": "Malware payload (Heodo)", "value": "b9f98eb7a4eea6a7a83116d1f4e87fa368e5e5525b3775089d999dfd0a514bd7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330428, "uuid": "42fa43b3-5e66-428a-8967-c2b40ceceb8e", "comment": "Malware payload (Heodo)", "value": "d8adef1aa8883e4e4f3bdf022d6ff828dc4d209b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330428, "uuid": "a8b29283-8fb9-40ec-b698-ab533367d08c", "comment": "Malware payload (Heodo)", "value": "0be8ed985a45350d9260141cedad2f2285219fb224c657b9ab0a7dd6a3a693c3723c08a9c726bf0cee998ed6260e250e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330428, "uuid": "add16b2d-d9cb-4f19-889c-417602b3a4c8", "value": "T1EA353942BA48C5BDF04E08B9181EAA69667E1C447B3296D7338C7FDDBB319F90832517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330428, "uuid": "712ca256-a8d0-4d5e-8561-fa221527bf31", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330428, "uuid": "e8376336-c22e-4541-bdf6-1835d7926b38", "value": "12288:C4rjnpAeev7HmOsVUCfbWierRcDFtLlirkfIcsMEPe6MpPfXxiDjM+R:5rjpAbv7HmOsiR1cDFXiQfNsUPv4DjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646330428, "uuid": "55625acb-24dc-40a1-95c9-74fd0a12c146", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646330428, "uuid": "12a6a300-d56d-4483-b7e1-432bf8609056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330428, "uuid": "6ed1dbd2-9b13-4d56-ae1b-615f3231ca25", "value": "msw3bSaKAyocKUAZ1wPy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f088b920-9a9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646276367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646276367, "uuid": "1e009846-ccb8-40df-ab51-7b48996a6666", "comment": "Malware payload (Heodo)", "value": "3194696b17466bab7fc13473b0fccd90", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646276367, "uuid": "60bfbd82-6eab-469e-9e8d-211907c8ebb2", "comment": "Malware payload (Heodo)", "value": "ba5931f6c301ebd332a7c81c6632780f68a3fd2d94490b69ae377b53c27a24c8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646276367, "uuid": "382bcbe6-b307-4a9c-81a9-020b72ea9ef4", "comment": "Malware payload (Heodo)", "value": "9c0ebfb059b88ab30d038a37563f931eb772cd3b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646276367, "uuid": "9e5af7cd-0cd3-467e-a504-a3465f15c370", "comment": "Malware payload (Heodo)", "value": "664fac0a7ea7ab80b3977ef008c86ce9a7139c176d260f52d7c08faa980e87b60e2b6a37d2e5c8ea10f24aebe3c3b1b0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646276367, "uuid": "fb4593ac-018e-41d9-a171-64bcbf8829e8", "value": "T13923D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646276367, "uuid": "0c733bb5-1409-4922-822c-50a171133fe2", "value": "768:eeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:VoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646276367, "uuid": "afaf4278-eeac-4e02-837a-5cf7483e4e87", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646276367, "uuid": "7e63d6df-0ab5-441e-a31d-2437cef6487f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646276367, "uuid": "dc7f6fad-3bd5-4bb9-8751-6a4b3ed4ade1", "value": "New payment details and address update.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cefc99b-9ace-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646297165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297165, "uuid": "12e84d70-cf3b-43ca-b5f3-b9fae4e0f5b1", "comment": "Malware payload (RedLineStealer)", "value": "5434520c1fc8aaa0f334e995543b6c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297165, "uuid": "39b939f8-ec82-440d-b54e-80b3ebf3cd56", "comment": "Malware payload (RedLineStealer)", "value": "bbf67c955bf540ec7893ecbacaa8fc63f61e0d8f43dab06456f9606051fcfa4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297165, "uuid": "63e35c45-a2f9-48d0-b206-f8a9e76e495b", "comment": "Malware payload (RedLineStealer)", "value": "47d77e9ac89c7c212028f869e717042c32e2cb0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297165, "uuid": "51e5ed56-a484-4594-9ee4-06e0fb56c0e1", "comment": "Malware payload (RedLineStealer)", "value": "f46fa6c4cb05debac55b518e28fbdd886549ddc7fbcc369a8015650fe07d7082174ec9b2c678badc3741c7812d503e62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297165, "uuid": "873b770f-98cd-43f3-95c2-efa97c9371fb", "value": "T1BA751267F83660F3D7A661F470A089E2F036FC6B52D620A884C937C35679E63D53B252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297165, "uuid": "79f2ea96-fdc9-4e6c-a41c-66c7a3459950", "value": "8a8a09d67f33d9973fef6c94002ede79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297165, "uuid": "cd6d4625-046b-4b8d-9ce6-6f58734f4e6b", "value": "24576:lIFER7OtLqmNQr7XMvNu2+Uwm3AJJxH0Yh2zrMkfgkpr0/r2ZXcwOP6iGuYV7:HMQr7MNdH8XxVM4kYkprgyJ70u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297165, "uuid": "3b1ad251-d2f1-4b8b-af72-3d4570010d3b", "value": 1689040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297165, "uuid": "6fa85fcb-f608-4cb6-89ab-92eafe2c9dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297165, "uuid": "c1983644-736e-40d8-8d07-c814059a1d00", "value": "5434520c1fc8aaa0f334e995543b6c19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6557e1bd-9ae3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646306199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306199, "uuid": "0091a4c9-07a4-412a-b6f7-412c92e0b895", "comment": "Malware payload (RedLineStealer)", "value": "bb5791c973d5e9f73ec2e6108332e3ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306199, "uuid": "acf0a616-1b30-485b-aeee-226a31041097", "comment": "Malware payload (RedLineStealer)", "value": "bc585e3646575ca2ca96acb2a55a4a94524f5fe9388d75c34113b66940031a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306199, "uuid": "61dcc17b-88c1-46ec-9748-8373f467bc51", "comment": "Malware payload (RedLineStealer)", "value": "cf3298bf88376c66f631ed302c63c7d0cc972964", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306199, "uuid": "9b741d9d-c553-49cf-9543-9de04a268613", "comment": "Malware payload (RedLineStealer)", "value": "88c5a5bae203ec22004de3a9a888939cf04bcc0e9617e791b0ebb186713e514b655b919b22c5923a19ebe3adc7ab0837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306199, "uuid": "ee3f8845-dbe7-4e04-9e51-11eeb53b2cd3", "value": "T1F4B4B53439FBA019F1B3EF75DAD87997DA9EB7633607E85D204103874603A82DD8163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306199, "uuid": "15ebd5a8-3a69-47a1-b494-d6d382e06c55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306199, "uuid": "11de484a-96d9-48ff-bf75-42b99595816a", "value": "12288:pS4XSEFHdNJg92XqUrkzhK8v0roQQK0Bx3p3Y7:44XPBdcQLx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646306199, "uuid": "f5665889-c1ff-4acc-962b-2928af1f32be", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646306199, "uuid": "6a6ff0da-0c12-4e17-a6cc-d00b889419be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306199, "uuid": "da33f7f6-59e7-4b42-958f-969f764c65fb", "value": "bb5791c973d5e9f73ec2e6108332e3ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff7eb0f-9a93-11ec-9275-42010a9c0029", "comment": "Malware payload (LockBit)", "timestamp": 1646271910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646271910, "uuid": "ce12d636-5460-4f51-bac0-89296f758e19", "comment": "Malware payload (LockBit)", "value": "975efcfa0c3c1ff6fd019bf4fb63d5e6", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646271910, "uuid": "f40754f5-da4b-4dd5-b56e-0b9af55357d4", "comment": "Malware payload (LockBit)", "value": "bcaca6fc1d5abe8d437d22fc4fad17cb37eb727f84f4f07da1f98d279575e1f0", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646271910, "uuid": "c874df93-6768-41a6-8015-b830e92c4a2d", "comment": "Malware payload (LockBit)", "value": "3dd2ac97e967cac941ab0ff892f9f9dd55cb2a41", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646271910, "uuid": "259050f9-cc98-4b1f-90c1-ae6a7fba93f8", "comment": "Malware payload (LockBit)", "value": "abd6b4f9b62f7efb8ae2d4b760ed326a5fffd969cac18dba8d20de642bd379bfef3dff0cdfe6eb433d44b82e97f8c4ef", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646271910, "uuid": "2688d10a-72f8-4251-8e23-57df4a84c7cf", "value": "T1518423675C02CA20428AC85B3BC6065CCC73D55C062FAD7CADB25FB88B64DDBE0D575A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646271910, "uuid": "29b2c914-5c2d-423d-8897-063d649e3cf9", "value": "6144:JD+g2Hl65qFjZrUcEFln2ocPqECFRw35TpRd1Q4nxI8oxaZmNJ5+J9C:N+tF/9rol2ociFC53d1OXNFC9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646271910, "uuid": "7510b0a1-c244-4867-8d6b-3f4d35c61c2e", "value": 391268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646271910, "uuid": "994b8988-a9cd-4d64-a909-0e2b12b594f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646271910, "uuid": "1208c3c3-a46a-4a49-9a45-f388be27adad", "value": "LockBit_tasca.com_28.02.22.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c71157-9b39-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646343112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343112, "uuid": "1b0cca94-ae7f-47f2-9e96-e09a9751b8fc", "comment": "Malware payload (RemcosRAT)", "value": "30030ad13478365085e7708a9892afb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343112, "uuid": "fbc85424-c520-47b3-b0e8-dec710e60273", "comment": "Malware payload (RemcosRAT)", "value": "bd250e1cb4f8d322a5464549dc067ac7bcbecfc2d4fca46c40af8d23173011d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343112, "uuid": "eb4356f0-a6c2-4139-9878-3666ea1e81c4", "comment": "Malware payload (RemcosRAT)", "value": "d394e202a1ccfc5338a500b5faac8512ce37d878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646343112, "uuid": "9b1e9cc6-0527-477d-adb4-d109bcf80f0d", "comment": "Malware payload (RemcosRAT)", "value": "d0b3990102a4ed3a9a70f2f8b1aa79008ad88e904ca783fbc6ca8b69a4988218c4c8d886ced2a7df55003d67cbd91c5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343112, "uuid": "70eab5a5-c36d-4e44-a89d-614909297e86", "value": "T14E4533166B100DCDD3259AFBA56B386B6821D83F860FC98BC6ED5504ED06C1BCAEE351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343112, "uuid": "7665c4c1-e3fe-4d26-819c-d0d698df73cd", "value": "34e38af0cf92b3aa0cebc60b1cc8d0ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343112, "uuid": "09f01b8c-bc81-469e-90c5-5f8cec76ab4b", "value": "24576:oVT41Ou5rm2fqWo0ZJfR6A/h05nn0GnREJwzJnP/mgcsR:8Eku5KZWoeOAuZ0G+AZ/HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646343112, "uuid": "0d30d827-b381-4488-8dd4-1ad40937a06a", "value": 1275632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646343112, "uuid": "ea98ff72-42f2-43bf-b6c9-1a5ebcf49239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646343112, "uuid": "6e3b838a-c1eb-4819-86f6-3a12dd68e125", "value": "bd250e1cb4f8d322a5464549dc067ac7bcbecfc2d4fca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ac8a81-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "0e3b71a9-49ba-43ba-861c-40e7e51a2a3e", "comment": "Malware payload (Heodo)", "value": "9917f18776b8dcebc827d85145f0c02b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "248e6be3-4b10-4519-9a15-d505dacf44fc", "comment": "Malware payload (Heodo)", "value": "bda123328356095e5480c7eb1c623368dc7fbabd1e38cccb65f4a66100c613e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "69217552-6187-402d-b5ff-7e3bd1bb4511", "comment": "Malware payload (Heodo)", "value": "d92457c0df331ddb40351158fa714e1fce35b7d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "40cba48b-b80d-402a-b90c-0143b682952e", "comment": "Malware payload (Heodo)", "value": "ad44a96766bbfdc177cc17f70b4db1f44028e043cba69d6764a1201adf7e4df1b3bd29c841604e3fc9837dea77552eb9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "8ebdf2ad-1c96-49ed-a1e3-4d1d78bb8788", "value": "T189D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "5a412179-1722-465d-990e-2ff1968968df", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "e48146a6-13a0-46e9-99c3-55c3f88d58be", "value": "12288:ZxpNJJJ2NHPoczJ0OtIhxf3foRXIa5EPwvA:Zx2gczJ0Ff3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "7cbbe788-3697-44a7-b244-1ea35908c435", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "0a4c5a2e-2514-452e-a8d6-a85a1d6e7705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "5dff3f89-ca9d-4ea7-8352-a72b62d1dabf", "value": "emotet_exe_e5_bda123328356095e5480c7eb1c623368dc7fbabd1e38cccb65f4a66100c613e9_2022-03-03__000308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bb0ace-9b34-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646341235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341235, "uuid": "da510cf8-9040-4cd8-86cc-00a02568abf9", "comment": "Malware payload (AgentTesla)", "value": "dfd479d855ba92c59b03b2e5c9f97388", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341235, "uuid": "115345c1-418d-44a7-ab5a-41f5cb0a40e9", "comment": "Malware payload (AgentTesla)", "value": "bdc12d8ed8ee25ebd9e8ec000a22a91b0e3d37bb79d586869fcc662b8462efea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341235, "uuid": "6ba4859c-3a8f-4d74-a95f-87d1340dbfc2", "comment": "Malware payload (AgentTesla)", "value": "e67985191942aa0c71cab31f6e15b3f2ab535ebc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341235, "uuid": "7aa8d184-12fe-463b-a92f-ce24337bed4a", "comment": "Malware payload (AgentTesla)", "value": "9e527a59018ba910c33b0a1b7f8088528f451e4be8dfea2842a3b2165723afe936b3ad95ec6701cd62d73784d536215f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341235, "uuid": "299dce25-85bc-4516-9cbf-3691791b88b6", "value": "T152742365B3D156A3CF244A74283397B4C7BB628123A24E6FA78159AF1EA15C80C371CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341235, "uuid": "8e00f4cf-5111-42f9-bcfd-914b815ff17e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341235, "uuid": "87338a5a-e6f3-4a01-ab37-4da7361325ca", "value": "6144:rGibSt9x40oS2/OuG3neAyQQ3iCw5Q1UkfJfvtPtzxZg1gj3VMf:Kt9x4QeAymCwyvfJFPtzxZsS3Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646341235, "uuid": "738e42c4-7304-4c68-8fad-be0f37a7882a", "value": 356402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646341235, "uuid": "762cd360-200b-482a-9ab4-54bd11b2a633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341235, "uuid": "113f60dd-b4dd-4e98-bfaf-a301932ad60a", "value": "DHL TRACKING NO_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7ea119-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1646301107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301107, "uuid": "1bc89cc6-6377-481a-85c3-fbbd3dfc5d5c", "comment": "Malware payload (OskiStealer)", "value": "bb87e7ff6d125e8c0183018c86fa81e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301107, "uuid": "39dceedc-03d0-4667-bbd6-a423a8a2c01e", "comment": "Malware payload (OskiStealer)", "value": "be52ba286982ecb2bda4033824ce2fb1147300af2c5106cfed27cf3fb6022b1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301107, "uuid": "e8004fc4-1296-4d01-9297-37b11028dd44", "comment": "Malware payload (OskiStealer)", "value": "41a201db5fabb2f0e245d902fc69df141b91f4c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301107, "uuid": "3edb58c3-ef1d-49a4-bd64-49d1200558ba", "comment": "Malware payload (OskiStealer)", "value": "0592b699e788973572c553fc8475c24a5c9838e301d76fd2f511c02f4698faa87602acff20a7963e0090e22dbd707964", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301107, "uuid": "21010aa2-5110-4d81-a924-3796a6a607a7", "value": "T1AE54221AD2D076B7C2B488704C32267DFBBB85AB00F1115313F6AFA57B670D68119AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301107, "uuid": "1d7266be-5a8a-4fb6-8ed2-459fd5016bbf", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301107, "uuid": "ded5299b-dfaf-4fce-9a4c-8f51024518e4", "value": "6144:rGidlf9ja8ZbKaQLf9ibO/948aQofuacwGwni4OaCEP05gHxG/j:nVe8ZbKaQDew9MSwi+65F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301107, "uuid": "1d010ef7-51c4-4744-86f3-d7dc9bfb018d", "value": 296247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301107, "uuid": "973a3a8f-7ee1-4529-a5bc-283acebd653e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301107, "uuid": "fd47990f-c0e3-4260-b674-3072d0b75d52", "value": "bb87e7ff6d125e8c0183018c86fa81e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2641756-9acd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646296852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296852, "uuid": "d2c8c85e-5a1a-4639-84a9-3ec042212091", "comment": "Malware payload (RedLineStealer)", "value": "4d7391266c664799583a76cc6da68424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296852, "uuid": "ab9837f3-e802-4ff7-b299-09a87c92f14e", "comment": "Malware payload (RedLineStealer)", "value": "be7e411ea010e7c3bee637eaf2cb5b033c7f767841a59771ad422c4c4e701a0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296852, "uuid": "f68fdae3-c942-4c9c-ab27-128d2a03c58d", "comment": "Malware payload (RedLineStealer)", "value": "bbbb23f72a522bb29cc970c197c663de2073c35c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296852, "uuid": "532568da-f574-4b68-a416-dae81a85428b", "comment": "Malware payload (RedLineStealer)", "value": "b974e8a7bceadf27a87cda9ed4d75274adef40df713e491d51bb5d066bd1c4d500b6f8e178eea415de64323c42cb1656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296852, "uuid": "ba7c5ca2-9b7a-421f-98a2-83740da6b1c6", "value": "T18136338036D17917CB0386F43FFEBA5174279D9D98978106EF826025D344EDC9AD8BB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296852, "uuid": "aeb071a4-f4dc-4641-83c6-6bd41f3e6555", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296852, "uuid": "6a92dce5-998b-4c90-a1eb-4dc7294f295b", "value": "98304:5s6hpKB36YQvW/AZEsdKllH0NQC1LFuNW9VxLHrhpD:5s6hpKxQvjeuKbHCxuNSdLhpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296852, "uuid": "972d4da4-e527-4e22-82e7-3bbfa18dad83", "value": 4903728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296852, "uuid": "bf5a6332-4c87-4d95-a505-030a0dbfe820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296852, "uuid": "f9210090-30ea-4b50-adee-01455aed0a4b", "value": "4d7391266c664799583a76cc6da68424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ce5f20-9b1c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646330780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330780, "uuid": "77e82747-12ae-4b13-963a-a401a4eaf856", "comment": "Malware payload (Mirai)", "value": "0884f919246ebe0ab782b341d3819e6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330780, "uuid": "5de17ba0-7d5a-490b-9f7b-6c744e89a66c", "comment": "Malware payload (Mirai)", "value": "bee8c1bec98842c76764eaeffa2389c65cc724411e843c89df0e73af0438c886", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330780, "uuid": "4f4241f8-29ec-4e2a-8e27-2156dc3aae71", "comment": "Malware payload (Mirai)", "value": "2ada8998399aae6483a0d3917cb0093ed7ac7134", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330780, "uuid": "954165e2-282e-466a-bafc-71f65af4bb26", "comment": "Malware payload (Mirai)", "value": "aab6959993f76ee4c22eaf20055525498328188dba641d7fa7ff652df79ae713a7606f1b9fae651cd31a223e94a24ca5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330780, "uuid": "655ff641-cf1b-4514-aee4-277f33a27c29", "value": "T14DC39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330780, "uuid": "7d8c39c5-fb96-4e6d-8cf9-1b865d6f7e3f", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpU+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Em+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646330780, "uuid": "681902cf-39fd-44e6-8511-c52bd9f39dfe", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646330780, "uuid": "1bf435dd-42ea-40bf-a260-8173c32e1278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330780, "uuid": "8ac87410-1f22-40dd-a4bf-e9bbd1c08044", "value": "0884f919246ebe0ab782b341d3819e6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aaaee2d-9abd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646289887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289887, "uuid": "3d80b033-39dd-49f0-9fc2-c2b30c7168d7", "comment": "Malware payload (Heodo)", "value": "3b2c2053d333f19688bd0d209507cf06", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289887, "uuid": "7f32dc07-565e-4eb1-a4c5-b1b5d6111023", "comment": "Malware payload (Heodo)", "value": "bf17cbcda7df79d2e1030bf1a38e6c861eebeba5bc334e124617974de66a5a8a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289887, "uuid": "2580a73b-417c-4e7e-93b0-0237cf338d1d", "comment": "Malware payload (Heodo)", "value": "165a4c2e4bbfd39b9f56d96a0d67efbfc0bbb5a9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289887, "uuid": "65b408e9-fa3e-4b6f-9045-52211d8b5461", "comment": "Malware payload (Heodo)", "value": "d62298e01978f04c9bd639491574ae1646c136b838f3b16c898b6a156a1ee902710648fa0042c66cccee5067315bfce1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289887, "uuid": "538ef1f6-b123-4a13-9ff1-ac2d6a05d6a8", "value": "T19023E116C9346C2EC73E8C75420839A171596511A8CBFB5932947F0D3B86FCB67AE19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289887, "uuid": "61ed38ae-4a6d-445f-9a79-9ed06d97071f", "value": "768:H5WHFKfQzXTmbfRzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+UP6UCIHcX:HwF+OXabfFtT5fTR4Lh1NisFYBc3cr+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289887, "uuid": "613380e3-58d5-4b9e-bf12-6002efbb13ce", "value": 47898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289887, "uuid": "6298c84a-7585-4d16-ae56-80b75a57b321", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289887, "uuid": "a69cad50-9933-42c7-94f8-7def65ab4558", "value": "form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cd0875-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298274, "uuid": "32a33d5a-d533-44df-9629-a69bd5792b5e", "comment": "Malware payload", "value": "1c5d4ff4c7ffd6c0c6e56b238a4dc806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298274, "uuid": "830ac264-40cc-4901-ab99-92a8a6d80657", "comment": "Malware payload", "value": "bf20eb54e15c145d16f5d635b0b28d404705643207ca20585645c3aee7eaeb91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298274, "uuid": "b6d2e894-d2c1-401d-ba5a-b0aa09e85ef0", "comment": "Malware payload", "value": "87d9ef735d1fc177e207af0dc0aa6c32db60b61f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298274, "uuid": "71b18546-28c2-499d-be38-f7b20c459af4", "comment": "Malware payload", "value": "b6e7cd77177d066987b22b861a1b2d32764b2381b4241b356a1e2c194656007e87fc1413227fdb39d2571c83e7e909f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298274, "uuid": "38271821-df17-42e2-bae4-ee0a3dad73e9", "value": "T16F168E56A2E400E8D9BAC178C64B9917E7F178190370EBDB02B1526A1F23BD16E3FF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298274, "uuid": "eabed527-41d9-4da0-8875-5b84a54707f1", "value": "98304:/RLRLj41OH4wAIOF+kmcIxJr+fx3k/sc37gz+li0pjY:nj417x3Msc8Kli0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298274, "uuid": "25a40e35-dbbf-4907-9cb0-0e1435759bde", "value": 4193359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298274, "uuid": "87c37915-aeac-4105-b7fc-beac0cb06950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298274, "uuid": "9c3fe325-5c26-4302-9b04-d574f39a5059", "value": "1c5d4ff4c7ffd6c0c6e56b238a4dc806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cf3b92-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298900, "uuid": "f1538ac7-88b1-4667-a3bb-1bfebdcdc60f", "comment": "Malware payload", "value": "7152f3cbe6487fb29f50934d56c375a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298900, "uuid": "e7c4e77f-0546-42b1-8c45-ac1c2d5c0cba", "comment": "Malware payload", "value": "bf3208f8363c2f4c8f0c431ec05376c3b1fefff9175423bb242755173229308e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298900, "uuid": "5ea5e9b3-35a2-405a-a18e-262c76e36236", "comment": "Malware payload", "value": "cb60b0bb58f709cbbcaa126beb59a549b8dfda49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298900, "uuid": "7f9e16a5-567e-4bd7-8c52-2234f3a5fc06", "comment": "Malware payload", "value": "6f937954c66da483b625437a7165d74791447d7bab10ade2c59665b5e3573a29969d711c64a4d9e7b12ee1450d336315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298900, "uuid": "91741990-7500-4846-b7da-4cf60eb00c35", "value": "T18EC4BE17E6428076E4632430265D9B7649BD76300A2655BBF3C42E2D9EF02F2AB35F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298900, "uuid": "ed236864-80a4-4006-b6e4-6712cb1cde47", "value": "06c6e92acd3ff57b00b3132976b3f6d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298900, "uuid": "19fc0f7b-e327-44a4-859a-0ad7de7c1cc8", "value": "12288:F7vT8cGUCZmxIwNjVGCXZqmmJUL+JHkdIUnjoqhwLw4d:Fz4BUCZmxIw1VGCXZ5mJdkdZnBh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298900, "uuid": "d7b6a545-7584-46d8-84a8-d3cfdb15db68", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298900, "uuid": "8e1f7a20-5b68-4349-921c-59b154fa9411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298900, "uuid": "986f3e63-4e29-4b6a-a347-1e4876e9789d", "value": "7152f3cbe6487fb29f50934d56c375a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc397c59-9aca-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646295634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295634, "uuid": "7364fb38-92c3-481b-a714-d95e03b927f7", "comment": "Malware payload (RedLineStealer)", "value": "17e90b815308c6a3c7151fca6459d9fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295634, "uuid": "ce1dce57-c46d-41b9-a906-f0bb0fc4ed70", "comment": "Malware payload (RedLineStealer)", "value": "bf894da22560296f9b89bcdd35c2b248bec6f7731f408835151f5709d42e0ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295634, "uuid": "2f3f456e-d04a-4498-ae87-8656d1e30f81", "comment": "Malware payload (RedLineStealer)", "value": "ce0d8372bb80659826de14e764797804a8fa1d3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295634, "uuid": "20375dac-1fec-4f14-ab78-4690af2ea8a3", "comment": "Malware payload (RedLineStealer)", "value": "308f311cafb7d06c567904b9e20533730b2b02d9ec0a9363b79d53bf2e554ceb9ff81699f71810394b097928a254bf17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295634, "uuid": "49c2725b-a19d-43c1-bd31-4b0d8c2fee50", "value": "T16D9533A1AF545A27CB08A77902871F64E3B8C08907A6538BE4DDAC27FF5F1EC1D574A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295634, "uuid": "2db40f0b-7015-4b60-9317-1393eefdaa8d", "value": "d5d1d28a7ab95635f678965b5e009ddc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295634, "uuid": "825e5371-3c86-4060-b842-c12655e6ad1f", "value": "49152:E5TZiW5ktTsQtD5RRBIKh9E0P3gYG/MSqWeYIxo:uiGKDNKI9EQQpMBWeY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295634, "uuid": "8f6def76-3b88-4110-a5d9-99893102873f", "value": 2022912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295634, "uuid": "f36b61c5-2b6e-48fa-b434-4d87de6caf64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295634, "uuid": "263fa8bf-660c-4265-a62d-1133590cddea", "value": "17e90b815308c6a3c7151fca6459d9fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592af692-9ace-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646297159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297159, "uuid": "7b3b842c-d977-47d7-845d-b584e89b9a15", "comment": "Malware payload (RedLineStealer)", "value": "4a6c4ee5ce1cf30938d62b3452776edc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297159, "uuid": "12069573-4b38-4f4f-8447-a8d6d28f018b", "comment": "Malware payload (RedLineStealer)", "value": "bfd5afbf1e2c67f0369ade5bec262372f4b5d716520cb147e37050b30bdfb920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297159, "uuid": "8087577a-3205-4573-bf2c-2e4353b59875", "comment": "Malware payload (RedLineStealer)", "value": "2ee538c0fce1b263d27783b25818095888ca6236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297159, "uuid": "ef3fee9a-79ca-470a-bee9-049ecb948e93", "comment": "Malware payload (RedLineStealer)", "value": "98730abd29dc6c77e8083628f0e411591f4e8babacc77f15f7ef6de2d2fad8e35a6bd35c77ceedfd0088d1b7a5cc8bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297159, "uuid": "ac63489b-eb94-4e90-8011-9374ca53f5e9", "value": "T112C423E31B803984CD0345705EC45E2FADB99304E5C044ABB269CD62EFC89B7A7E947E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297159, "uuid": "984bd7ff-4b09-48f2-a298-0384380c4de2", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297159, "uuid": "d802eacc-530e-42df-83be-2e618791b4e5", "value": "12288:zz5sduiJycvABAnQ0md7vLQS03ULaHNqrxlKIQNoVoj+SZ5LLySA1:zz5sEiwcvAn0mdvLkEaHNYK3vj+evO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297159, "uuid": "cd0a743f-f07b-4bb3-af8c-4f969103240f", "value": 563504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297159, "uuid": "47d63fb5-90cc-4422-b89c-f9afc0271a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297159, "uuid": "8eea15ee-9558-461e-be5b-e0e6b28ce086", "value": "4a6c4ee5ce1cf30938d62b3452776edc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ded0fb-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646301040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301040, "uuid": "719c50e1-20ae-4719-803b-b9b7cd33f23b", "comment": "Malware payload (AgentTesla)", "value": "1d0c4515cfd17abbc9161fce3eeef773", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301040, "uuid": "fdf514f8-00f7-489a-83ac-65bb19bd0764", "comment": "Malware payload (AgentTesla)", "value": "c04f065fa78f73e0226e3078c4cd5bb96141ea0ecf1c5fa3d2fb95f7869d2f22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301040, "uuid": "ef0fa945-355c-45de-a1ce-3a98af3e8898", "comment": "Malware payload (AgentTesla)", "value": "acbc900a8faea1f727ed5bf2ff5e8de627afdf78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301040, "uuid": "8d1da4dc-0fed-4ae5-a3f8-48b2df2f84a0", "comment": "Malware payload (AgentTesla)", "value": "64623ae2e187a773b68e0e4dfee1a1420ae62b6afe8f50cb3da0cf4d4e7d22903507dad6839428317a697d8624834cfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301040, "uuid": "c35915a4-57f2-42f9-a8ec-853ad249cae1", "value": "T13115D00439E68038F97A8BB1DAC4E7F09B2DF325E548B0B658005E157646B7DC94AEFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301040, "uuid": "3aa52a33-db83-4d06-97e0-1c0530a31901", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301040, "uuid": "6e13e214-e56d-4ec1-8014-3d1ccff8a5da", "value": "12288:pAR/IGTqPyf86FzxiicEKqJZkEE0Wm4JiCVRE6eYCrPbnRYn8MdTJgRmB+hUR38l:peJRNfchq3brW8wV8lY8osU98wK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301040, "uuid": "6a0f7104-da73-472b-a462-add68dfab0f3", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301040, "uuid": "883b1fcc-c222-4098-a536-afdf256dc9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301040, "uuid": "3e35934f-f912-4671-9fa2-e409c72bbcdd", "value": "1d0c4515cfd17abbc9161fce3eeef773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11f4f01-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320982, "uuid": "304acf36-4056-481c-91e0-0d8da5782d2c", "comment": "Malware payload (Heodo)", "value": "f07728b1aae296506a4eb9e7d1c2dc7b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320982, "uuid": "41d66e58-cc11-46d1-91b5-e49caaf5948f", "comment": "Malware payload (Heodo)", "value": "c1076aa47be802e4ae6a2d585b36be5b0782727943d40fc966a51c01b74644fd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320982, "uuid": "b21875f9-e35a-4305-9c9d-002353ff9a0e", "comment": "Malware payload (Heodo)", "value": "70b39614972df2c10cdc76fc2ba24edd0664cbfa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320982, "uuid": "cc02557b-f5dc-413d-be8e-4e2ad9d72d6a", "comment": "Malware payload (Heodo)", "value": "6fe56b6352252db6bcd4414f9e0fa7cfa974239a579c0946f70ff5cbf1163c436f0a62d0b2472feacf1f79fbc7a48c41", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320982, "uuid": "b802de2d-56cc-4bad-af8e-b49e782357ec", "value": "T18823E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320982, "uuid": "d393079d-d117-42a1-963d-29fa1b207780", "value": "768:K/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:K/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320982, "uuid": "6492d4d6-3cda-4789-8df8-70fe1d02e89f", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320982, "uuid": "26b7d56d-e09a-4078-bc6d-808b2de155e1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320982, "uuid": "af325e69-6863-4caa-a278-e5d30e3bc296", "value": "OMICS_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddadc70-9acf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646297757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297757, "uuid": "3e0c6d6e-e48a-4021-be56-f3499f08e340", "comment": "Malware payload", "value": "3b63821a301af608a2dfd7b274f69266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297757, "uuid": "c8d03d4c-7908-40ca-8eaf-6c51fdd5a040", "comment": "Malware payload", "value": "c153071c43613a6ff4c454e3fda8c29ac41908fa8e6dab9d9f021e9263b456a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297757, "uuid": "09cc6f80-2500-49db-bc25-9b14ded85925", "comment": "Malware payload", "value": "dc6eda319f754859fc555c7664546502fc89fc14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297757, "uuid": "dfe3a1d6-440a-4aa3-a9e3-412ba3adc189", "comment": "Malware payload", "value": "e24732dcda63b2d4acd1a0f6dcc06a6376a946fa1f4dc743c9057d9ef79ae8cc1a40915ded561e6e0c7ee5c6c506518c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297757, "uuid": "ddc7f140-0c65-476e-bcff-b24a6e98c957", "value": "T16FC4BE17E6428076E4632430265D9B7649BD76300A2655BBF3C42E2D9EF02F2AB35F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297757, "uuid": "e26bc33c-3f23-429b-86ac-ac445a013ceb", "value": "06c6e92acd3ff57b00b3132976b3f6d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297757, "uuid": "62e9a9af-9248-46b7-8162-3c8212dde0f9", "value": "12288:F7vT8cGUCZmxIwNjVGCXZqmmJUL+JHkdIUnjoqhw5w4d:Fz4BUCZmxIw1VGCXZ5mJdkdZnBhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297757, "uuid": "f4b03532-aa72-431a-a46f-72a316cdea6a", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297757, "uuid": "eaf4047e-124e-421c-8efb-da683b1e1719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297757, "uuid": "0ab313cc-2840-4030-9464-df6e97e94fb9", "value": "3b63821a301af608a2dfd7b274f69266.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d00b479-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646294454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294454, "uuid": "165e7f1d-bcf1-43b8-b542-f35bcbfe7c00", "comment": "Malware payload (Formbook)", "value": "ff3bcab544950925b95ec6a9e7fb3ac1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294454, "uuid": "8347515c-b5df-45f4-bc39-85adeb295fd9", "comment": "Malware payload (Formbook)", "value": "c22cac70a31c08610c8e2ad6fe65804b6698500c5da9a8dff5da1a90f8efe56c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294454, "uuid": "a2bacc32-5634-4615-b978-a6de444274c3", "comment": "Malware payload (Formbook)", "value": "16df2f6f5b1dcb36438a83744d1b40374a502a09", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294454, "uuid": "76e84607-ddac-4345-91ed-f82044abb111", "comment": "Malware payload (Formbook)", "value": "2a3f444c4fbb46b3a95645678c9f295ce76504ce835b31561225fcb2104a1611c18b65b6924d50ba05fe057e6be5959b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294454, "uuid": "e007dcc9-05a0-4c6b-9c2a-9ed461f33b3b", "value": "T1E214126DF2F891D9F2DE5531D2AF8639BF28EF4464662F27314E388554BB80226380F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294454, "uuid": "994716d4-2e48-4b79-88bb-a8c4d20de947", "value": "3072:yBkzsTvL87XdngflAw0WwQjYQqXn79/aviCCX1GgP/wmUf/ERuqTQ+zgM9iS2hRk:0kYo7NngT0WwQYF1CCl+mi/ERuqMftBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294454, "uuid": "0c318d26-48e6-489c-99f2-2ff4c13f60fb", "value": 190568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294454, "uuid": "3f855595-e820-4fe5-8a41-f492575d06aa", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294454, "uuid": "7cf7c379-af71-475d-8a0b-33855c55d635", "value": "Remittance Advice_178.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64226f18-9acc-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646296318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296318, "uuid": "86c76d7a-8a95-45cb-97a1-2c9578c01dd0", "comment": "Malware payload (AveMariaRAT)", "value": "85efabef8e9e4b4a5272429dbfb13bcf", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296318, "uuid": "15f1812d-e93c-4f14-966a-273c5a8a4b29", "comment": "Malware payload (AveMariaRAT)", "value": "c241ae9d95421c026e56410c707a74de57e2f05505a461af475510f3c8a4ccb4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296318, "uuid": "4431c1de-52f2-46f5-908e-8a47b01a56ab", "comment": "Malware payload (AveMariaRAT)", "value": "f6b25af46497d7a09fcc542b134e05d89daf733d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646296318, "uuid": "6e333d7c-5add-4750-9e96-af7148a2ec7d", "comment": "Malware payload (AveMariaRAT)", "value": "895d47268b9f0f409d64e8ec6370fedf3d6ed873511cc7346cd922eabc36c873d489cea9b4c43eb2cdee7aa6654223cc", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296318, "uuid": "a88fa1bd-3752-40c4-ac8b-ac58e5b809b7", "value": "T15205CF9D7650B5DFC597C872CA981C64EA20787B430BD103A027AEADBE4E59BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296318, "uuid": "a9dbd450-1e4f-40df-bfd7-c5756d004729", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296318, "uuid": "fce358f2-f420-41c8-98ef-370db46ef901", "value": "12288:zrT8ETMW23HzDiXqCql7Q1AiwIJE9KTtd1WxZ0NQis/zWaspU/fgAFwy:z/qF3Tkil7+ALGEUTt7E0O/zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646296318, "uuid": "34929aa7-5f5f-45dd-bfa4-74da634e46a2", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646296318, "uuid": "3102672c-8841-4527-b147-5e5195c9b5f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646296318, "uuid": "52eb7dc5-f62e-4671-9ca9-339fdd1b4c23", "value": "Arajanlat keres 2022\u00b703\u00b703\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c63bcc7-9aeb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646309539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309539, "uuid": "91471f53-d970-4311-a92d-93bf897ca8ac", "comment": "Malware payload (RedLineStealer)", "value": "72b06da5e2d23ee12b89d891e80bda5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309539, "uuid": "7aee414c-b9ee-4400-aa34-95bfa7b709c3", "comment": "Malware payload (RedLineStealer)", "value": "c25e427b4cc4f925eb98334fd1795f2e3dc09eaf4df8cf1342dbca9ae33e18f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309539, "uuid": "9129e247-4fe2-4b82-b4d9-a2f01ec593bc", "comment": "Malware payload (RedLineStealer)", "value": "1e31ab5828fa44e161060d64a37dedcac6909b2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646309539, "uuid": "6eaec685-8bc0-4c38-bc15-604a259627d5", "comment": "Malware payload (RedLineStealer)", "value": "a65d6a12b8680d6c48ff9e89e2ef2387af2ab8ca4030958e022b1fc3e9624ec59729fe0dc8df93f3b6a52745ce0befd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309539, "uuid": "af785435-e34f-401d-b20f-f2d0c948cd3e", "value": "T184B4C43439FF5019F1B3AF75DAD47997DAAEFA633607E85D205003864A03B82DE9113A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309539, "uuid": "6a1bbbbb-c514-458a-9921-c821ffb4f209", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309539, "uuid": "429ce764-9271-4761-8b80-f07f086f6cc9", "value": "12288:clUeQf6nRLsnAVMdk4PENAELIdsxtMqV56OXnulO0kiY:yUeQSB06rHkQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646309539, "uuid": "f0351558-b856-4fe8-9623-6dba93707264", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646309539, "uuid": "08afcb65-3740-46a3-b05f-00304956db7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646309539, "uuid": "9a532de5-5d3e-414f-b344-aff164bf9f5d", "value": "72b06da5e2d23ee12b89d891e80bda5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61f643e-9b0c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646324024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324024, "uuid": "bbb54827-de75-4145-b887-979743e774d3", "comment": "Malware payload (Heodo)", "value": "ed81c6b462e4997b2a8d0c1dc9056c24", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324024, "uuid": "5bc8b0ba-6b11-4bf4-bffa-7464fb6d8bcc", "comment": "Malware payload (Heodo)", "value": "c297d1452232bf05ebfd1ddf7638b34bcefe36c818124d4193a55327e2cfa1a9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324024, "uuid": "0d495f58-636f-435b-895e-b373be96b869", "comment": "Malware payload (Heodo)", "value": "cc9e9e9415b6fd908c70e4d2935795d57bc09934", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646324024, "uuid": "03dbc53a-bcab-4443-b8b0-8faf43e200aa", "comment": "Malware payload (Heodo)", "value": "0d1360ed25afd39c9cf1b9d67b29c75745bf93cd394ae6ea65ebbfb51c7a90f3c566e3a1c9332db971e7681b6db42517", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324024, "uuid": "ab4fe64b-9510-4791-959c-3e2f433f3c05", "value": "T11C23E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324024, "uuid": "7375e606-3ff0-43e8-8441-31c40d593f21", "value": "768:+/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:+/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646324024, "uuid": "d389fd19-efb7-4608-8257-9e6306ab1798", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646324024, "uuid": "dabe2359-90d4-4e4d-b376-500dc183d794", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646324024, "uuid": "ff3c929e-1cfe-4ecc-8acb-0b646c4d9ebe", "value": "Details 2022.03.03_1652.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6253c0b-9b48-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349794, "uuid": "fbee7d11-fa96-4a53-9199-ca7aa92eac05", "comment": "Malware payload (Heodo)", "value": "19e397cb644257221dec7bd2b7bcf064", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349794, "uuid": "0fce36f4-c197-409e-8bcc-970b935f24f2", "comment": "Malware payload (Heodo)", "value": "c2f05ab2767fcd35b1600d579f085ee6faf735d4e521aaaa8659186799187a52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349794, "uuid": "dcd0b440-979c-4e41-a9b8-bac1a16e2852", "comment": "Malware payload (Heodo)", "value": "57768c419494987e83f6f879c4d92c2f38e79ebe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349794, "uuid": "550b3d28-fe4e-434e-a560-2edcdc63172f", "comment": "Malware payload (Heodo)", "value": "e3e27a8cd0784f77212fe82fd11209aa6ca3772a4551a5cca4aab29d90a982e2d1505f756fb5b34085dcc3c45694d412", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349794, "uuid": "7ecefcb4-abf3-4b2d-8b27-30b6a32cc8b5", "value": "T1BCD45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349794, "uuid": "dd718f51-2f6e-407b-adfb-7fb384dd9c55", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349794, "uuid": "13262505-767e-40a2-b834-050c967decb9", "value": "12288:J1U8sNY8/z0rYebzwdLCoGEAbcVBLku8w:oq6z0rYcMdLVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349794, "uuid": "81c47714-e916-474a-a3a6-dd1ce258a148", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349794, "uuid": "084ed1e7-b4e0-462e-b0d2-48c439ace5c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349794, "uuid": "5d677d18-cf7f-4209-8dca-42e64b42f7a4", "value": "19e397cb644257221dec7bd2b7bcf064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2457de78-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646300077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300077, "uuid": "ed4e509e-1059-408f-adcb-14da2a3a5cc3", "comment": "Malware payload (Formbook)", "value": "8552a2e49a799e356c0cc86c663404d5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300077, "uuid": "3e5d57da-75df-4b93-86fb-5163447691f1", "comment": "Malware payload (Formbook)", "value": "c3149977a94d97c9932e986559fb155d85a194a1adddcf85e64013e966b843f4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300077, "uuid": "b8bc4d23-0a41-4b34-91f1-c2bb48f6fe17", "comment": "Malware payload (Formbook)", "value": "ae002f147d5697e86ec75baff38c692da049b5d4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300077, "uuid": "6f612f46-c877-49f2-bfc0-a1d3d532a3e6", "comment": "Malware payload (Formbook)", "value": "eec30540a3183399ebe8c9bbcbd2261d8d9bdb5b5b1444ed6b28731e3d8edaed4374380a6ac0c4bf0dafee28ba05db61", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300077, "uuid": "d5815e37-55a3-4a44-a855-e6a8fd0bbb52", "value": "T19A141275FE6F9AF6EC520532BA9B22251D41CE09E583C312624176197B3CC5DCB8333A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300077, "uuid": "e8e1dfc9-dc53-4710-9439-4eff2c69bf7d", "value": "3072:PoDj9WXCcvBpnqLFjJbhv3qYotqM4deRdZ/fUneZ765KvxnOXbvUr2FXLCu:A9W3nijJdCF4TeRT/Mes5AnOLvXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300077, "uuid": "7d0e31c3-975c-4430-a912-a7a5d8c0420c", "value": 191144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300077, "uuid": "13ccde12-cb08-43fa-94be-31f0f39e2abb", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300077, "uuid": "30f5b0dc-6dc7-40f2-b911-ce96791ff72d", "value": "SWIFT Transfer (103) 018OUTQ180222053.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430bec17-9b33-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646340501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340501, "uuid": "cc2755a8-7beb-4c6f-8f9b-554e19d092d6", "comment": "Malware payload (Heodo)", "value": "7fce55935fae3d76f4b7ac05c99784bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340501, "uuid": "6fd8caf8-753c-4c97-8240-220ee9320ffa", "comment": "Malware payload (Heodo)", "value": "c34e40a8ef0071257b130c092cf4d7e684dcc82d5dbfb17e9fcbc147dd04691e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340501, "uuid": "10322ebc-78f2-4ee9-8b57-81bb49685c24", "comment": "Malware payload (Heodo)", "value": "1c6f40ca0e89127cf8c601313a6f2c32f1f7754a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340501, "uuid": "d3c295b5-28de-4220-ac93-3f96d944ee1f", "comment": "Malware payload (Heodo)", "value": "e67affeedcbbfe296eaa8e2e71152cb5d2b0c157a6eda08d254293667eb602478af368d09178c447c1a2107daf98a602", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340501, "uuid": "7ba21097-fb9b-4303-8eba-3040178ab014", "value": "T189D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340501, "uuid": "3caa781f-9527-465c-9099-2c6b9ddc9583", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340501, "uuid": "f33b6bc2-4075-404d-a2a5-4dbd37ced9d9", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLTCjzhmD/bwb1r8Hc:Bg4IqjYTT20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646340501, "uuid": "605fa5eb-844e-4084-9f9b-8fb48624948b", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646340501, "uuid": "d7e6d919-3f68-4a0b-a02c-41fcdc34e85c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340501, "uuid": "587973e7-d276-44d6-acbd-9629a3e16e1e", "value": "7fce55935fae3d76f4b7ac05c99784bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376b58c7-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298820, "uuid": "f54eccab-2282-4593-b95a-d9f8bdb6dcd9", "comment": "Malware payload (Heodo)", "value": "92daec836624c3d9253bdb22b631e60c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298820, "uuid": "03aa9688-4b79-4693-9dba-2dc7b4344e50", "comment": "Malware payload (Heodo)", "value": "c4d1fe9267694022f83f271fb5506105aa4dd0e415bb65f0d97abaa63df2580a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298820, "uuid": "a5c93265-d8f2-4ff0-b59a-47199c30fbdd", "comment": "Malware payload (Heodo)", "value": "84ae62440ac780b3935b80932d5526739c34556e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298820, "uuid": "4a6a8cb9-6918-4e22-819d-211210cf483c", "comment": "Malware payload (Heodo)", "value": "69177878312fe619f7bd853be2d745dce46ac63089cc42d1940c1d6feccdcc0f8efecaa06b44a97a1f5ac58fa03af801", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298820, "uuid": "15b3ddef-cf6a-4703-aa88-bc6d88301993", "value": "T13E353942BA48C5BDF04E08B9181EAA69667E1C447B3296D7338C7FDDBB319F90832517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298820, "uuid": "4ac73ac7-bd80-431a-bb21-008ec1ac113d", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298820, "uuid": "10886091-8a15-4263-822b-57a40f80617b", "value": "12288:C4rjnpAeev7HmOsVUCfbWierRcDFtLlirkfocsMEPe6MpPfXxiDjM+R:5rjpAbv7HmOsiR1cDFXiQftsUPv4DjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298820, "uuid": "2b34c8fc-96df-4462-8418-c678a6b28032", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298820, "uuid": "6ff21f1f-ae82-4a24-80cd-c3b250ebcd1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298820, "uuid": "1a6d9ba3-342f-459c-8157-865b6ac6d582", "value": "emotet_exe_e4_c4d1fe9267694022f83f271fb5506105aa4dd0e415bb65f0d97abaa63df2580a_2022-03-03__091335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50201473-9b36-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646341811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341811, "uuid": "d70b9064-a76d-448f-ac2e-d9d5bbb99c27", "comment": "Malware payload (Heodo)", "value": "ef93fcdf34b741606a358a1a262586f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341811, "uuid": "30b96a62-0099-4ced-a0b4-80898a067b07", "comment": "Malware payload (Heodo)", "value": "c4edc4d859ffc6bde941e2198877a23d4a8d4ce09af5d996e74ae16788ddb1a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341811, "uuid": "98cdc47e-9920-4fea-8ac6-0d5bfb13ac22", "comment": "Malware payload (Heodo)", "value": "2f493a564035958e5a1c03d5afb8d686573fa028", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646341811, "uuid": "2eced1fa-2037-40ed-a412-007fac2e88cf", "comment": "Malware payload (Heodo)", "value": "05d5abc5b7d4cda3c253cc398ed86b2a2fbd4a164501a3d89923fc4eeea4701cdeb1b77b8b666dc7910c9bfc02bf3013", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341811, "uuid": "f78cb446-86d5-47b9-a6bb-3dd219756c62", "value": "T1E1353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341811, "uuid": "9044cafc-69ba-4266-ae7c-e420163cb9ac", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341811, "uuid": "b98845d8-bd66-4025-afcf-ab1af10006cd", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZ91EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZRytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646341811, "uuid": "9149159c-8fe5-455d-9dff-2d74761e7673", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646341811, "uuid": "fe267523-c2b9-49b7-8ee1-b76058d345d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646341811, "uuid": "7c747a41-92dc-4e88-803b-9bd8c560f526", "value": "ef93fcdf34b741606a358a1a262586f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfa6491-9abb-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646289167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289167, "uuid": "5f9909ab-5e4b-4aed-9731-b75f7ab1927e", "comment": "Malware payload (Loki)", "value": "ed86b6e4c9f116001c3b27744c5c50ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289167, "uuid": "7633f31b-80fb-4301-ba1b-d0b3898412cd", "comment": "Malware payload (Loki)", "value": "c563c22a6ef57303146195f39aba8eff9dff5e46ddc85e05fb6dab4d14543bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289167, "uuid": "12f03548-8035-43c5-918f-14e5924df38d", "comment": "Malware payload (Loki)", "value": "2b99507e29bdee7f2b2e03c2cf2941f45203e217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646289167, "uuid": "9ab64601-5a6c-4b70-a303-03e70f51367f", "comment": "Malware payload (Loki)", "value": "3177feb31ac51b22d542c584d80646edcbb1918eba8f30d6ea66610de105a809d020bb875a434803016af26e7e5e516f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289167, "uuid": "6e40df9d-3f3d-4e96-b35f-94c4a8a5a1b4", "value": "T155F4C00439EA4038F9768BB1CAC4E7F0CB6EF225D549A0F654105E157A42BBEC949EFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289167, "uuid": "fba8090c-e9cd-4052-8693-f1b2b8c53695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289167, "uuid": "a54f0426-5d82-4b24-96eb-019f7be40c3d", "value": "12288:rdR/IaTsP0fFwFIC0uetx2X3z4VB+0VISU5FS6gR0IhY4LyQbp1Dm:rzgsfJDbtgX3A5Uq9R0kym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646289167, "uuid": "2e0fc419-cf43-466c-85bc-05d9e8af1011", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646289167, "uuid": "9e11644f-7358-4685-bc79-1ac03ff9f09b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646289167, "uuid": "7c59aca7-0bcb-4d8b-8b0e-e89ea5753467", "value": "DHL Receipt_AWB8114704847788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0614bac-9b06-11ec-9275-42010a9c0029", "comment": "Malware payload (ZLoader)", "timestamp": 1646321330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646321330, "uuid": "52b75967-db9a-4f23-92ed-2e2b79c6014b", "comment": "Malware payload (ZLoader)", "value": "72d9d1613f2dd8d89d2372cc5f22e316", "object_relation": "md5", "Tag": [ { "name": "bat1k2", "colour": "#6D09D6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646321330, "uuid": "6ad322fa-819a-447c-a242-532fdb5b5204", "comment": "Malware payload (ZLoader)", "value": "c5adc361e52c9a978ab90c6e56379a7c6202381e34d82a2a73b007c2469263bf", "object_relation": "sha256", "Tag": [ { "name": "bat1k2", "colour": "#6D09D6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646321330, "uuid": "2c186cd1-a977-4f87-8029-fb256e3a4e00", "comment": "Malware payload (ZLoader)", "value": "07ee0fe5a1b4c51fca014d1b6aa9accdac6f0a00", "object_relation": "sha1", "Tag": [ { "name": "bat1k2", "colour": "#6D09D6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646321330, "uuid": "75d0b4e1-153f-4b04-83cf-c1ea28a95e7d", "comment": "Malware payload (ZLoader)", "value": "5d4ee5f731abe188920a5bafa83b81e00ece5b7ac8ea52f57ca5495fd928ff49e5bfb0281149e7b67d4a71e338145e8e", "object_relation": "sha3-384", "Tag": [ { "name": "bat1k2", "colour": "#6D09D6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646321330, "uuid": "b0a5891d-cacc-483e-8fef-558cf380b6b5", "value": "T121A449356D819F25DC2D55F84F948BB40CA4ACC07A2F4DBB228FF62BD9B2E410D29791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646321330, "uuid": "04bdec53-8ddb-45ce-bd24-f77c0a91c5ba", "value": "49d449535c1512855882f9dbfb8a5ea2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646321330, "uuid": "8a5bb5b8-326e-4475-81ac-7853faf79d2d", "value": "12288:ItcypQ1tIsl4qSZ0caEEtBTgIn2n0hgYTln8rw:ALQjKaEQg2hgUSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646321330, "uuid": "4894cdef-cfc1-4695-bb11-58066c075a76", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646321330, "uuid": "180ee6d7-edc4-4b69-a297-745e3631d7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646321330, "uuid": "c12b2e4e-e6a6-4102-a606-e2218a3049f9", "value": "gily.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7cfe87-9ac4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646292898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292898, "uuid": "557ef236-0a1d-42b8-ab6d-231c57adda54", "comment": "Malware payload", "value": "fd3fc15bc64dd178c90b065ad6b29a7b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292898, "uuid": "f52efdbc-0307-4e3f-a59e-d9a5afc14809", "comment": "Malware payload", "value": "c63236c72ef56f8215cb6b710b230032eb122809d3ab21eaad7ae4077ac6283c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292898, "uuid": "aa1de58e-e402-4b18-b848-24fb7eb6bf2d", "comment": "Malware payload", "value": "2c30395afd090561ac8ab67fd2a6b7b968a04c64", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646292898, "uuid": "271ace11-e81c-4c7f-88e6-eb7566b8716c", "comment": "Malware payload", "value": "87e18502dd0fa447b007c0be6e08dbe6b104bce831d17ee02ece711a267540dffa41c53d9a3c607d84b226eb4ec71e01", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292898, "uuid": "9d450e69-cb4f-4224-832b-de189ec88e1e", "value": "T172E5F102F770515BC4369AFD620B83B211195C4D8996EE067D4CEB79B3FEA842FB6384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292898, "uuid": "1c67756a-56ef-4a6c-93ba-eebe2c20e7c8", "value": "49152:BR6/6mXYPUr2mht/vp4IDOkyoDxleeCMgarE/LK4jNudMjKu7GCu+E4FNcAbQ:zim89tZakyolleeCVaATfCMjjGp+LFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646292898, "uuid": "e60c0c38-cfc0-4454-8e2d-e6535cf7ce6b", "value": 3299871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646292898, "uuid": "3cc2d597-a9a4-43dc-9e56-30a5c106a81e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646292898, "uuid": "466001f7-571f-444e-b2ec-2a073093445c", "value": "tap.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824b4c27-9b28-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646335882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "6ddbb832-152a-40b7-a689-f6e1718f62f5", "comment": "Malware payload (Heodo)", "value": "41ea3588b649fd4bef426ba3a97d2a3f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "20151f72-be93-45b7-a5bc-acbb8788d3fc", "comment": "Malware payload (Heodo)", "value": "c646376d8b7d15bc892166edbbd69206bf9e383314d8f76ace2d26cd30b6f219", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "cc0dea05-6f07-4e0c-bc1f-6c8e1a0990ea", "comment": "Malware payload (Heodo)", "value": "0d26447195a80c56d83a0c42742cc820eb811ba8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "a28cb687-f688-4b3b-b471-f1857dab29c2", "comment": "Malware payload (Heodo)", "value": "911d90d18333c93bcf2fb216928554489c015067fe0387608178db4f8161dd7247efac761d6421fc840dc2c7fd6104b9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "2a13061c-6c8b-43df-b080-e05b3f5a95c3", "value": "T1B4D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "28df845e-d416-4540-85a2-bb42ae009d2a", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "43c4b753-f254-44e3-9a2a-825dc302c942", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLrCjzhmD/bwb1r8Hc:Bg4IqjYTr20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646335882, "uuid": "8b660d53-401a-4548-a941-4caaab6a82ec", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646335882, "uuid": "1441a783-4b4f-4c7a-8b73-cd60a1ac5b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "eeae871b-5273-4fe4-9076-8c6082144122", "value": "emotet_exe_e4_c646376d8b7d15bc892166edbbd69206bf9e383314d8f76ace2d26cd30b6f219_2022-03-03__193116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0884078-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320981, "uuid": "45e5c7db-aef5-4dd6-8f34-fcb8d9f9ec31", "comment": "Malware payload (Heodo)", "value": "0a558c06b82d07526f2827179730bc39", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320981, "uuid": "9d6237f5-da8e-4866-88f2-7c24bdf4e4fd", "comment": "Malware payload (Heodo)", "value": "c668cc85ce01b12c0a782a2efdd4c579566096d37d92be40723d358286facf40", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320981, "uuid": "58e61078-caae-446a-acef-ce732b8b3f23", "comment": "Malware payload (Heodo)", "value": "69a0e4d5773d1d2940d080c1b2d9dc85f25bb16e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320981, "uuid": "cf8990f2-595f-4165-912b-96b73277918a", "comment": "Malware payload (Heodo)", "value": "45bbb2d122737ecbd21e266e80d61d9aad82923a29fef19254bc01f26ea108782b51c9eb792e01b5e61f92c10f0ec298", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320981, "uuid": "a57942e9-312e-4ea8-a4ea-8203b4e4a133", "value": "T1CF23E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320981, "uuid": "d681f07f-ee20-4200-b826-4328e13374d8", "value": "768:WqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:9rVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320981, "uuid": "d682c1c9-9697-46f0-9038-3c2fc8154437", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320981, "uuid": "28ce6380-29bd-4c16-ad8c-2fa23a41f0e6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320981, "uuid": "40cfe517-0717-4794-ad18-979f169b9eec", "value": "OMICS_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49b9bd0-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300426, "uuid": "2c4b844d-9999-437d-96b8-230bd1121102", "comment": "Malware payload", "value": "55444085e1f1375bae7e4f843e23ddc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300426, "uuid": "04a48de2-510c-44ff-9e3a-93c64a8c7b82", "comment": "Malware payload", "value": "c723ba3806897779f31bdb4b2101a6bae4294d82cfc8fdb2e289229740fd6dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300426, "uuid": "4186499d-3f8d-468e-8527-7d27459fbab3", "comment": "Malware payload", "value": "f14b93cb8888a346c81a2f5938c9c170ce063a36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300426, "uuid": "d20c078c-92fc-4b98-af26-929dafb8663a", "comment": "Malware payload", "value": "87b4a930521cc8dfb804007ad4d2ebee73a1b338565360f1166f314a93fcc43a9f22691ed042bfe014c30d0c4d3a6300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300426, "uuid": "b4db35b0-be19-4c51-bb7c-07ac946e0d6a", "value": "T1B6263313AEC08CB1D1609C708E48AA61B639BD200F159AE797E46F4DDF616D0BB347E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300426, "uuid": "a6c976ad-4431-4268-a736-9bb6b71049bf", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300426, "uuid": "5652c680-4cd2-4536-ad28-260c76057bf1", "value": "98304:JDEpt1XEwKg/8Txkg2QMovv+TU/AXzv5ZYpGe56so/vc/NrF1o:yptxjcxtTGv5uGSo/vMJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300426, "uuid": "6cdb5fe7-c050-4a26-b59e-0490da0b8d10", "value": 4791120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300426, "uuid": "a9fcfb4d-1fe2-4c2b-a31c-5ea84b0314b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300426, "uuid": "fdd89c99-64e9-411c-ba51-ec39213a1787", "value": "55444085e1f1375bae7e4f843e23ddc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b3bb10-9ae4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646306647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306647, "uuid": "67323681-9b82-45b9-852c-81f3b5c7ae40", "comment": "Malware payload (Mirai)", "value": "5735582cacd3379f262f3d6641a09b32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306647, "uuid": "19fea688-9946-42dc-92d1-046c11808508", "comment": "Malware payload (Mirai)", "value": "c72967a53547e585c134a6e6b5ddb89896fcafb13d169ba5c51e009d1a5cc2b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306647, "uuid": "21fad4e5-aa1e-4aec-b8b5-4dfa323cc862", "comment": "Malware payload (Mirai)", "value": "4cbf1f7daa537c2ad95ba50183fbfe57e87ae7ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306647, "uuid": "e1474327-5010-405b-b127-5b0b4ce170dd", "comment": "Malware payload (Mirai)", "value": "45c9950c4d20d1f38af5a0c135fd2753fcdc7ca90f0f635e5a0a622069c2fc3515e1b4ad49231fe006e14520895c62a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306647, "uuid": "59a05be5-99af-46e6-95f3-5951a15e8d4a", "value": "T16C633B46E687F9F0CD450AB8206BAF75C436A8333130DFEBEBD8B9179D56742605226C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306647, "uuid": "746c5e3e-55dd-47b8-9322-943bb72ac49d", "value": "1536:IeAolofbYYQsBehM1XcB3xESOUd3dgQ48Sbm7mm9:IeyssLcBTN4Xbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646306647, "uuid": "c69ad585-8e90-4a5f-af68-aca2c9c0f75e", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646306647, "uuid": "4b504d7f-b92f-469c-9a1b-a04c9f18817a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306647, "uuid": "59dd910a-9c90-442b-a7b2-718b367434eb", "value": "5735582cacd3379f262f3d6641a09b32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2269fb4a-9abe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646290195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290195, "uuid": "269acb08-5a6a-4288-b7bf-c7bef73ff47c", "comment": "Malware payload (Heodo)", "value": "473731384649670f371496725d4a5c3a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290195, "uuid": "00a35af6-063e-46c5-9b06-a85c0d6396c3", "comment": "Malware payload (Heodo)", "value": "c729f6b947618c14dff15bdb6e38258b18559a7f16a732051a0c64e4b162d2bf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290195, "uuid": "9b0baa38-4c1a-4f14-8e07-e927a91c1e8a", "comment": "Malware payload (Heodo)", "value": "f8f2ce77c4b068c971e3935aa7ba23d56d34af26", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290195, "uuid": "4e0ff6da-2e5b-4cbb-884f-05c15ac35d92", "comment": "Malware payload (Heodo)", "value": "832fe4e9c6628e52be4252b897678f5b7be3fe83bac3d60aa0695e2e86aa33ad660000d467ece80c8d26fcbc6a4438f9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646290195, "uuid": "36f77ead-5c99-4e91-93ca-b207daa9a6c5", "value": "T1D623E116C9346C2EC73E8C75420839A171596511A8CBFB5932947F0D3B86FCB67AE19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646290195, "uuid": "d546a08e-429e-4d03-82fd-b6747061499e", "value": "768:X5WHFKfQzXTmbfRzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+UP6UCIHcX:XwF+OXabfFtT5fTR4Lh1NisFYBc3cr+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646290195, "uuid": "b8f8cb75-e2d0-4aae-abeb-c3ee8c8d7a24", "value": 47898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646290195, "uuid": "9ed8b152-439b-4ff0-a6a8-e8dff23eacab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646290195, "uuid": "1c4dca71-f427-4983-bb7c-1b6e7d29b21e", "value": "Address Update.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e8f6ad-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646298311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298311, "uuid": "ff95ce0d-7bf6-4325-b0b9-9cea12c6bf61", "comment": "Malware payload", "value": "122821e802b14330eb8639c0fb5c2414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298311, "uuid": "6fc959dc-1c9a-483c-acb9-53444f3fa3c9", "comment": "Malware payload", "value": "c7432fde3ecfa55ffdfe03219de886a91f4032a0091eb6a99fdcd442b620eb4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298311, "uuid": "905c9bf5-6168-4f14-85fc-0a9d23691086", "comment": "Malware payload", "value": "053741cc8ed991a5f54a6268d67d5504abcac81b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298311, "uuid": "f082f0bc-9ffe-405f-97e8-ba846fa99498", "comment": "Malware payload", "value": "2fb63ae5e565850c3c8d7d21df1b0e24c0a5756ca99002fe4d4f064c62445cfc1f5a3e54d35a6fb03069dc3909c4df5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298311, "uuid": "d324d648-8d26-4dcd-bff8-d4e9b31690b2", "value": "T11CD4012032D0D032D1F725774424CAB54EBBB87569266A9F6FC52BBE1F242E2DB34349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298311, "uuid": "63be962e-e519-4516-a86c-87a7af2c3bc4", "value": "fdc337a25282d3662375292d95cfcd8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298311, "uuid": "091f7e52-9485-4afb-bf4e-a703454b6515", "value": "12288:CvMNXZr3eVs71CneAxtPcqWboSwXhosIG7/0oswW/DNcvXQVe:CuXZr33BCXtPcqWbxw/Ys4iXQVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298311, "uuid": "a4c8c174-746f-4937-a794-ac3182291765", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298311, "uuid": "68116ed2-652e-4825-a15e-308a91b19e0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298311, "uuid": "3464a72f-373a-4a3c-9d8c-4db371a4a13c", "value": "122821e802b14330eb8639c0fb5c2414.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5096ea4-9adb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646302923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302923, "uuid": "f63ecbc4-ab03-4dc3-8fc9-96f53d9d3a55", "comment": "Malware payload (Heodo)", "value": "389cbeb66b283f57e13027b7e87ced5e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302923, "uuid": "1d8dbddd-74dd-4c1c-8357-d6af476b3d15", "comment": "Malware payload (Heodo)", "value": "c831ec62ca5ed77ebe2a04c4ab3dc2154ffad10a375e1a8f68103270de4f5bd1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302923, "uuid": "9ffb2e6c-d43f-44c4-9f16-03334f1f28b1", "comment": "Malware payload (Heodo)", "value": "c2841e452a8303d8fe6210d6778f136b98a3e794", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302923, "uuid": "30450657-7864-4035-ad1e-1a341384c97a", "comment": "Malware payload (Heodo)", "value": "93a3aaf0dd84b9ad0ed91b60070650327ee0cb3aaf546b4cf6180c9755749aebfd2ece08dccc397a1a300eeeebee5360", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302923, "uuid": "adfb2713-fa35-4d6d-a55c-b167139b6a8d", "value": "T1CF23D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302923, "uuid": "79d3e70f-9946-40f1-9b3e-743c6a90bbe8", "value": "768:6eoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:poPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646302923, "uuid": "8fac76c7-3c84-4242-b5eb-2bd6521b9f34", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646302923, "uuid": "8bf32457-768e-4d97-b510-427e04acf346", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302923, "uuid": "c01298ed-f43f-430e-9170-a6304bb7588f", "value": "TAI55950583014524293555_202203031544.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5210dab-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320989, "uuid": "c00626f9-c9b3-417f-9a16-42045b27c453", "comment": "Malware payload (Heodo)", "value": "25d7552ae0deee3dffd9765021cc8368", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320989, "uuid": "61f0dd0f-2743-46d5-b043-bc551b9d4b7a", "comment": "Malware payload (Heodo)", "value": "c86d39cba7fa591a11c033959d0e64c03e81e595b6d4748e7d2598e53d864c5c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320989, "uuid": "297337af-4807-4f67-bafb-3aa61f841504", "comment": "Malware payload (Heodo)", "value": "a985b78d449f5a495752018b78c4a57e5160c194", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320989, "uuid": "9431b5fb-a4e2-459b-86c6-7db785dd4885", "comment": "Malware payload (Heodo)", "value": "b5bb291cced9aeeb99b22413497ce58f465a7b3632b5ee0a0a412365df708f32f1858db25f02f6047f464cd905838b74", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320989, "uuid": "5a6aeb71-b961-4ab7-aa1b-1b25b5ea9fd4", "value": "T18E23E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320989, "uuid": "d7f6c63d-9fb8-46f2-b7e8-4d2e45b7fdb7", "value": "768:GqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:NrVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320989, "uuid": "6bca7f0e-1aae-4909-866b-6f493036d4e8", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320989, "uuid": "076feacc-d67b-4808-9310-8ed2669afa0e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320989, "uuid": "c94e25a1-d5cc-4c38-a778-fbbb0656526a", "value": "omicsonline.net.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc608b1-9b33-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646340603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340603, "uuid": "5490328a-2c22-4637-8a62-f02a7d6fde08", "comment": "Malware payload (Formbook)", "value": "d3cdb722ffe5f03b5b07cf8fc68d59a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340603, "uuid": "6e79a730-b9e1-49ae-aabf-c4f9dd52e4f8", "comment": "Malware payload (Formbook)", "value": "c8800bb303625014adecb230db7346b8336ea4d5699edb4f19a42c676c0ea468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340603, "uuid": "3740294d-cdd7-4059-b949-895de5af7bd9", "comment": "Malware payload (Formbook)", "value": "f1dd74dfd065a63f6384343cc34ac99bfc7ae979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646340603, "uuid": "c63c1ffc-6e81-4176-b4ee-1bb5d8722225", "comment": "Malware payload (Formbook)", "value": "c975c40d339fe660c594c6392e362f6d820c9f71688087ccc41dfb63dd5f526e63c3940657f8596ef5222b6e210e08bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340603, "uuid": "ee32b18c-c431-4947-9e6f-14211173dcfb", "value": "T1DB542317E5C482B7CEA601345ABBDEBCDBF9C94842761DA70B962FF52A33093411CA53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340603, "uuid": "8dee247f-d3dd-4a1e-afc0-349ba95ad3c8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340603, "uuid": "c3a8067d-59a9-4279-9a87-b6940b3651af", "value": "6144:rGilLQjzOuJVSZI+NaqHwH2y3RNsunR7CYTZyE8YTmqlQysIzggg:NQ+YGIhW0PR7ns+ZLfaxPJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646340603, "uuid": "0b7e9200-741f-46fc-b399-d2248a9e121f", "value": 305103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646340603, "uuid": "c7374093-a4a5-46d8-a869-41bcda417709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646340603, "uuid": "13d0b40a-0516-4d2d-814a-43b2b7afc8f9", "value": "too90957664.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47965e87-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298847, "uuid": "d9f39425-29a9-4fcb-a6eb-5c3da4f4aed9", "comment": "Malware payload (Heodo)", "value": "48730134167aa47107aa8e7b6e1cb9ba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298847, "uuid": "3138d3ee-2eef-4e51-bfd4-772cde8d1d11", "comment": "Malware payload (Heodo)", "value": "c965eeaad58d6c017871ed1776945c7394283d02227924cb4fae2c8106234a95", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298847, "uuid": "54f958b8-abef-4105-b8be-c9e113c905bc", "comment": "Malware payload (Heodo)", "value": "341c60242727a2a6ee741dec82e8c0fa6c7e9e01", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298847, "uuid": "da0c3a3d-0925-48ef-a9ca-4c6f6e433933", "comment": "Malware payload (Heodo)", "value": "24f43fbcb615d60c71c7f305cb3f6d623066620e96572ad59557b4d8ffaaa133d1850120dc778c3ce2b946fed5cb70d0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298847, "uuid": "0817a4f8-0bc7-4bdc-a3ff-e07fc755768d", "value": "T19523D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298847, "uuid": "b3dbc34f-af12-431e-9d2b-e26c21084d05", "value": "768:aeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:JoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298847, "uuid": "0e48497e-d152-438c-b4b4-23d5b283dc4e", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298847, "uuid": "1b18d10a-dc75-4ce9-899a-90ae55ae6544", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298847, "uuid": "04441a96-3507-4c7a-9f48-5052a4620bf2", "value": "Details to update.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fe7507-9b47-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349121, "uuid": "4a4074a3-9650-4b4c-8843-5c191e1ede80", "comment": "Malware payload (Heodo)", "value": "82ab9aa1d990aabee36650fad7165d70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349121, "uuid": "78c39dbe-e79b-4d69-9f66-63932e765e64", "comment": "Malware payload (Heodo)", "value": "c98b33b202cc396abee9a23306bbc8d59c0c559086988fd508e0393b39ba4ab6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349121, "uuid": "b8edd5d4-6e33-4e04-89dd-d9cd3a3511e8", "comment": "Malware payload (Heodo)", "value": "2303303e3536ff39c62015c0274a21edc9e983dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349121, "uuid": "a7090add-0cde-4ca5-98c9-53cf312c64bd", "comment": "Malware payload (Heodo)", "value": "82cefdb121618d507c682d5f858d8c790d0970252fea8632b3094eb0418ebf9cc353c19e6ad2ce7da98d9ca1874313b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349121, "uuid": "6cccdaf8-d6a2-4520-80db-1744b9402fa7", "value": "T1FFD45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349121, "uuid": "38b35bcd-a227-4b3e-9131-1e03bd578149", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349121, "uuid": "31b4674d-f11e-4482-a5a7-4ac9ee6afd5d", "value": "12288:J1U8sNY8/z0rYebzwdOCoGEAbcVBLku8w:oq6z0rYcMdOVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349121, "uuid": "98eec67a-020d-4cff-9dda-c631cc0cdd33", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349121, "uuid": "bd185045-e443-4eac-bd92-ea8ae43443e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349121, "uuid": "b707c4c5-bdf0-4779-b9dd-23a43bed06c4", "value": "82ab9aa1d990aabee36650fad7165d70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25b4494-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646300368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300368, "uuid": "00aa0da9-df4a-4a5d-96ca-fc8b444372b6", "comment": "Malware payload", "value": "54de06bfc685c29b0135e886b2e7afb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300368, "uuid": "1c191c34-3315-40b7-9b56-e40e091068dd", "comment": "Malware payload", "value": "c9c31aa5e33282e7e4ca9360c0b249d2b86b667597050f6471854441d9b20c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300368, "uuid": "00cee875-4883-491b-8de7-6acf6ac3e9ba", "comment": "Malware payload", "value": "0294c1b6787bce5f859574cb487bcabd34e0c8b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300368, "uuid": "cc3aeb97-8e23-47ab-837b-c4c83c7fda31", "comment": "Malware payload", "value": "d0d503d422a315b64992e7d31f1759bc40d1f4b3fad0872d4fce5bf9a9c3fbea16ff2cb085b17f00441eac6121df6300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300368, "uuid": "c4124bc2-c6d8-4bf5-ac32-5b928eb68dc3", "value": "T11C26336F2298272FDC1AC079E799A7004BC2DC5AE4F5D77B27A086532E301F51A8D8DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300368, "uuid": "82a3cbe2-5244-43f0-9ae3-37e78c979a65", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300368, "uuid": "4905384e-c043-477b-ae97-f0e6f87d7138", "value": "98304:tOGIdBR4L0tTakbCGjvuEB9LfTRQ/nTVGcp0ZSu9eMDLbU62Kh1VMs6:tOgqTakmGTnLbRuZp0dRDfAKhM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300368, "uuid": "21985465-0a5f-43f0-9903-52c087d1fe86", "value": 4529152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300368, "uuid": "2194c917-a077-40a3-8856-a2b609734c03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300368, "uuid": "6dc2babc-f9dd-446f-a246-3c81d21bd0f7", "value": "54de06bfc685c29b0135e886b2e7afb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22154638-9af4-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646313387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313387, "uuid": "43373e87-812a-498b-92e4-7e9576afe9f1", "comment": "Malware payload (njrat)", "value": "09f5e3fc4a15fbf25724fc2f95394166", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313387, "uuid": "b40f0ac2-65e9-430c-ac8f-7e33a6075525", "comment": "Malware payload (njrat)", "value": "cb15585aac621fef5710d7c2b6cc714d7d3283576717cd7738a0898d5b63a470", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313387, "uuid": "cdb0b0e1-935f-44d2-85bc-377acc655dcf", "comment": "Malware payload (njrat)", "value": "99d985c1562944169823da75a5b8246e83cf7232", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313387, "uuid": "2b993839-9cd4-4a63-93fe-05085039f54e", "comment": "Malware payload (njrat)", "value": "454fb4500d7996c22171af6fd1635645ae1a20e06759a1ec46c08b920784966905e2432129c13b110d1598a4ae68c189", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313387, "uuid": "c36b0e13-f5e3-4c56-a79b-ae3750f0794a", "value": "T177363388B6FF063DFA8A707C841545A437C14BB335E6127A8D3C619EB5C929D6EB7230", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313387, "uuid": "c50fd052-0ea4-407f-aa70-c6e880eb50c9", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313387, "uuid": "4b6dc362-5b69-4c8e-a5cb-7f0e9c1f1013", "value": "98304:ul0Voa2E41ASpFmcjP/R92nqC65Lt9ZdPRPk:80eahobR9H5LHVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646313387, "uuid": "c833a129-1b06-45cf-b4d1-cfcfa624326e", "value": 5178368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646313387, "uuid": "41c76101-5217-44ec-97d6-385edc5dbac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313387, "uuid": "449f4ae2-6f33-4918-99f2-5a5d8dd6ce77", "value": "09f5e3fc4a15fbf25724fc2f95394166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823f6c2f-9b28-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646335882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "73e1daa8-52e6-4715-9bf3-c91bb5b713e6", "comment": "Malware payload (Heodo)", "value": "8d9ca5f0b44c5c8181de1bb6aeadf2f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "96191c42-8ea8-4437-9e51-90696d234b89", "comment": "Malware payload (Heodo)", "value": "cb72139467dc843ec51bfd01f79d5cece7a9774a5c28c79c87948c404faf7f51", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "dba1c0b7-46e3-4967-bde7-6fd9d7753891", "comment": "Malware payload (Heodo)", "value": "16325e52cf5844b75ac5c918fcf8a14970c7a0dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335882, "uuid": "3cb858e2-4919-455c-b402-60b9ba54a41e", "comment": "Malware payload (Heodo)", "value": "7a83c369aa9be5a7accd6510e84a7919a2f32bfe6acc4022a3d5d96b35ec0b5c664d434915ffba82f10203edcd34e3d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "8f5b120a-94f4-45ed-8d78-e7083ba3b308", "value": "T1F7D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "c4cb0ae9-5918-4e0d-9cff-07f784393214", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "3e98528f-4c41-4a16-9ff8-a2e2d0445349", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRL5CjzhmD/bwb1r8Hc:Bg4IqjYT520D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646335882, "uuid": "7e3fe8c8-109d-4cca-9d51-6c3c841f76ca", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646335882, "uuid": "7a417d10-afc0-4a23-8796-2e4426e895af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335882, "uuid": "e6ebf1e8-e22f-4922-9650-1d4b2cfde316", "value": "emotet_exe_e4_cb72139467dc843ec51bfd01f79d5cece7a9774a5c28c79c87948c404faf7f51_2022-03-03__193116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1522ffe5-9b03-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646319808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319808, "uuid": "d64aed74-288e-4272-910b-6df510410f7b", "comment": "Malware payload (AgentTesla)", "value": "565fc650ef3147305d4605724c22bfd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319808, "uuid": "67263b8d-6b69-4c59-97ae-649ba0b19180", "comment": "Malware payload (AgentTesla)", "value": "cc81fe490219fe3733c1027531cf9cf5b57fcfe6c40508dae0b336413d0d3a5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319808, "uuid": "a3571990-6c2f-4a46-947d-be35e79e9d10", "comment": "Malware payload (AgentTesla)", "value": "eac0f79b206fd94aa62e6bbe984b5e3b96a16a6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319808, "uuid": "0e8954c2-fbb8-4f5c-95bf-cb432252a3b6", "comment": "Malware payload (AgentTesla)", "value": "f3c4d412740ed23bc386b179deb95894d66ae303a64d94fb75fa7433fba76b0e2a031321791aec24f46a26fc1b9078ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319808, "uuid": "8ad0595c-8d54-4a44-8065-f665aca41fa0", "value": "T149B30F50E94DACD9E7E8C1B3B93A9B100575BBDB92F8819F2265371452B37C320B7D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319808, "uuid": "aeda03e4-7d06-4834-af2d-8315c46191c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319808, "uuid": "8140b513-686d-45e2-bc6d-1e018277b812", "value": "3072:wbhbry8o05lhUqrAMgTPA1p8Dja+auDOLQyDl9hFjO4rW6ZQY7j1lQ7wXVA0+biF:wbh2CvK4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646319808, "uuid": "f6412d58-f28c-4fcb-ae7d-92383ee01004", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646319808, "uuid": "0623b078-bcd2-41e3-a836-53170ec38cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319808, "uuid": "ed93fbd3-7cb3-47f4-b9ce-835663da2179", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d666a8cc-9ae6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646307677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307677, "uuid": "ced6a59e-5595-4bee-9332-7527a6cb2220", "comment": "Malware payload (RedLineStealer)", "value": "f8fac3087e1e0b95dc2033c77dce2c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307677, "uuid": "aba766db-93ca-4034-b397-33b695091435", "comment": "Malware payload (RedLineStealer)", "value": "ccb12cff0a511ecc0d76e5d77b1a1243f89a524248c700e8b347ddb818e7aa23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307677, "uuid": "3b18a3ec-fa06-413a-af55-d0ebd7ab8b2e", "comment": "Malware payload (RedLineStealer)", "value": "a00a10fdb3c1ccb9e3861b19a89dad88afda7da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307677, "uuid": "93c38707-ee49-4202-a4e8-98cb42b00be8", "comment": "Malware payload (RedLineStealer)", "value": "86a7ef2a9c0c72ba5186a39993b2c6befff9a2da6bc13b35bde204a459d741fadc13bfd079fb3793a218d5c0e6e66c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307677, "uuid": "3d7eb0d1-52e1-49a5-aeca-cf8a1b57e6bb", "value": "T1932633AC3B493CE9D3ED86B58994C44C480462948BF0587B59FF76A917D183B3A24CEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307677, "uuid": "d6af490b-aa2b-4a43-be8e-94357f417d1e", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307677, "uuid": "70d1c0e5-b6d5-4b24-9e71-bc93c819f260", "value": "98304:uWZgOPfM1fF2eD98qGET+Rzh4/GhHvR2Cw+rz02c4aqlInoVUm9cYcwQDH:XgOPgf9DeqELLvUCw442JBlInI9zcrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646307677, "uuid": "aa907090-8dde-407c-a46a-c49c2585e9a4", "value": 4862104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646307677, "uuid": "6bc0fe9a-1d57-4956-9404-962720319f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307677, "uuid": "69c7d91e-8989-4fb6-acfc-dfe8779bff0f", "value": "f8fac3087e1e0b95dc2033c77dce2c46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc42b15b-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320974, "uuid": "4bffebac-6e9e-4ce7-b1bc-744bdf27e810", "comment": "Malware payload (Heodo)", "value": "efe08b49768fc391c68c080dfe35fed7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320974, "uuid": "a22599e9-1d54-437a-9ea9-25fec0e54633", "comment": "Malware payload (Heodo)", "value": "ccbccba50baee38d21e2193c276237de829eeb5668c31e3f21c998444a2b3266", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320974, "uuid": "77dc3624-5737-4cfc-9eb1-7bec7e67a033", "comment": "Malware payload (Heodo)", "value": "118108dccb6578eff9e4e2affec9dc33d1de2f56", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320974, "uuid": "cf5bc9c5-3deb-4f82-b35d-7aacb405cfdf", "comment": "Malware payload (Heodo)", "value": "51d54d26f3f8eb284ed06c9637e630e4d8f56ae01e26a24784d39ed83f2e0233ebcfba9f76b50d5b941ca122dcec1bd5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320974, "uuid": "682826c8-dd27-43f6-acb9-4bcb87cad7ed", "value": "T12F23E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320974, "uuid": "c07d7892-2dc3-42f9-ac2f-5d151ab29612", "value": "768:GqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:NrVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320974, "uuid": "7d00d88c-ad5d-4815-8bd4-ff8f67fa1d8f", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320974, "uuid": "b593815a-5313-4ce8-b09b-cdeefdc030ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320974, "uuid": "d1c236cf-8522-4d86-ae63-f99c1230e700", "value": "Insight Medical Publishing_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7224092-9b38-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646342950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342950, "uuid": "084f2369-af12-41c2-9f6a-88e13b425996", "comment": "Malware payload (Heodo)", "value": "5f2272c8fdb21be91e6a0766b5023c49", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342950, "uuid": "6acfcad2-a00d-477c-94aa-27e2e22f0592", "comment": "Malware payload (Heodo)", "value": "cd167f13c341daa80c45ec850289d5385e3d928098334a3e042b2173cc13bc9b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342950, "uuid": "80ef8d4d-8b4c-4ce3-a016-7ec679975a59", "comment": "Malware payload (Heodo)", "value": "5c2a24b9410841394ef83a29399908f15fdd80fe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646342950, "uuid": "5466e270-2c58-4774-aa86-abe16623cc60", "comment": "Malware payload (Heodo)", "value": "d018ba60a500e672cd4fa903f01fd851c7d4b07cb203ee21e3c777da92ec388cfffb3db1c2f015537a12c30d37e2000f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342950, "uuid": "1d98fdf7-28e0-4481-a761-b50dc8aed3f4", "value": "T110D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342950, "uuid": "f7c2e808-8000-4c36-9d5c-9b1929a89910", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342950, "uuid": "982e34b2-31a2-4eb5-b834-d0473e98fc42", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLKCjzhmD/bwb1r8Hc:Bg4IqjYTK20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646342950, "uuid": "f9374cbd-e46f-43ff-9cb8-d98e442e441e", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646342950, "uuid": "b7496cf1-b05b-496a-ae49-3e03c830325d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646342950, "uuid": "774658ae-94a3-4c5e-b5ab-802f8ba2f964", "value": "dan.ocx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ae1445-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646300208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300208, "uuid": "f31c6cfc-0ea9-42a9-9285-642a668c3fe9", "comment": "Malware payload (Heodo)", "value": "aeccc4fd7b3f3414bc920f96243a2b4b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300208, "uuid": "76797c50-3904-4cb0-a50f-8996abd2effa", "comment": "Malware payload (Heodo)", "value": "cd1d25d156a6f0e4557421edba5212f6daaf0bc4d3c527fc1bace153aa240c14", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300208, "uuid": "09d60dee-124a-4453-957c-582ceff5a019", "comment": "Malware payload (Heodo)", "value": "3ec6a26540afa2ae5ebf55ccabf58a55b1dde88d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300208, "uuid": "6e8a1ec7-8b44-4316-828c-e5a8ff4de682", "comment": "Malware payload (Heodo)", "value": "a4b67c5132dfab261bac474713fb98350bbbb3f50459cad460d84f1765b1ef42f70886f150784879cdba65e5ff1d8b85", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300208, "uuid": "9ba7b998-40c8-4063-a583-85b8c1f841a6", "value": "T12225AE223AD5C07BE2AF16760506E76E62F5FD304B2586C36FD11BAE6E345C29739302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300208, "uuid": "8fa2ac8b-a53f-4a11-94dd-ff6f8f6d5757", "value": "c43d7d6aae03def404d4e73d7d3f62eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300208, "uuid": "7d43550d-1a09-491c-a31c-bed1a77288c7", "value": "12288:+LDlVD0Fj+g1dEJgcIzQHBKeWZlQN5tFjNRLU:Ci6fgcIcHB8ZebLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300208, "uuid": "e4dd7f47-74e2-4e0a-a1f5-1e29aa461228", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300208, "uuid": "b0f67dd8-17ad-484f-9a7f-6069f2be93eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300208, "uuid": "6d966281-ab7c-4b1f-bfa9-aa805b24cc13", "value": "emotet_exe_e5_cd1d25d156a6f0e4557421edba5212f6daaf0bc4d3c527fc1bace153aa240c14_2022-03-03__093642.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd76052-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298163, "uuid": "c46a18ca-ea8a-401d-b17e-c5d729476eef", "comment": "Malware payload (RedLineStealer)", "value": "06460c3c3512dd77b3eaf3350b63e8d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298163, "uuid": "cce7247b-0062-400d-a191-25a10c3f804e", "comment": "Malware payload (RedLineStealer)", "value": "cd2475a36c231403d7d3e778342c67b250c625901fd7122e5a0fa90306c649ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298163, "uuid": "19427cca-4402-4410-8c22-8c394015f860", "comment": "Malware payload (RedLineStealer)", "value": "e0dddab3c8e2f8f18649f0898bd8897123543a64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298163, "uuid": "e0fe8498-6dbc-4906-ae76-f55aab839240", "comment": "Malware payload (RedLineStealer)", "value": "8710ae045cc99a3068a21b5273b2f0534789174671f6959a06393ae1a230ad46d60374c78a5d58a09aecbefe87896561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298163, "uuid": "42f5adad-6bd7-4bf1-a443-bbc59a9d0544", "value": "T1A43633C020057ADAF19D0F39B0849E610DB56AF6EBD6DE3636FAC706587103B6F501AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298163, "uuid": "eeebee0a-39ce-46da-b535-1a5a7f63af3c", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298163, "uuid": "838cd7c5-8547-4e81-96f9-fe09a200cb46", "value": "98304:6JBSUeUmfncRy9kh2+lupGNsv4bqEzGJUSHC+hNE/6qHzBhzZ:+SRncOFvyGDrJqHzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298163, "uuid": "827a0937-50a3-4938-b71d-ceab1046b036", "value": 4867072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298163, "uuid": "a73f27c6-d14c-45d4-8cac-bf383e22a1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298163, "uuid": "f54a5f07-6f18-43e4-a379-650e5c209efe", "value": "06460c3c3512dd77b3eaf3350b63e8d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ce1022-9b21-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646332915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332915, "uuid": "6c62386c-f46f-43cc-89c7-e2aaf50cbd22", "comment": "Malware payload (njrat)", "value": "1d8297b602b73f0435f4be754b5aaa6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332915, "uuid": "4a52b53a-4ffe-4ffa-9704-369d4941573d", "comment": "Malware payload (njrat)", "value": "cd25971aaf51ac81e64ee64cbeb77cbb0ec1a2ec8bb851f2df2437f665d4902d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332915, "uuid": "a14bf6b9-afb0-4a83-bcd9-1e6485a2bd3c", "comment": "Malware payload (njrat)", "value": "ec8aac5bacc1810c64acc92a2c8899c3cb09fd2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646332915, "uuid": "0a51f227-f19e-42a1-8df6-97d7a5b5708f", "comment": "Malware payload (njrat)", "value": "b48ffc8540b65cf731d238e107804024fa2f275fa077925cbc49cd5f5787f22ed2c374f445f14117206af6ec5fc6ad50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332915, "uuid": "4cb5ab6b-04eb-48f7-b64b-e2f19d7039a0", "value": "T16DB60250965365B4E87FEB7B21BF9823957EB3730F02613132B0454EB12CDADB26A631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332915, "uuid": "f52b6d03-f41b-49cf-b132-0801a08bfc25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332915, "uuid": "80a76c6e-2ce7-4a26-8554-12c26ab350ad", "value": "196608:DZzUPMIH8zUPMIHE8tGj8tGj8tGj8tGczUPMIH8zUPMIHO:DZQPxcQPxkdjdjdjdcQPxcQPxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646332915, "uuid": "5aca4f1e-73af-443e-beb3-a80fca4fffc2", "value": 11137056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646332915, "uuid": "3f3d7530-6043-4726-b778-20991bf9d57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646332915, "uuid": "d7bc8d67-d26a-43fc-a4ab-03a54bc8516f", "value": "1d8297b602b73f0435f4be754b5aaa6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e32ef6a-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298858, "uuid": "d1454e7b-be4f-47a6-9a81-daa5d2b29ae3", "comment": "Malware payload (Heodo)", "value": "5e92e74bdb829a268c99c34fe9a62f14", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298858, "uuid": "ef721807-648f-406c-b8b5-7998bd1a576c", "comment": "Malware payload (Heodo)", "value": "cd263a5cc78d6ec9b785676bcaa506abfd80e5a5c60453dcb4c5aaebbfb38187", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298858, "uuid": "9ff5bf54-3f09-470c-8330-68c11afd5fec", "comment": "Malware payload (Heodo)", "value": "dbab098979d8f4d55dd8e0d2ed15b9f023339098", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298858, "uuid": "d45f6430-8323-4c5a-9211-4ded5edc0bdc", "comment": "Malware payload (Heodo)", "value": "4f703b53fd3fdbd301a47e997c4487c1dd33132df203f4622901c9987ff53febe5bdae17914eae400782237da28a1e59", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298858, "uuid": "f8a7144b-febd-4eb8-b448-f7952042f56f", "value": "T1F723D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298858, "uuid": "454b596a-10b6-4326-a3f5-6ad5e5ad0263", "value": "768:KeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:ZoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298858, "uuid": "0b0f183d-92d7-46b8-afbb-57a4d4fb99b0", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298858, "uuid": "5fde17b6-8d14-462a-938d-e4f15b97338f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298858, "uuid": "f2d9cb50-e962-4a08-b1fd-3655d5290bb6", "value": "omicsonline.net.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761f1c49-9aef-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646311381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646311381, "uuid": "5579c9a0-f9fc-4554-b5b6-61ddb3777aed", "comment": "Malware payload (Heodo)", "value": "6b58699e0401b14504a4f9b0a61ddb09", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646311381, "uuid": "783d6b82-a57e-4f0e-a5f2-7cba24ca8019", "comment": "Malware payload (Heodo)", "value": "cd321f29a4327b87abc637f56b9fa204340d2c6e884140f25d66bd139d7d5a3e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646311381, "uuid": "2d3e447f-4060-49cb-a3af-f8573e2b1580", "comment": "Malware payload (Heodo)", "value": "f74dec9f43cb7ac6f20d31d3e8205ced1dace527", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646311381, "uuid": "92518cee-c084-48df-9042-98b02185d168", "comment": "Malware payload (Heodo)", "value": "bce7e20a97ae2adf5c903f6a3d0e09a510b536ce6dd74279c515abb983752252ba991b85e825e130b4db3383017b3480", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646311381, "uuid": "bd58f60b-de15-46ae-bb0b-6b1169896214", "value": "T15923E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646311381, "uuid": "68cecce6-e960-4aeb-b44c-87e02a207a06", "value": "768:u/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:u/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646311381, "uuid": "2e2dfad1-1186-4d3c-a207-d18bba9bede2", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646311381, "uuid": "7679d925-1beb-4d6d-a72f-524a93f868fd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646311381, "uuid": "5919af73-e35d-43bd-b6f1-80cb2e4ce5ae", "value": "Scan 2022.03.03_1340.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a0a75f-9ad4-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646299998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299998, "uuid": "7f949e54-59e0-4b1c-a958-6d48a09c18e5", "comment": "Malware payload (AsyncRAT)", "value": "5d1006c054e0534962e4af4ae7ccb9d2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299998, "uuid": "3ae49e4b-4fa3-404a-916c-4f12bb65ce11", "comment": "Malware payload (AsyncRAT)", "value": "cd5954bb5bc633d251e8b70d7f789e34569379f299fbf0ae688720e9edfd1136", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299998, "uuid": "c495c2c8-1c1d-4895-a1e6-19a5252622b1", "comment": "Malware payload (AsyncRAT)", "value": "c3a71d35702845fbf6e2418e05bf1d724528cd5b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646299998, "uuid": "3dbaefe9-e9d6-4f07-934d-cc855563c1e4", "comment": "Malware payload (AsyncRAT)", "value": "e4d7aff450cedc342c1901c70ac5121a32c2d677afdf95534513bd705e3393bcb6d8d0232f7c3c8fb4a3e200f2318881", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299998, "uuid": "27e047d0-280b-4313-8745-f3b560e4426e", "value": "T1C9232B003BEC812BF2BE4F78A9F26245467AF2673602D94D1CC451DB5613FC696426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299998, "uuid": "fe15bf8b-3853-4ddc-9ae2-9c6c52ab88d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299998, "uuid": "e7f63d24-21b4-484e-8a24-b8d70a7cca98", "value": "768:EuOcvTbAKeIWUu++Ymo2q8zUns84bs6JPIZzjbbgX3Z4yAA1/BDZex:EuOcvTbRb2zSqs6mZ3bkXJ4yAATdex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646299998, "uuid": "17a092bf-2a23-4abf-9f29-cba720477369", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646299998, "uuid": "e754e83e-355f-4bab-843c-505aadea88fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646299998, "uuid": "b13a3032-2c78-4526-b910-8c0d456d94b5", "value": "5d1006c054e0534962e4af4ae7ccb9d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62fe2ae-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320964, "uuid": "30523cce-e5ba-46b0-abba-94082704c4b6", "comment": "Malware payload (Heodo)", "value": "e937db18842f7aa4fafcfb03b858ad10", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320964, "uuid": "7406e2a9-47e2-4def-bf01-4f009c46624c", "comment": "Malware payload (Heodo)", "value": "cdf7d3316ab64ff81cc5238a3faf0c4600d2b4afc8ab5b117b491a48c5a3696c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320964, "uuid": "e60c4346-d176-456f-b15b-79fbadb18af7", "comment": "Malware payload (Heodo)", "value": "2a0567f06a9273d36238f5158c3460190d5b333d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320964, "uuid": "d8a16ae7-4a26-4452-997c-7743e8fa6103", "comment": "Malware payload (Heodo)", "value": "42587a7cc71302e1ff70141025d1b1c6bf311a6abd990ab86abf2b27d5f4f91f843f865db555be5f6f7ee1ae14704880", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320964, "uuid": "e96a5f31-7601-4731-81aa-7b6ba31186d2", "value": "T15D13D02DC0A61E99C727283DD6149AF4124C1D4A86E0FA9F1D5463DC3B6A2FB074FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320964, "uuid": "d8592d1c-58f7-4505-b3ad-4838d9d8d271", "value": "768:q8uomihd8DOevZCwtl5yKfcrND59V+L9Rw4eWrXcTqZ0VfvfSa:q8uom8eDDylND59V4jwmXc2CVfvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320964, "uuid": "7ec405d8-c3e8-46ef-ba80-3804dfceb831", "value": 41798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320964, "uuid": "6ba3edd1-061a-4fc5-8a5f-b2dd0ca2ed25", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320964, "uuid": "78650e21-3a8b-433b-8a07-be954e1cf9a0", "value": "documento-0303.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72695ece-9a8d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646269284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269284, "uuid": "ba073bba-72a5-403b-a701-359dc542b075", "comment": "Malware payload", "value": "062099a3de0c8144e5f0b7b4a97d7947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269284, "uuid": "ddd97431-5e9d-4a1e-9ce9-c29643eed492", "comment": "Malware payload", "value": "ce3ecb8c2b1d7a3c347e0fe73a70caab42f0b6ca9f764c2de448367ff9c730e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269284, "uuid": "3bddee67-553c-4e54-b868-1ef22c0281f1", "comment": "Malware payload", "value": "21bde16318ff34e20dfcf167ec5f67d555f93999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646269284, "uuid": "85e2530a-b6a9-4d6b-b577-e39075f76400", "comment": "Malware payload", "value": "1d1e08c322a55b9d2de06a3a05413ac02cddc964bc4963354dcdde50793f870af80c9d280942f3b154f5b728bd901f64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269284, "uuid": "c3fdd236-0a96-4467-968d-69cc63ccef5e", "value": "T122B5271DFE904C75D56205309865D32D6634BD259A239E1B3388BEDEFFF1F806A26232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269284, "uuid": "b712e0d3-7ef0-4685-a60f-2f2d92be2350", "value": "72ca07d97c0d9eb43e9d276b49e5da13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269284, "uuid": "afa70a09-5a66-43e1-87ec-8f47cd48e07d", "value": "24576:3z1ay0rUlzPmx9FIifqFuSeFz1ay0rUlzPmx9FIifqFucrc+lPY86BXx/WnSyhbC:DKOmx9tqFSKOmx9tqFlMBJWSytLoqUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646269284, "uuid": "7ab5ecdf-33c0-4804-9be7-936274742174", "value": 2427680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646269284, "uuid": "a92197b5-efea-4683-9d23-33d5ea64ad20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646269284, "uuid": "c6da3440-7e8d-4336-912e-0c0738bf4ffb", "value": "OLicenseHeartbeat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e4dd29-9a88-11ec-9275-42010a9c0029", "comment": "Malware payload (StealBit)", "timestamp": 1646267276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267276, "uuid": "63fb1c33-4bd2-40da-b53f-f0cf1a5c10c0", "comment": "Malware payload (StealBit)", "value": "8a619a201ffaea64b14d75963b626149", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealbit", "colour": "#B97D3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267276, "uuid": "d23d197c-39a4-4a0c-8958-bbd3361e3305", "comment": "Malware payload (StealBit)", "value": "ce6b07c00894fd72d7733f12b42b82bb58691f83458cc0a4f1414328df8c1c79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealbit", "colour": "#B97D3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267276, "uuid": "713d85e7-ac2a-4601-bffd-8510ed682dc7", "comment": "Malware payload (StealBit)", "value": "9628d0d594437e18b4778964403375007a954b27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealbit", "colour": "#B97D3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646267276, "uuid": "4f4c861a-fb88-4e1f-90ed-8faa3e174d5c", "comment": "Malware payload (StealBit)", "value": "eae5b4fbcd1f9b0eeff7ebeab22f7f4f3885ef3eb4b7a5a54854563a6d21b4b0fa01114e8ac001403123388035e38fc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealbit", "colour": "#B97D3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267276, "uuid": "b410a34a-553c-4b71-bcbe-091bd52f0c6f", "value": "T113236C433CB280B6C450627018BE5B37AFB95926E3E809E76744C920C6B19D9F97D7CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267276, "uuid": "d88b6d11-0434-4c40-898d-fe9c51df9eb1", "value": "768:AEPQI759hrPDKd0OHTiPHIm8oN2mfv+w+3Smfpp7Ker35y1:GI7LdPDKdXiPotKvfmw+3TfXzr3Y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646267276, "uuid": "3e324559-add5-4389-9f83-9170f25a1620", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646267276, "uuid": "2cfe7b6f-bfca-465b-9820-629cd4dda83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646267276, "uuid": "173f1868-a17b-4429-b82b-ce95a41962d9", "value": "rundll32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033fb0ca-9ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298303, "uuid": "5429f59c-981a-4321-8d1f-9d1a10d2075c", "comment": "Malware payload (RedLineStealer)", "value": "0d19ec089e14c9b5301c2528157be776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298303, "uuid": "c76bf5fd-2d9f-4659-b22c-507e2dd59f39", "comment": "Malware payload (RedLineStealer)", "value": "d048fe8895c8e37eccb029edee49bc476694b63b325ae5931e57059430572e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298303, "uuid": "84b90927-5c90-4abf-8c02-f51c6a4ef977", "comment": "Malware payload (RedLineStealer)", "value": "b0d7c07f220a0d0e9c58b2d7b06f16f67e551e5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298303, "uuid": "e0e10108-9123-4897-b9cb-19efc74db6ed", "comment": "Malware payload (RedLineStealer)", "value": "2809f3d87e87610a758c11782c474978e923d40567a111a3d32f6312db14657774701df8f89537e575debc1d4dda3dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298303, "uuid": "dd37c829-2cb6-4c76-afcf-120086fd8937", "value": "T108D4F11172C4C032D5F32A720434C7B54EBBBC6666266A8F6FC41BBE5F156E2DB2034A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298303, "uuid": "0a9444ff-35b5-48c3-91f7-bfcacba8ba74", "value": "fdc337a25282d3662375292d95cfcd8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298303, "uuid": "6a401a54-7798-4498-895e-340ecc6f2b96", "value": "12288:YvMNXZr3U975FvjW8MmbuRNFVsr6bnU8gzcUvLz4EwBSD6xuD8xVrDa8A0J4Feem:YuXZr3g7ImbqMkn95Ujz1D6oD8n3ajzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298303, "uuid": "0124fab3-62b9-47ea-b15c-ddecbd46faea", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298303, "uuid": "f6f243c5-382a-4b26-8228-111fd151bed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298303, "uuid": "0ae138b7-62dc-4bc1-ad78-aa8d71b5ca84", "value": "0d19ec089e14c9b5301c2528157be776.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3823dd-9a86-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646266480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266480, "uuid": "94012759-8e77-463c-b721-5dabdbae3912", "comment": "Malware payload (Heodo)", "value": "1db8832904b7ca0b01049ad883dd39a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266480, "uuid": "8143a0eb-94cd-4a98-b97f-dd3877c76573", "comment": "Malware payload (Heodo)", "value": "d0820986950252c84c1f9b7b65fbe0b89441c6807b3c635882e51aedbc449ef1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266480, "uuid": "18cd5d53-63fe-4a39-8678-20197ffdbadb", "comment": "Malware payload (Heodo)", "value": "2c283d5c5f4cd40920e11dce2da88258052d2557", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646266480, "uuid": "0eb43c73-8c50-40ef-99a6-46cc4bde3fad", "comment": "Malware payload (Heodo)", "value": "af6f09f97dcc5e5f863c6a7dbb08f87736af6e56c95494bf09922c52358cb8b4f1baf5788ba6f9b5dfde738f11644c24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266480, "uuid": "ac22b5c5-f1bc-41d5-8f90-1ca8485aa80d", "value": "T1F8D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266480, "uuid": "a0245a34-3e1d-4054-af6c-4e41ad000eda", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266480, "uuid": "afc37672-ca07-4d22-a4f6-64eb716d4562", "value": "12288:ZxpNJJJ2NHPoczJ3OtIhxf3foRXIa5EPwvA:Zx2gczJ3Ff3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646266480, "uuid": "2bcba39e-96c8-4313-bf6d-fb7720c6f375", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646266480, "uuid": "60e3c42e-d6ee-4956-a595-7a46f1ef8a0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646266480, "uuid": "df62271f-2fa4-4b53-a187-3e8025cdfe31", "value": "1db8832904b7ca0b01049ad883dd39a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00586311-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298728, "uuid": "1a89a68f-bcd3-4781-b5e2-c618ae13f63b", "comment": "Malware payload (Heodo)", "value": "dab7495d9b24c6b657a5223c4152d1d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298728, "uuid": "269c2a39-fd53-4c54-ab1a-b154edf1cb48", "comment": "Malware payload (Heodo)", "value": "d0ead18beee30fbb19452f1145b25eaf3ae94cdb49bc6919fc223a723d9c529f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298728, "uuid": "c25f5566-97f5-4647-88d4-0c3120a3bfa4", "comment": "Malware payload (Heodo)", "value": "08bcb21ceff98df0771ddf368c970f61a31226bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298728, "uuid": "1e27c41f-58d2-436e-bc51-cf6922962127", "comment": "Malware payload (Heodo)", "value": "bed8149cd41a8a473466d6f6dbf60b415e4cf255e868171d56148c329321575873595309e439e137d46766a6b2d2fefc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298728, "uuid": "0ef8678d-7d64-450d-80bb-b79eb0b19858", "value": "T1E5353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298728, "uuid": "179bbfd9-d810-4999-a267-d1818b7b8f41", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298728, "uuid": "1eea73e7-bb06-47bb-a6fa-3a97defd22f9", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZe1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZcytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298728, "uuid": "58b06c0a-1ea4-4682-9ad4-8f5ed13c30cf", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298728, "uuid": "6a096d5c-7381-4199-bd75-f7078a040ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298728, "uuid": "9d6c4161-a158-48cf-b988-4dbc573d89d3", "value": "emotet_exe_e5_d0ead18beee30fbb19452f1145b25eaf3ae94cdb49bc6919fc223a723d9c529f_2022-03-03__091158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12579448-9acb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646295751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295751, "uuid": "1bd43b60-b0f8-47ad-ba13-b35a4f9bfee7", "comment": "Malware payload", "value": "2051d542346afe97bdf51861b78df575", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295751, "uuid": "e4f0c629-6e4c-486b-a4c6-abedfd265a3b", "comment": "Malware payload", "value": "d1533045617bcdefb2f393d70ba59e03c3537721a74b86138b109746b273a135", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295751, "uuid": "973ca136-cf93-44a8-8ee8-a5510790f14c", "comment": "Malware payload", "value": "37ba2896c423ee7610de54c4b3ba41d7123cce79", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295751, "uuid": "a6160ee1-0cd0-4f34-8bd5-bf68fc47713a", "comment": "Malware payload", "value": "728c30bfb5a8d8356a041f1a5bdcb9f0898dd28f7b760d67f7e22922c5666b466575f06101809e930c5b6c6ba5ed4e84", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295751, "uuid": "c93fb3b8-2fba-4bb3-b5e8-334a821ec666", "value": "T14713BF14C511650AC273A53ED83898E15CABDC17622489CFE1D67A4B0BA4FEB3B4EBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295751, "uuid": "7acef967-3efd-4253-be69-f26ae9721c36", "value": "768:w+IxRD4S0JS00SneSnjS0yS03S0IMS0bS02ScxbV+cUs70Nn2srTpxKC6yDsfuda:w+MMVU7N22Tbwy40zVMMAaY4bFMM1/K5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295751, "uuid": "a7fcc27b-66d7-4e5b-a2f9-4145cfacb885", "value": 43633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295751, "uuid": "178f5b28-35f3-4e96-a33b-c4747e250ad0", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295751, "uuid": "bc406fc0-143a-4594-b791-f3c42e26f605", "value": "New Auto Parts RFQ List,PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4836c9e9-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298848, "uuid": "4f7cfd97-9ad5-47d9-b1f6-8b7d47fb8e5b", "comment": "Malware payload (Heodo)", "value": "d270e2a0bb7b89dbe86a9703ff8acceb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298848, "uuid": "e2913da5-98a4-4258-82d5-06d5e80a6b22", "comment": "Malware payload (Heodo)", "value": "d239df3009ad2453ed65f14d7010254a826c44cca66b1ee9049380969ba6a39f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298848, "uuid": "2bdbc768-7055-4cba-9498-a41233c209fa", "comment": "Malware payload (Heodo)", "value": "63ea9ce4c4c757b8313abd2df68266960a1e295c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298848, "uuid": "ffec87b3-14e1-462e-99a6-4f4639e991b2", "comment": "Malware payload (Heodo)", "value": "37068de7ce7c9ef0c165772eb7e92c4c6010795641e515b7517144867e8cd6fcf091a946ffa9061aafdf1ce4a18d1e65", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298848, "uuid": "7afc60eb-75be-4bde-8128-92167230b5d7", "value": "T1B123D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298848, "uuid": "ed8f4db4-3670-475f-a769-80c36811c5f7", "value": "768:KeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:ZoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298848, "uuid": "b1f9293d-bee0-4f98-8640-f8a2cdfe6328", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298848, "uuid": "a613a000-9f30-49f9-8362-8707e8fa1819", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298848, "uuid": "63a9bb0b-232c-4799-998b-58269be9437f", "value": "Electronic form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e6eda8-9ab3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646285696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285696, "uuid": "e50c7478-0bcd-4e42-98c4-efe6d2c88fab", "comment": "Malware payload", "value": "4bb1549baaaf52b94fa25e1c29b22fa9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285696, "uuid": "6959b201-9339-4465-95ac-4fab501f40e5", "comment": "Malware payload", "value": "d3479d537135e75b2e5b23d7aceba466d79d0c55afa85f848fbd0bcfb8a96f51", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285696, "uuid": "12a5daae-1c4d-4873-a062-a357ab309237", "comment": "Malware payload", "value": "499436ae0fbdff66de3db6dd010b6ced0b32c4ca", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646285696, "uuid": "ed9ce3b6-eae8-4ca4-b6db-3c99ae6a5e4e", "comment": "Malware payload", "value": "bf9a0da250edd1505ced926a364c6ab8f5fb03195daadf3b2e28e4232fc26330394b13fa7f9052b5f55933af976249c6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285696, "uuid": "0487722b-b6c6-47ce-9f73-88ea67a99128", "value": "T15CA6DF67FB98C85AC4F643B6C8764262E0434E1747439AA73A7CB2781F735C12E85ACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285696, "uuid": "03748d6f-a743-4c05-9c23-542768068a3e", "value": "196608:ewIa43j3uGbp4gW6Ru7gRlAAFskZXvYWgwJV/rTYt5n:eFDj/77Ruiq0xQWHp/+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646285696, "uuid": "b25b1192-20f3-48db-b8ca-a77d2f11d69b", "value": 9679247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646285696, "uuid": "b8370e5c-3607-4539-bb11-65dfded075bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646285696, "uuid": "3c66a1b3-0a00-4310-a1ea-3854d91b45f7", "value": "PDF View Scanner.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516f1a7d-9abf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646290703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290703, "uuid": "358977aa-b759-4b94-8092-70c149271c70", "comment": "Malware payload (AgentTesla)", "value": "29dad6c53b0ace2eb79b2a0238b6d0ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290703, "uuid": "bd153066-3bca-47ee-b36f-6985a922d781", "comment": "Malware payload (AgentTesla)", "value": "d3e2cc8f6c90a8d4596c9032e6eba10010195a9abe678aca2d4d94864dcfaa4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290703, "uuid": "7276f441-99bd-4619-9aac-5a8bf064ae0e", "comment": "Malware payload (AgentTesla)", "value": "ca7855d81344b4168daf9c7029747c3fb0f93916", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646290703, "uuid": "b3afb2fb-f1b7-4379-9f32-40e49dcee300", "comment": "Malware payload (AgentTesla)", "value": "ea7c8e6dfff3d68d8909800cdca99d4f68f6e38eaad19c0aa19c21fbc85798bcfe1e8a35d206a33dfea6844ae7bf31c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646290703, "uuid": "837b2b41-5af6-462f-9719-636b44da63cd", "value": "T1AAD4E03527996B68C53D27B4013894D063F17A46FB22D62E3EF2019C1F72F96A723693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646290703, "uuid": "bfc353f4-e00e-4a43-8ef4-58f8f321403c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646290703, "uuid": "5a7a55fd-e595-4a3b-a69f-3411803a29e9", "value": "12288:vpcUGOqIcOG4Q051mQ5dhQyCiXXqdcIJnhhTl7plTMaIkCAu:3RrG4QRKdrrKdc6hZfeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646290703, "uuid": "4f9b20e0-191d-4cc9-806e-9c365aa7e557", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646290703, "uuid": "030b366b-47ba-409e-8ceb-e551b16ba67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646290703, "uuid": "979de3c4-b537-41a7-a8ba-e8a0c1b9b2d6", "value": "RAMPF_2203115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d338b934-9ace-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646297363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297363, "uuid": "7c345092-dfbc-4c8b-b4d0-0728d65161d4", "comment": "Malware payload (AgentTesla)", "value": "44474bffbcf1aac04bc5959d9f24e226", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297363, "uuid": "be8cd072-1ddc-4016-8faa-a374a7ac7de1", "comment": "Malware payload (AgentTesla)", "value": "d3f1e6e0aa3f138133bcefcafd34cabf610fb873575a6eb92252cd27a5778f15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297363, "uuid": "8c6c9507-d2a7-4091-81c3-c42ffb5f313a", "comment": "Malware payload (AgentTesla)", "value": "ecf517e738bfa02c098e4d45e873ecca6a3e91e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297363, "uuid": "f164271e-b4c3-4b27-a3bb-74918c4e0c3f", "comment": "Malware payload (AgentTesla)", "value": "49eec6f724669dde77fe51a6420e1f9b707b50f2677a19e747fc76e0b195c8b8fa0595632ee173ec6fd6b1cdbbfa6516", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297363, "uuid": "302d1e55-e508-420e-81c3-64ff65759b0f", "value": "T1E115D00438E68138F9368BB1CAC4E7F18B6EF225E549B0F654105E167646BBDC849EFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297363, "uuid": "4eebf39a-bbe8-4487-90f5-39ade755e3aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297363, "uuid": "38da94e7-6c36-4515-b5d5-ac20664b5fe7", "value": "24576:6XIhpZBzEVXQ00/0nJR8z5LPozL/NRc1Wb:3h3iA8nP89jozLFRcEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297363, "uuid": "1a6285d7-57fb-4999-9a4c-8561e4d6b5d3", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297363, "uuid": "6ef6d6b1-05c2-434c-8941-f64839d52ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297363, "uuid": "3f3f3787-aba3-4a5d-87ee-b1fe75fd6df2", "value": "purchase order -0034287.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96066e76-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646300267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300267, "uuid": "d8f80723-a359-44b8-bda9-6932117a90ed", "comment": "Malware payload (Formbook)", "value": "79bde6ffb1eaadb1fa7e57fe45211825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300267, "uuid": "0cf3ee20-1762-427c-86d6-bd551bfad782", "comment": "Malware payload (Formbook)", "value": "d3fae1feacb2e75560f838099213ae33385d6a0a11caa222a4f09024721e2720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300267, "uuid": "00e3c88a-e35f-4be8-ae6a-e8b51dcb2453", "comment": "Malware payload (Formbook)", "value": "9a8056252f890fa1d4dc8e98c7dfc3ae7cf836b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300267, "uuid": "7055c5db-1742-4487-9763-4e752cd2f650", "comment": "Malware payload (Formbook)", "value": "e09e12215254ccfc733b5591fd297a88c02db623a30cc4e946f45e77bd8cfc1a95a0e4d7f0bcb2b4a7e1ca741fe70199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300267, "uuid": "165e2e8e-c9c7-40c9-847a-51245042d9a7", "value": "T163F4125EBB881D17C67D4C79D88950A88379991FA0C3F38E6F68087B11C33A1698F767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300267, "uuid": "0199a92b-2955-4c8e-8c0c-b7a2808a7c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300267, "uuid": "0ce21d1c-0ca5-4ca1-a8a2-9d9ea83727a6", "value": "12288:XcXg13cjQ15kT3L/2HhSkzAV3m+XsB3iPDJBJ49lTE/hRAvkBP0aYOM4a:sXg1MjQ1y/ohnzS3m+8sJByqAvM8RO/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300267, "uuid": "3ab6f36f-e6cc-4492-902d-b0024fc5a1e2", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300267, "uuid": "abd64a6d-c101-409d-a6cf-25f536d6e906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300267, "uuid": "b8c23bda-bf51-487b-b244-aaa1f4fc4926", "value": "79bde6ffb1eaadb1fa7e57fe45211825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645e89ab-9ae5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646307056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307056, "uuid": "19789180-73eb-456b-ae3f-e7faf3d37d53", "comment": "Malware payload (RedLineStealer)", "value": "f28165143fb411329811d55d27186594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307056, "uuid": "ca9e5a3f-b90d-41d0-bb41-c70901820652", "comment": "Malware payload (RedLineStealer)", "value": "d3fbf51dc6bc4cbf7ee653207902766391a60bdea39c8c2f4e07adcf8dfdaf95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307056, "uuid": "9aa90928-8ea9-4791-b81b-6e4dfc9c2202", "comment": "Malware payload (RedLineStealer)", "value": "c86dcfacca96475fad9d3ecfebdd72747868ae51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646307056, "uuid": "c7b02e46-875a-46ac-ad9c-233a7d1f2479", "comment": "Malware payload (RedLineStealer)", "value": "17139968544dc0b4d30f5ec6df73ab09b831611f765677891d31097d1aa3b6bc7e78b5e770d91785e32bb02eb64f1099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307056, "uuid": "1e2b5858-f831-4415-b625-5917950daef6", "value": "T1B7644A2439EA501AF1B3EFB58BE4B596DAAFB7733B07945E109203470B13A81DED1439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307056, "uuid": "5c65a71e-7356-4e73-bf79-f194c337eceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307056, "uuid": "991ee4d9-0d50-4a0c-a530-b7836e4d904b", "value": "6144:fUliASR0Iy0zH74yDYaLH0lUdh3q7IUS6GOEv1yO:fGiAvIy2H0yDYeH3d47IUZGO6AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646307056, "uuid": "e1d1eebf-d268-439d-b1b9-507e1ce33043", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646307056, "uuid": "505bf78a-7c40-423c-80fe-cf3638674279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646307056, "uuid": "cec83252-237f-41b7-830a-408486be2827", "value": "f28165143fb411329811d55d27186594.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d8bf79-9a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646268669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268669, "uuid": "98dd56a4-b983-4ca5-97c3-aeafdf5be15c", "comment": "Malware payload (Heodo)", "value": "7dde94a8e04e62327fcb1ab6d1976b1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268669, "uuid": "d80926e7-e239-4c46-adda-aed72f963792", "comment": "Malware payload (Heodo)", "value": "d44515f12797cd2d43a00a5a65b71a87661d197a9a8c2065424b1588bb9ed816", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268669, "uuid": "a6611d76-e2b5-46c6-b5d9-e5ca3609dcaf", "comment": "Malware payload (Heodo)", "value": "e7310851b68e534368963d73b7363dc39f1799e1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646268669, "uuid": "b2843334-c55c-474f-9611-1ab0782e304c", "comment": "Malware payload (Heodo)", "value": "2b3053ead770557c8291793d22bdb4eb83edba59b1e300ccbcbd8109cc48782c2331adf2aa590a95f9e891823bc1b285", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268669, "uuid": "8153dfe7-6332-45d7-991b-48db4c5a0402", "value": "T19B35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268669, "uuid": "6a34486d-042d-45c1-a735-2f5851b05153", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268669, "uuid": "657ec964-fa38-4db8-a9ce-227ec7361754", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uNVOe528JO6PC:6iRGcUY0UvDYNFtuf5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646268669, "uuid": "1e166b96-77ca-4c9d-b80e-52f24f224916", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646268669, "uuid": "15186061-d68d-418b-a8fa-187b26c7d7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646268669, "uuid": "f521a617-956f-4259-a056-b36d91714769", "value": "line2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c486bcdb-9acf-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646297768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297768, "uuid": "86cbd552-97e9-4f5d-bbef-ddc0dc0af690", "comment": "Malware payload (DCRat)", "value": "468e8b2cc658f49ba4a9708065d4624c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297768, "uuid": "40a7359d-e47a-4c2b-bf71-d648f0d4f961", "comment": "Malware payload (DCRat)", "value": "d5847a3a4d605f7863a1dbec8fe6ee818f9baddd282a585ab08f7a4f2d2d327b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297768, "uuid": "f1994d8e-7492-46a8-a87d-5fad805b41f5", "comment": "Malware payload (DCRat)", "value": "77857c6e574cfef746fc0743e68f134d1998d945", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297768, "uuid": "904f14c8-a1e7-4986-be66-47597f1a274f", "comment": "Malware payload (DCRat)", "value": "53dc4ebc3c56ec95d58a75b938a72740780ecdbc4df0784a8f7fb4384251ee667281fd3221fe884b5a7b5de7224e5d09", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297768, "uuid": "12296aec-0423-467a-961d-5e6d4dbe11da", "value": "T1F716120E4014E2AEC20C6FF3A8AFB1B543E54F64ADEF93FE1A10B94523F2195B906D55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297768, "uuid": "0cff5c0e-dff0-4e80-8b4d-917848e1e6da", "value": "78d97886e50215e49da64ab5824cb83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297768, "uuid": "d9253df1-d7c0-47c4-a17c-6dff8dc21855", "value": "98304:GDk6mihHyXS3x1Y4eSCYTuwcnrP2+ijEWWGnKXuaJvjg74EizleL:GDk6mihHyXS3xu4eSVPcnreHjbujJEs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297768, "uuid": "9214fb6d-7953-4eb0-a239-9d115f3b5cfc", "value": 4108192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297768, "uuid": "4b2081f0-a3c8-40e1-96b2-da915a4ebbcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297768, "uuid": "1dda65cf-48ae-434f-b0e8-4c00a6fe6eff", "value": "468e8b2cc658f49ba4a9708065d4624c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2a2fa7-9b0f-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646325052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646325052, "uuid": "c3afd013-b07e-440f-bd86-018319933be9", "comment": "Malware payload (Smoke Loader)", "value": "d2660f79c6ed3fa6e6d9e2d261a07085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646325052, "uuid": "51e0a7e4-a367-42d7-8ac3-6fa22c32017c", "comment": "Malware payload (Smoke Loader)", "value": "d618d086cdfc61b69e6d93a13cea06e98ac2ad7d846f044990f2ce8305fe8d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646325052, "uuid": "5014e157-874c-43cb-9e6b-d28a0f141ec9", "comment": "Malware payload (Smoke Loader)", "value": "6f62d52b374fa52a1d3d188cab916a451937deb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646325052, "uuid": "68685d59-d96e-4afa-bd41-85cc37a8747a", "comment": "Malware payload (Smoke Loader)", "value": "55875f9614becb1b4f041158f1adfcf20b05d8908088c87c1e3da6d313f3b575ac23a918d3f3bebab208931701f5d0f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646325052, "uuid": "d50cda88-a3b4-4e8c-b244-7792d1c1f581", "value": "T128741A0015539C6DC445833F8DAEB710E9AEEF92A6B39C4E6D683A1B36701C0716F6F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646325052, "uuid": "ac7dd8c1-2cef-470e-8f25-f00fe1ee1346", "value": "fed86fe2d9c90d6542a162388f4d6b45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646325052, "uuid": "b89a98fc-8e61-4160-b890-318dbc769965", "value": "3072:WJ5LtmLL16mJC2rTC5bU/lUvW4/G96Od3mm5pQu9MjIlp2hY:ocLL13zr+5bUuW4O6OdAu9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646325052, "uuid": "33bd2ebc-7da7-4fe9-9208-a292c9d3913c", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646325052, "uuid": "d62f0ce3-27ba-4d3b-8bf6-5e3cfa48199d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646325052, "uuid": "63610e3e-ec36-487f-b9f4-da47e0995466", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f1e397-9ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646294407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294407, "uuid": "4f3b6c87-c52c-4a21-aa4b-13c783e5faed", "comment": "Malware payload (AveMariaRAT)", "value": "caee2181acc410759fa5af49e44ff566", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294407, "uuid": "47f5a735-7edc-4f06-908e-b98b33541f8e", "comment": "Malware payload (AveMariaRAT)", "value": "d68cfb745e9f076fbc02abbcb79b7aa7754f7df1a2c5ba70e8694ca802bec1bf", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294407, "uuid": "77404757-fb87-4edd-bac3-485aabd3933f", "comment": "Malware payload (AveMariaRAT)", "value": "064d38aa677b7b803b4548dc1ed919b97f0a4b49", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294407, "uuid": "a4d2f648-6766-43ad-bcae-8546ecfe648f", "comment": "Malware payload (AveMariaRAT)", "value": "0ba97387c08edf1fcc94ed1bcb292ec3808c1f71bbe64107d705f978c4a37a690f9ec90aec9919b9dbc477699b57efe3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294407, "uuid": "2b230c56-516f-403b-a868-1f183dde6157", "value": "T1658423579D372B2D89283CB445B362E88FFF85001356B1EBE5E092636E187417C7EB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294407, "uuid": "79c23554-6d1c-42a0-aa89-835609381278", "value": "6144:Pjm1frs7MqzXenYjKcoKE+n7fYEa+whs0767UBlr70F0ZzfvsHRWhlgmGtN1:0fr/nYGcV9n7QEhj670sfoWhlD4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294407, "uuid": "aa1a8721-f16f-462b-8640-74d765eea0a0", "value": 389920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294407, "uuid": "60ce2e99-0149-4e5e-bf51-54b778a60044", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294407, "uuid": "161d652b-6711-41c3-b6a0-c94009872489", "value": "SKM10322.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfecbf37-9b26-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646335180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335180, "uuid": "da5fba8b-50d7-453d-9b91-76cbaa0757c2", "comment": "Malware payload", "value": "589fc060c91ab7063e8884736330df6c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335180, "uuid": "8ad1b1e9-3cdb-4192-b3af-152a4af78eb9", "comment": "Malware payload", "value": "d73e9e45979ed958d35ebf3d9d3c4de6022ba5833604b91fe7e3fceae3e1d085", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335180, "uuid": "94c6c517-7759-4e50-9f02-5ef353577f7e", "comment": "Malware payload", "value": "627237e4532bf85b4a137ed467ef927d320ea6d6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335180, "uuid": "a97105fd-44e7-4688-9073-affa76ef0e82", "comment": "Malware payload", "value": "943b22c55aa41db99949c0c737d6bfe6694cc2f96d452054edf8a76b1d991689eedabf38f0570c9f30bae2d26e6f3dfa", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335180, "uuid": "8f8b6f64-4b56-41d4-9399-2db5fa8993aa", "value": "T15144F1DD95D353D8C5B5C93F327B1A6D0808026B59C1B2AF7847AE181F1E8D6AFAC0D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335180, "uuid": "aeb4dfc6-15ba-4a7d-b988-983c7acda0ca", "value": "3072:bbKz8hzEVPn0/u9NzTdk3nyZYRAKgoqX4xaNPYv0pt2jbkcarJ8hThi:bTW9myZ8NtGs0pt2/kHt8hTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646335180, "uuid": "6625ebd1-aee2-4ed2-961b-1080552605c5", "value": 266178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646335180, "uuid": "cd061641-1909-4c00-8d52-fabc045c3311", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335180, "uuid": "3d973976-4f15-48eb-95db-df9572b5be28", "value": "meamgnri.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55a41fd-9b48-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646349819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349819, "uuid": "4d9c6154-87ae-4034-8cb4-5558742e96dd", "comment": "Malware payload (Heodo)", "value": "160dddbec2334fa04c40d6baa42d6de9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349819, "uuid": "8211f377-3a3e-4ccf-9629-98551d297cd8", "comment": "Malware payload (Heodo)", "value": "d776e958e3e1bd697bc77e6d2aec1fe209dedfd3ed19e9d96233860408d8c25d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349819, "uuid": "638f08da-476e-4274-815e-a53610229d25", "comment": "Malware payload (Heodo)", "value": "37348aba9f850ec236b23bf39f95c69fda4e03f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646349819, "uuid": "ca6ccc79-5fea-4d33-ba7c-832e6c70fb76", "comment": "Malware payload (Heodo)", "value": "632832bf2ed0c87d8316d4235beec1a605a50fadf1a34798238696572019d40e860a0b91e751e81f82a333897990b8cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349819, "uuid": "727b5229-13b5-48cc-b04a-eccc074106a1", "value": "T104D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349819, "uuid": "a618719b-eea4-4781-a5c6-919721817460", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349819, "uuid": "c5664864-a1b9-4bd7-8fc6-4a803e5bff9d", "value": "12288:J1U8sNY8/z0rYebzwdVCoGEAbcVBLku8w:oq6z0rYcMdVVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646349819, "uuid": "84b417c7-ae6a-4f4b-9bb3-18bca84051be", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646349819, "uuid": "303116ce-a7ab-4c29-9adc-1db7b9285ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646349819, "uuid": "0e658691-af2f-49b7-96a8-4a58e946c931", "value": "160dddbec2334fa04c40d6baa42d6de9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff52f04a-9ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646294001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294001, "uuid": "05b2122a-aed0-4fd3-9e23-727baa8696ba", "comment": "Malware payload (Formbook)", "value": "1e8ca8f9363be0905b644cb79203ca8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294001, "uuid": "e003a1b1-fa19-42f4-b491-44505fbaa5fb", "comment": "Malware payload (Formbook)", "value": "d7b5ad2732b766a5180fd78a4299e86597cb2e32bba25eef3a7c74eb8a84fde7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294001, "uuid": "2735a49b-a100-4a5f-9552-1d9408fe5a4e", "comment": "Malware payload (Formbook)", "value": "3c46285621e1d48f32e98030e43278dbc839a26e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294001, "uuid": "5feb8b54-7167-49ae-9acc-656d8c8866de", "comment": "Malware payload (Formbook)", "value": "19420419162c4744383d86cf9f32f30d927a1032c899e5f42bc47b4d57b8f5af3291f98f4557c368b7ea4039f8d5e503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294001, "uuid": "3d7e7a60-801c-4ec9-89be-34bbf0d34535", "value": "T16804AE32D641C035E2B252B5F6BD0B7B893D0E343255A0EAA3F116E06EE49A5F52D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294001, "uuid": "2a416d8f-6593-4dc9-bdfa-20af24d00ae0", "value": "3072:QS4Hokzf7GsDaEJ3MB5/fOQCuci6Vu5XavPvdmilfZXIoJDlF6bQm6:CTz1M//kPi6Vu5qMil3PFmQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294001, "uuid": "e4ceb5e4-502e-449a-b656-c4b77ebd6889", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294001, "uuid": "26ec4c0a-fea0-488c-aa34-06a6c5e3fd69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294001, "uuid": "63627ae9-4be9-4e32-8d2b-94c644c5c1a9", "value": "1e8ca8f9363be0905b644cb79203ca8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca28913-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646300493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300493, "uuid": "45447b5c-860e-42a6-9b65-8f208616f1a0", "comment": "Malware payload (DCRat)", "value": "6e4f52db7bfdadb99a8dfb7f1f6b9333", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300493, "uuid": "512b82bb-4f01-41bc-a5d7-edf1e7c3fcaf", "comment": "Malware payload (DCRat)", "value": "d810072e7363c14184f61fee52b2968f7394ed84a7bb1ff52dba033b30ce17e0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300493, "uuid": "7a2aa275-f735-4798-aded-19cea27da7c2", "comment": "Malware payload (DCRat)", "value": "e5fba109612a0d6951d87eaf00c0ab53a5b71dfd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300493, "uuid": "db0a4a1b-2b45-486d-a79d-bbbf86ab57e1", "comment": "Malware payload (DCRat)", "value": "b22ce826b8e7355b59d8534e0d0b2bf9ae795a4e2938d94c92030332b8e52cc72e1cf5957d67952b6d4d703d6d0d86d3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300493, "uuid": "85af0b48-2a83-4678-86be-52d148c89f55", "value": "T1AC75331F0D687E04D8303FFA92251C851998269C93FA0D66DCA4E6DE3B7A0DD748E35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300493, "uuid": "fbdbe5a3-e8b5-4976-8e50-0b760d89d712", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300493, "uuid": "40fbb8d5-02aa-48d1-826c-917f1d97353d", "value": "24576:H4wTa6lFYh3KMH8VanmyJtV+26tim0aHh+XjRXv3pX57/oT/MKDQmWCsMoAaiN:HzTaQalMVanVEdcm0QUXjtvZp7/cls+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300493, "uuid": "76502b5c-68ad-44b9-a9c1-fa59e833640a", "value": 1555456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300493, "uuid": "ba67f50e-5ac6-4186-82dd-8832a83acedd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300493, "uuid": "59921e82-e81d-46d7-9386-c5ca2eb74043", "value": "6e4f52db7bfdadb99a8dfb7f1f6b9333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187f144f-9ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646300486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300486, "uuid": "55496c8e-b16a-45ea-b49b-6ef6cbf17fee", "comment": "Malware payload (Loki)", "value": "afc76e8dee3ab00cefbf81b7fa54732f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300486, "uuid": "6fcf452a-f6b6-446f-92d2-49ba851ba846", "comment": "Malware payload (Loki)", "value": "d8ae5b201f1df9fd6d7f314e9ff5deef5071f48256c1d861082767a46f39cdf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300486, "uuid": "7919a9cd-d59e-4e02-908b-5d2e54e8ccc1", "comment": "Malware payload (Loki)", "value": "87617021f61010d6badefb231b643713983abba7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300486, "uuid": "1b5c5923-4a4a-4e12-8740-06dae75f8c0e", "comment": "Malware payload (Loki)", "value": "541ec796e716c73e929aeb30e90afaddb1c84feee5aa200a9ea728381a99e37fba7762a1550b7dd1e3b4ed7c9fc8b2a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300486, "uuid": "ab442e3b-8224-4be9-a3a3-dcd0928e6e2d", "value": "T11454120453C098BBEDC4083B25FA637AF6F646A9E0799F0B6F905F693D027E4940399D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300486, "uuid": "794aa4ef-ef1e-42f2-b7a7-a3b890c757aa", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300486, "uuid": "b31c663e-1a25-430e-b016-60bbcb0bf94c", "value": "6144:rGiNi2bBAECtDLPGurygxg0yED5qvrGlMCpU0d:Ji2bFC1LeWygxgfEdYrGt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300486, "uuid": "34726930-8cc2-48a9-a14e-06b9ea38fe5a", "value": 302212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300486, "uuid": "e64e308a-35ec-4274-aee9-602546ad8df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300486, "uuid": "6037cba1-8f9f-490b-85de-cb05cb4e5cff", "value": "afc76e8dee3ab00cefbf81b7fa54732f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3bc1cc-9ae4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646306640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306640, "uuid": "60b2ae08-f2df-4ea3-b1f8-2368bfcd2199", "comment": "Malware payload (Mirai)", "value": "37a5971ba453a4ef866e7a90d08a22ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306640, "uuid": "43a9e2fa-3ff3-44cf-857f-045523fdbe86", "comment": "Malware payload (Mirai)", "value": "d8ba58bc0714039161265cfe7139ffa49fbd1ad04f8d1d6988ba507077c57383", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306640, "uuid": "0999a227-9b4c-4986-9633-717b52f2e5e6", "comment": "Malware payload (Mirai)", "value": "248fdf34e853bab23e171e66372d97153f078c29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646306640, "uuid": "03595189-e76a-4a3a-bd82-97334b878b82", "comment": "Malware payload (Mirai)", "value": "f116cbf4c7399a30448e9bb9c52e79fae4d5356f3fe06933850f6ee93b9e3784e0cd37267093d15b20984c84531383d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306640, "uuid": "7bb3f6a1-1c4d-4f2d-8f22-5a3b29f628c2", "value": "T1D393504E6E714F7DFFAD823897B79E209309339616A1C684C1ACED025E7038A741FB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306640, "uuid": "af22b50c-d54e-4186-8a58-7118705a2466", "value": "1536:vU9iqAyZ03D5dbkKSdkVj+lW8goEdPSk7IB6uLYIHdhAUwS08Qt:MOkKSdW+lW8goEdPrMxLYIHdhAUw9Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646306640, "uuid": "d2656763-2e11-4c82-a70d-052ebde3ea23", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646306640, "uuid": "08c23ba3-c7e8-4c9d-acac-d492d8d21521", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646306640, "uuid": "0abdcaeb-24b3-46ee-ba53-5e59ee5b664b", "value": "37a5971ba453a4ef866e7a90d08a22ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49aafc2c-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298851, "uuid": "4e13b1b3-fd57-489a-bfa1-a2c054c309b1", "comment": "Malware payload (Heodo)", "value": "16febfcc0610bf9306727975d4838ff7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298851, "uuid": "da335145-a632-4f2a-90c4-e8d26dae4435", "comment": "Malware payload (Heodo)", "value": "da0cfdab94206286ee49ff11cf96efbe4589dab55f8dd45a0981c8a8af5e1179", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298851, "uuid": "4e29dadb-afce-4c6c-b917-4e906ebb5440", "comment": "Malware payload (Heodo)", "value": "1e9b79e6a6c89794d14a237b9459222d4f5a5783", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298851, "uuid": "3e2bd8de-7c37-4595-beac-cb29d9b2ea63", "comment": "Malware payload (Heodo)", "value": "446b6ecac19b2252597fb9d69b0dd613a8181dcfd94ecdc1127ebde68ba5dc6e8684d97ee046a16363b34f0e2e4b4ec7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298851, "uuid": "23e8ab19-a67b-4059-87dc-4c0f027c29ca", "value": "T1E223D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298851, "uuid": "dd51de8d-f3d6-49ff-959f-64acdabc5916", "value": "768:ueoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:FoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298851, "uuid": "2242c6cb-41fb-43dc-8f36-df1cbccffe53", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298851, "uuid": "aed24813-e1d0-46f6-bc85-97df7d7dd0b9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298851, "uuid": "cefe2553-3aec-472a-be76-dd3e6a04e146", "value": "Form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf1e315-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "8c3447a7-db70-402e-b0f8-b6f23c6602ce", "comment": "Malware payload (Heodo)", "value": "a61426a181f344b5b883aa559af93724", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "4924467c-1a99-4ce8-8c6b-fce72d3e7603", "comment": "Malware payload (Heodo)", "value": "da3e32c450be6bba66812588b8d5f07348516aa95464ebe3f902c5c42fe6eee8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "9c5ab3d6-6e55-4567-8d2b-5d3308324137", "comment": "Malware payload (Heodo)", "value": "36bc4de4aae0ca30fa822485ee770ef0ba0b1ddf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "ccb0295d-03c7-4078-bbf7-70f30b099e4d", "comment": "Malware payload (Heodo)", "value": "26e792004f61341df5b421065024cd4a279a4d82857df780979226a0ffdca94c30fe22713ade73ca02dd90aa5845b63d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "a30cd536-6e49-4200-a302-f3a603b1c5b4", "value": "T1F2D41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "6be8c74a-e498-4480-9849-9c13dbfe47e2", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "6e6e39dd-de61-4b9d-87e3-06e5a1916fe5", "value": "12288:DjN/Z2wkRrA9CRDCIElAjHDsndSyHOrNvEP0Oua:dEHR+CR8yfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265651, "uuid": "2600a2fc-ce55-4bd9-9d58-d468ffbcf1b2", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265651, "uuid": "ad67deec-4c92-48ef-b9c1-2fd5decb4272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "1e176d56-7390-4a67-aef5-6b3e83cdb562", "value": "emotet_exe_e4_da3e32c450be6bba66812588b8d5f07348516aa95464ebe3f902c5c42fe6eee8_2022-03-03__000044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cb9853-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1646295145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295145, "uuid": "0fa0e2aa-5bc6-4d74-9151-1c80eb841e9e", "comment": "Malware payload (Matiex)", "value": "eef35b609d37962c62bab1df4c0b3c39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295145, "uuid": "43a4d126-9425-4e74-a157-870949365bf6", "comment": "Malware payload (Matiex)", "value": "da92268cf4a384c5d170d5d4ef9939183328e699c0097bd02b716757a2bc0dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295145, "uuid": "cc2b71d5-21c4-4cec-8e0d-974f09e550ad", "comment": "Malware payload (Matiex)", "value": "b009a2c43f9a959c72245e07bfbb32ceb8a2473d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295145, "uuid": "784aec78-77f9-4dfb-958e-7b48b26916fe", "comment": "Malware payload (Matiex)", "value": "aaf7644796f9bd57d359c51b26accadd4ae824f22ac4e471aab0394bfb50dbee21ead4f0e22d9641da2d55c448582591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295145, "uuid": "0080aa28-3103-409f-9275-0a6552663825", "value": "T1B7755913BBBBCD02D4EFCEBC480B04FA1B536C1925BD42098A7571D52F796AE24AD1E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295145, "uuid": "6808f3d0-9776-4f2a-9573-5d8870adc8eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295145, "uuid": "15c18e6e-b8b8-4b09-9078-a143019e9b1d", "value": "24576:IrrOeWXUy766ZhX50cjSGx64R3hXLAuZ9:4wJZhX53jtH759", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295145, "uuid": "64e32cca-95d9-4a39-847f-e9251c27e526", "value": 1610752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295145, "uuid": "fa4bfb4c-fd56-46f6-9854-7717a4b280fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295145, "uuid": "3f15d563-3eeb-4a8e-83d0-5e2b1fb8404f", "value": "nigga b nostartupp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5929926b-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646298018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298018, "uuid": "dc632043-8a7b-40e6-80f9-9cf6fa914408", "comment": "Malware payload (RedLineStealer)", "value": "37a5088bbf81dac60810bd50b60f803c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298018, "uuid": "ca573639-b1be-4fa8-b64d-3cda2f3bc6ce", "comment": "Malware payload (RedLineStealer)", "value": "daa1675de2f48dc9828793e726db01c9cd3f3cba5d04373a63a4b08b2f9fbc81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298018, "uuid": "ce934439-92d0-4aab-a8c6-485015c8b9f5", "comment": "Malware payload (RedLineStealer)", "value": "d3dc73f05cea15d4392dadd36736bb22f3de2f50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298018, "uuid": "a2c6b119-02fb-4ea6-beaf-c843595921cc", "comment": "Malware payload (RedLineStealer)", "value": "844d53dce39b2caa222a6aaec4d443c5922d08513354befa9dea62c654b8dc2626013f49a67cd8ffa2d33bbdc944bc35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298018, "uuid": "87e881d0-a520-403e-9845-9fb48a5049b0", "value": "T10D9523DE365BD0CBEBAD1CB0114E55869AD0E878C2C43B5E709AF43A847263643CE67C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298018, "uuid": "44004040-017d-4ee1-bb04-33e31b056df6", "value": "fd0aca11b560a85f36cfd483f64f28c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298018, "uuid": "479a1c36-47ee-4ecc-8805-e5a97c7c537f", "value": "49152:MidOnd6RDsVroO2YBOId5F5UEEtRxD923Op8+GsN:jM2D5fYUEkP9kI8+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298018, "uuid": "3c8acc2c-4d18-4087-a74b-2e4a03106332", "value": 1909104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298018, "uuid": "152b428a-ad2b-4b11-8305-ce57a51add8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298018, "uuid": "c2673446-3490-4736-a440-d4677847fabf", "value": "37a5088bbf81dac60810bd50b60f803c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2611f901-9aa8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646280752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280752, "uuid": "6b328f88-3b1a-45a9-a300-2fb4a1fbe4eb", "comment": "Malware payload (Formbook)", "value": "8796aaccd780a02dad7b9d67af5dc964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280752, "uuid": "3cec20bf-0874-4ceb-9027-2a57bd771b64", "comment": "Malware payload (Formbook)", "value": "dadfe6c54e7000472e145b38e7410fbfef963566a06811ede626705a9e98a53e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280752, "uuid": "8bc0e1ec-70fe-420c-80e3-f1a6bfb200ed", "comment": "Malware payload (Formbook)", "value": "b0eb4013382bdc3ca6e2bc76755054f5ff6553e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646280752, "uuid": "230aac77-4086-4563-98c1-1e7cecf678c8", "comment": "Malware payload (Formbook)", "value": "36a693e4e965a3a57997fd30cc530054767763237809d3cb795dfb989754598522c1173a654eaa47ec9378999833f9ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280752, "uuid": "c59c4eb8-8825-48aa-97d6-c01c1d3a77b5", "value": "T153354A9C365072EFC857C976CAA81C64FA60747B970BD203A06312ED9E0DA9BDF154F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280752, "uuid": "0ab7099b-cefd-4575-b020-829a852047ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280752, "uuid": "2b945880-975a-4dda-b902-1910e02f9fe1", "value": "24576:5rT3UkkO/XBH7mI9sfP7trGkdhnLSMwxOUqn/Kb:FYO/XBHhKkkGMwxOBn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646280752, "uuid": "7bfff3a7-6b71-4ac3-9eb0-dfdc995056b8", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646280752, "uuid": "b9638c47-c350-4fc1-8f98-d4fecf1619e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646280752, "uuid": "5cb5ecec-b308-4b47-9eb0-c04a81023ea1", "value": "8796aaccd780a02dad7b9d67af5dc964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac53948a-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackNET)", "timestamp": 1646298157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298157, "uuid": "cb484f97-78d5-425e-88fc-5c28ccd73b6f", "comment": "Malware payload (BlackNET)", "value": "0ce6472a1caf1e18f0c87c6f405c6441", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298157, "uuid": "41cf6514-9de9-4ece-b33c-81c6df0ccef3", "comment": "Malware payload (BlackNET)", "value": "db1499fa5ea0d7bc198609ef58218e8c95a63e19a4c59bcd5f6e81a0439beb1b", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298157, "uuid": "8012412f-529a-44f3-858a-d571afb2d740", "comment": "Malware payload (BlackNET)", "value": "d6f0f1a7cfb43cadeace56f7624e3ca91bb46b8f", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298157, "uuid": "93934d9c-21ff-4bbc-addc-34976e3b73e5", "comment": "Malware payload (BlackNET)", "value": "4c41c0bbde133756308d1aa09a3b1ba671bd6610540710973e7e0e5232af89c1c4be1688e45ad3194b976a20e15bb645", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298157, "uuid": "3ea7d30d-23e3-4b78-93d5-699ab38ce253", "value": "T13BA459C366048B24EEA47D385A64C93AC611DF8A7B04870328E1FE9F723EDD1552E367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298157, "uuid": "15a3e910-8c90-4aad-81ad-c7ce0c694de3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298157, "uuid": "7c0b136c-cc28-4c93-9232-bc82d02ff413", "value": "6144:i3JgUpL8SNFDu/O63hGSb/DB5pr0+UTsWkef1XwxQ1IbEKW:itp5bu9TlLfUTdwq1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298157, "uuid": "39f3e475-1a77-4f61-aaac-011d866874cc", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298157, "uuid": "0f965cbe-a8eb-4ae5-9b0a-b9aebbe05016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298157, "uuid": "5b43e6d7-9f2b-4f05-a668-ec2b78187654", "value": "0ce6472a1caf1e18f0c87c6f405c6441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a51ef99-9acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295845, "uuid": "c71f4d56-ae35-45bd-a742-2a84913351f0", "comment": "Malware payload (Heodo)", "value": "0242d378ee4a83d39e592526d5607aa6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295845, "uuid": "f7222989-a286-4e9d-a6e7-f14b4ee65874", "comment": "Malware payload (Heodo)", "value": "dbfa4d6d2bb9eceb448530122e514ae9ded3a7ac3ffd0ade6b938d439fcf05d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295845, "uuid": "4673e511-45c0-43d7-a233-c2ab44129fe1", "comment": "Malware payload (Heodo)", "value": "04f20cecdc1e4bced6f832ec5b67a247752ebf16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295845, "uuid": "9362cd13-09a4-419f-a99c-5c47fa9ff16f", "comment": "Malware payload (Heodo)", "value": "cab798d75ea6259c874231cdf0c3e4e60c87c56f0c9e323d0eb01e78f0db683f05785cb9437e80686a71544e143addeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295845, "uuid": "68eafa46-9a39-41c0-b969-75b03d304393", "value": "T1E8D41B017498F0B3E38918B04A858AFB724B5DB296117073F2ED378CA7725F15CE766A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295845, "uuid": "d4e63751-1e59-4542-9334-e772fb12e7bc", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295845, "uuid": "d77d2b5e-8367-49df-9b88-40251de16fce", "value": "12288:pao0Se86lloPxHHVVIjqxEqRVoQmiIII999tLLLdAkkJoFLZZWbClgluPcRBATfB:AqxETMJ777u3OmONFqNJtN1v96TOAnZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295845, "uuid": "90d5be64-c9ae-4d75-92ee-a7e73d22921c", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295845, "uuid": "9e3b108f-1389-403d-9888-e4b68aa2cbe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295845, "uuid": "69d78210-7baf-4abf-8099-a326c8568169", "value": "0242d378ee4a83d39e592526d5607aa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f11c25-9ae1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646305503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305503, "uuid": "7787f207-2362-49f1-9013-4cfbecf87c0e", "comment": "Malware payload (Formbook)", "value": "cdaedb9d5d04e8af5ba12e6a5463bcc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305503, "uuid": "47406520-bf27-4a9c-9dca-19ec08074c89", "comment": "Malware payload (Formbook)", "value": "dc398f97c7c248ee6e669cb910b617224c1da4eb8338a37fc4ed812784f83a24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305503, "uuid": "e6f469b9-e8d2-423f-ae42-b28063d7cdac", "comment": "Malware payload (Formbook)", "value": "027ec850ee32018f645e19cb402abe8e773e331b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646305503, "uuid": "f4b248bf-a9de-40e8-a010-a6406cc658fb", "comment": "Malware payload (Formbook)", "value": "063b0bcc8644bed338809715ca757579b794f5e0d8a1384090b26b8870e15eff975582319a989b47bf51150c76c76279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305503, "uuid": "0c6e15f9-a9f8-4110-b9e3-049598b62856", "value": "T1EA54131769C06A77D5724F3012BE5A3D93FBA3C50095290B2F943F3D7922B278B0A597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305503, "uuid": "9310cfce-b593-44b3-b6f9-e70a8d5b6129", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305503, "uuid": "63b34b2e-cdd5-470c-9f53-bd0079b80d2c", "value": "6144:rGiRdh8v32Yo92Qwl+xz6V0peVMvv3s6p9dKKl5rVR8YyVMb:9d2v32YJQw+zGTQv3s6vdKm54XMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646305503, "uuid": "9669dc5c-c3ae-438e-923e-ca9013b707c0", "value": 305836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646305503, "uuid": "d0e09571-f770-4f75-965c-51ade192277f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646305503, "uuid": "6ea03218-fce7-49f4-93d4-f64885d38ae9", "value": "mobi9000989.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0317a4f-9af6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646314538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314538, "uuid": "36128136-a43d-4ce4-b3a0-21461ac1cabb", "comment": "Malware payload (RedLineStealer)", "value": "97e456db29d1394d70692adfbd1e3bbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314538, "uuid": "8817e0cc-3475-4f6a-bfea-3d5447c6d600", "comment": "Malware payload (RedLineStealer)", "value": "dd496554f084af7bdd9c216bdb8718cd3de154d804b8955f4894c0954dad266c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314538, "uuid": "885a8c5e-ce69-4496-8c60-bbb7181c8898", "comment": "Malware payload (RedLineStealer)", "value": "4f0dc4b80cd0ebe91fda09ed71ba9e4733543e1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646314538, "uuid": "ac0235d3-1cb2-4c3d-882b-cbca987c6bba", "comment": "Malware payload (RedLineStealer)", "value": "31708b6e448d5fffd5be77dc074aec068d1121a83e64f1b1b269698f0291222d34c51d21ce155cec266a3faa68c84a1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314538, "uuid": "047f764e-fe65-4769-bcf0-85beee6f78fb", "value": "T153E53302FAC380B2E537453119592BE1A47D3D613E298EF7A3885D5EE9311419B2AFF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314538, "uuid": "91338cd7-4bf6-4eab-9031-424d2afd0510", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314538, "uuid": "e93f720f-3d2d-4ed0-b80b-8b34cff6153d", "value": "49152:V5OvM7GU1Hoq9JS929DC1O0dUEkRY0yrWmNKnImzKu6FYkixHtnSfN/hFZ:V5F51IYDQOnRY0yxyzfUixNSlDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646314538, "uuid": "e9e1e8d0-d43d-4d42-9be7-5984f26b7d7d", "value": 3272344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646314538, "uuid": "7cf9cfc8-f537-4940-ba24-775753818974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646314538, "uuid": "32f31f91-2d04-4897-b6fd-9a620ef826f1", "value": "97e456db29d1394d70692adfbd1e3bbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05076318-9b03-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646319781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319781, "uuid": "9d825570-577e-4c10-bf23-378524b7d52e", "comment": "Malware payload (SnakeKeylogger)", "value": "ec3c59bbaf3a542d74d5f0118e1b9b1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319781, "uuid": "25d61624-ecaa-4957-a150-7c3916a86b30", "comment": "Malware payload (SnakeKeylogger)", "value": "de93ab3981db82d5d391aeb515b94f8069a6cb187a8aef110d37932b03b97ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319781, "uuid": "631f7ca2-8c68-4cfe-8b21-7cab1c9cd8d8", "comment": "Malware payload (SnakeKeylogger)", "value": "ee9a764e5476aeedd15d0ad10809fe841f46eec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646319781, "uuid": "b6a87b1b-8491-489f-9e23-864794454b48", "comment": "Malware payload (SnakeKeylogger)", "value": "05437ca4dd7ad459e73133fc4f8f4114160a203fefd21acbe2a25609e7476d65f109bd4ee4f2677e9d21e1ec1488a04e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319781, "uuid": "af9f469e-4cd3-4193-aea5-6c5643dfcc15", "value": "T18C44023422F43229D99A0FB8F1E032401FBC5AE2B999D34C5F3879D7395B2D41BA1639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319781, "uuid": "f874b542-efd9-4b53-8119-a0d7c0d00982", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319781, "uuid": "a7abac38-5058-4eb0-8837-d5620ec06842", "value": "6144:utz2DwtL+s5XtatAdSs7qF9TfrNI/kRCl9:utCMYtAIL9TfbCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646319781, "uuid": "ae0567fe-de90-4ff4-8b8d-26915ba1c6c9", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646319781, "uuid": "1524f38d-e2d9-494d-8f58-0be04074ba68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646319781, "uuid": "7b8d55a9-47b3-4cea-a777-664938609f4d", "value": "Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04d963b-9afc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646317035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646317035, "uuid": "5165301f-b08f-4ea9-a9be-9719caf1bb7f", "comment": "Malware payload", "value": "377fb2762553e5210c3735e115cabf14", "object_relation": "md5", "Tag": [ { "name": "alfarcec2", "colour": "#C78926", "exportable": true, "hide_tag": false }, { "name": "alfashelluploader", "colour": "#861196", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646317035, "uuid": "a76fc612-d70c-4187-82c8-0d14a0778bb4", "comment": "Malware payload", "value": "df70e51b8184f55f8c2ead6b202814b71417b0986aa71a56b5d1dd07275f084e", "object_relation": "sha256", "Tag": [ { "name": "alfarcec2", "colour": "#C78926", "exportable": true, "hide_tag": false }, { "name": "alfashelluploader", "colour": "#861196", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646317035, "uuid": "715607b0-377c-4569-ab3d-706f08405222", "comment": "Malware payload", "value": "3f17b6aae500520310a9998509f45fcc24e7b9b8", "object_relation": "sha1", "Tag": [ { "name": "alfarcec2", "colour": "#C78926", "exportable": true, "hide_tag": false }, { "name": "alfashelluploader", "colour": "#861196", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646317035, "uuid": "6ac11c24-9411-45c5-9915-3983c396f8ec", "comment": "Malware payload", "value": "08150a03f0fb3799e6ce9afd98f45060ac924ed8daeca8e673d24f9eb8fa4b891f71a722224e87ebb275498b6b2c6d7b", "object_relation": "sha3-384", "Tag": [ { "name": "alfarcec2", "colour": "#C78926", "exportable": true, "hide_tag": false }, { "name": "alfashelluploader", "colour": "#861196", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646317035, "uuid": "53653f9b-e52c-4944-b7bf-20be303ea092", "value": "T1E474CE84CA888437D324D7B5BEBC479539D8AF38614C8489F352E5670E3EA2D9C251EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646317035, "uuid": "ff211bbc-4fe9-4791-be57-885ba712ffe9", "value": "2a2a662be9dffc461398e7c94d0b55b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646317035, "uuid": "d6987943-62de-4996-80b4-c4473012b279", "value": "6144:HulHCiG/6nw9ECH+WXZ/HybbYjdvxjYJZxCG710IR3sTcitBKjiWIq+s3pmTFKnY:uiiG/6nUECHzybbIvxjYjxCGqI5sTc6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646317035, "uuid": "6524643e-1458-437e-b1db-7c8f9776a570", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646317035, "uuid": "8acef310-2fac-4f1e-8373-1f21f9513e93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646317035, "uuid": "d0dbea89-e2cb-4529-aaac-6312b6226634", "value": "AlfaRcev2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8726f9f3-9ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646301101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301101, "uuid": "11a18081-2c9e-4532-81be-85fc995f1772", "comment": "Malware payload (Formbook)", "value": "fde9e531e09739823526fc9ff4385a2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301101, "uuid": "c428871e-68d4-4459-8359-a1568c04665b", "comment": "Malware payload (Formbook)", "value": "dfd8941401c6e44bf380f982cd4b78d847f87fd3ea364418b00ceec92f97c500", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301101, "uuid": "8695caa1-b3ef-4f42-ba5d-88322684a85e", "comment": "Malware payload (Formbook)", "value": "2e637361b14c82d64b152a46ac266c08546494a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646301101, "uuid": "a345768a-e5ae-4913-bc67-5e1a294ef24a", "comment": "Malware payload (Formbook)", "value": "956c9006e67b531c34ab801252053eec7e56bc6bab51ecb220c26ebfe47c66f74120a0e62c96d8db2efeefac7a11f768", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301101, "uuid": "36770169-9a72-4c11-a5b8-8ede602f18b7", "value": "T16C15D00438E68034F9768BB1CEC4E7F18B6EF625E589A0F254005E557646BBE8C49EFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301101, "uuid": "6a13ab29-12a6-43fa-a118-a2b6be5c76e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301101, "uuid": "8f37e614-2adc-46a9-98c5-c93088941ebb", "value": "12288:VhR/IDTviQxhG2xikWMOA6e1thREfnWOkKq+hIAM1kAn8thjKkoVi:VWLVhG/kcygnO+hIs68aV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646301101, "uuid": "1e49d81a-097b-435e-9e73-d49c9069ac4a", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646301101, "uuid": "4cec4790-56e5-42dc-9155-3a178014bf11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646301101, "uuid": "0c90dcc8-22e1-4c90-8073-c7830442c199", "value": "fde9e531e09739823526fc9ff4385a2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c802bca2-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320967, "uuid": "e02f4996-6333-4026-b624-f5d9103a580c", "comment": "Malware payload (Heodo)", "value": "374c14753e57cd27bd77895732441700", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320967, "uuid": "8759754a-eff9-49f8-94b6-bccc2bd489ea", "comment": "Malware payload (Heodo)", "value": "e02398e9df1b5e810e38c6f0b4e253784d40b89705180871c3f4152fafe45097", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320967, "uuid": "1a59b6ea-df7f-4d3e-b6bc-7418b2beb8ce", "comment": "Malware payload (Heodo)", "value": "1daf630e6377bb2d149f841982cece951cd57b3b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320967, "uuid": "e4bfe4f9-3734-4d2a-8205-4086282e8b0a", "comment": "Malware payload (Heodo)", "value": "494060aeb935963cc2ffb60e3f643bcca568144b43f2d67a943985d76f32f3534c848890b535abf89be7d8b2c971d18a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320967, "uuid": "7408aac0-0780-4f46-b98c-548c93197689", "value": "T12823E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320967, "uuid": "41422a33-6113-4c81-9e59-88c07f63ee73", "value": "768:KqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:ZrVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320967, "uuid": "778f8127-1764-42a6-960e-278e167fa5cb", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320967, "uuid": "d84169e2-cd12-4f03-bfa1-1dc5bef966d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320967, "uuid": "94066acc-e0dc-48b7-baa2-42d8142f59a6", "value": "imedpub.com.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9ae2a6-9b1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646329776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329776, "uuid": "c81e6bfd-0b7b-4785-a828-779901323902", "comment": "Malware payload (Mirai)", "value": "1ae0a4b7079bf1c53e5a78a8ec8d81b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329776, "uuid": "d1e95966-b00e-49b1-8207-1673c0a2b605", "comment": "Malware payload (Mirai)", "value": "e05856beab512a7e0a8030ccd3a419e9c62baff18205d64fcd8049389c32ad94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329776, "uuid": "1b07e1a6-a46d-4488-a364-fca52c7a9647", "comment": "Malware payload (Mirai)", "value": "8dafd94fb8889fc3ab15d4524e7bc0e13bbb44f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646329776, "uuid": "e51557a2-2829-469c-b90b-44b530721322", "comment": "Malware payload (Mirai)", "value": "2baa32d705f06d63dfd2d505be8e722ef7a64febf45f580999ab54ff7503c3612d373dfe61f58d07f63573ca501deeee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329776, "uuid": "b6316ff7-2f61-4b13-af57-41e2536ee85e", "value": "T19C833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329776, "uuid": "84788fef-e7a5-4a9a-a0e2-0c707943976e", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCKdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JVBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646329776, "uuid": "9c67b059-f533-4ad9-89b3-ccf2c2450f9d", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646329776, "uuid": "86a958c9-f681-4173-b135-12baaf5db291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646329776, "uuid": "37572146-b160-48cd-bc31-7fba9ef23fa2", "value": "1ae0a4b7079bf1c53e5a78a8ec8d81b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149d01a7-9ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646294467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294467, "uuid": "cf301407-add3-4823-9a18-f66beef0859c", "comment": "Malware payload (Formbook)", "value": "77ac6d6bdb578589bf396717584c73f3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294467, "uuid": "3e13ee8d-67ef-4aef-a30c-2bdba4fa8d4c", "comment": "Malware payload (Formbook)", "value": "e09232babf7795817a084728b8e55cf1c2b7b626fe85377b6b26fbfaeba11aaa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294467, "uuid": "193151dd-87f1-4727-9ae8-051332a98d26", "comment": "Malware payload (Formbook)", "value": "6b74035d804ca1e80954c40aaa957e1b285e58e5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646294467, "uuid": "4af164c8-0198-4cbb-9b89-afb56266f245", "comment": "Malware payload (Formbook)", "value": "dc22bc767c00e2b9413bbcaf01e74f758205bd639d0636962f7c44f65caa322200af7d99f290a91381e7a828acd21ea3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294467, "uuid": "df296615-a869-4364-a7fc-613d8d23b3b4", "value": "T14414127CE2254B21F7796A3C7EAB1086100BDFB577334D5E281079F66AF3222F962418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294467, "uuid": "1587128f-eecd-4e6e-8c4b-8a79a8909ba6", "value": "3072:Sb6S/jo46uWl8lsjZa/SyQKeJfxU3t4mn9KQgayCwyxEz2ETR7XdzSJkW:AobuWl8loZX/Zot4m9KQgNTiEzN1d2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646294467, "uuid": "0042adce-28f5-4cc6-9f95-a0d67fac2dc0", "value": 191240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646294467, "uuid": "a902b3c2-16e8-4e73-ad3a-1db1d7c51ad0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646294467, "uuid": "f8186df7-7f4c-4ba9-b202-a68449c572e6", "value": "MV CHANCE-NOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc89dc69-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646295232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295232, "uuid": "657d49ed-f8ba-4d87-bd89-bcd24b197e58", "comment": "Malware payload", "value": "7425528ef97d8892a38428f15a6bd1ad", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295232, "uuid": "37f3cbc9-2661-437a-bd67-b9390bb5c24b", "comment": "Malware payload", "value": "e0c49d3b67bfe6ef62f596aa605ec73da7965babb6052ab21cf66135635d3b9f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295232, "uuid": "95e96a8e-2c74-446f-86f0-27c81c8e3edc", "comment": "Malware payload", "value": "21980e5587ed67ecb17e92a3153028bcb5e7c432", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295232, "uuid": "70a5c233-04b3-455b-bd0c-54d19387d160", "comment": "Malware payload", "value": "7f74ba3730de3a2db2f1a8a972c0054cc8028e3c97bbba1895ee71c41c60eb0a3e72dfc87a65232225364563bd17ae63", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295232, "uuid": "523e76ca-3245-4d52-9fe4-dae4654098f6", "value": "T14A163923B244653AC46A1B3B4937A6DC993F7A613A2ECC5B57F0488C8F375413A3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295232, "uuid": "ac40c2ff-138b-4453-b3bc-aa78f4746fff", "value": "49152:TAx3PKZF2m5dWGRsS7uNoTZEnwoi1btzoDk00RvsMaybz17/vTdrDln8TUbNk0y0:s3iZF0hi1btzoDkyMa817JD9GR0yYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295232, "uuid": "fc0fa459-1f73-4f57-9377-2e1f23acb122", "value": 4232704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295232, "uuid": "514e974b-1128-4113-8f9f-d2acd665c937", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295232, "uuid": "44ac7980-ffdf-4548-b970-4cb33cebd237", "value": "AcEndesaFact0303.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ca7e2f-9add-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646303565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303565, "uuid": "a96b5a5b-01ae-436b-a31f-6be287409edf", "comment": "Malware payload (Formbook)", "value": "164a87318101a9db9ef70b957107a371", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303565, "uuid": "bc9dca0f-11cb-4832-a15f-7e288e061cb3", "comment": "Malware payload (Formbook)", "value": "e12a81f11dc9f18aee908391ed7ffac58539725ec4a09dc40788081fd24def1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303565, "uuid": "c4a7d245-9949-4ff4-b3f1-abba1fe5a05f", "comment": "Malware payload (Formbook)", "value": "38a03e6db21901a70d5966fe2578adf4396474f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646303565, "uuid": "6aa5a652-faed-42a2-9e1e-d29b800dfb33", "comment": "Malware payload (Formbook)", "value": "81a27a2257fce1b992ded2202dcd7f0ee89eb61f8f65c262f5eaac192cb97f197da56ebbac9d8160bdcdca199b20cafc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303565, "uuid": "8245a4ef-0a8b-4b67-acf6-b89b64d6dfda", "value": "T14C55F003D4A96942E73CC9BD756325306B1B4D7B183F41410638A2F836939BB4E7B6FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303565, "uuid": "886e89ce-8484-451d-8fa8-0fb4f801e740", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303565, "uuid": "08b27124-7cdb-468c-9d38-13efdf287e63", "value": "24576:s+K/BxLbX/IKLT3PgLWDmsofESvPQJRfyxmyN7M/d0M0COjQ5ohbo1DmvzLATC:s+KHLhTfgSDtwmyN7M/d0M0COjQ52boS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646303565, "uuid": "9ac0bec0-0928-4eab-96a3-af8a9f8956f8", "value": 1349632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646303565, "uuid": "e0a7feaa-a9e8-4dbb-a5cd-a00bfeec2062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646303565, "uuid": "de180807-fdfd-4ec7-b409-eb3185b0c64b", "value": "164a87318101a9db9ef70b957107a371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a30cbd-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "82de362f-3d06-4bd3-8e75-5dbe83989513", "comment": "Malware payload (Heodo)", "value": "2e2473b0b867b510fbd9139c03a64092", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "c0c3c3c4-e84c-48d4-8246-a50c803c00fd", "comment": "Malware payload (Heodo)", "value": "e170da253376d6ea417bbb57fbc2e068f355459f5d3b1eb2d953d5afd39bdf79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "5a48cff4-a43d-4ff1-be8a-a03804c18291", "comment": "Malware payload (Heodo)", "value": "94ea4731ce0f589f2d78054a38f83446c4de0157", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265796, "uuid": "e8adbc33-6ea8-4903-9bc4-1f6c5cb16527", "comment": "Malware payload (Heodo)", "value": "407179fe33c493e878492c4922860cb884635226b20be3e0ea1cb5e2381f15af379b71263e2893f91853c0bddb87d765", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "7b1519fa-1e3e-4ecf-be8d-eb26068a231a", "value": "T103D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "07a96550-e98c-4650-81ae-59323896d093", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "4eca1174-4451-4a9e-a456-729b810f4d1b", "value": "12288:ZxpNJJJ2NHPoczJmOtIhxf3foRXIa5EPwvA:Zx2gczJmFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265796, "uuid": "4c23e515-12ad-471e-ada2-8b32837f5a58", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265796, "uuid": "271cd444-4fac-4c82-845e-0598997ef712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265796, "uuid": "0a1ac3aa-c053-41bc-ac38-18c789cee2ea", "value": "emotet_exe_e5_e170da253376d6ea417bbb57fbc2e068f355459f5d3b1eb2d953d5afd39bdf79_2022-03-03__000307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd09961-9aa0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646277594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277594, "uuid": "ddac0429-8ee6-4b91-9bf0-5ad60b76b2ba", "comment": "Malware payload (Heodo)", "value": "1797e744da87c20eeb3b5bb3c35e5782", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277594, "uuid": "a1f99b07-f485-4641-bc3d-13891ed2f0e2", "comment": "Malware payload (Heodo)", "value": "e19585668a86903d9fc0a6e14e681a0945bbd8b1c3285dd8399500b51e7fb410", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277594, "uuid": "c75e028f-eb14-4951-93f8-c32023d051fe", "comment": "Malware payload (Heodo)", "value": "4dcad0f7d7f53ecf38e8e43bc9d86a615a93626a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646277594, "uuid": "f14ba979-d4fd-4b0e-9dea-9c6f3162ffc6", "comment": "Malware payload (Heodo)", "value": "47d8658613e9451b4b63c0100f2efa36581a2c4ed867907941095e56ea6050e27f291db7e68eb5a93a21fdc5f3776603", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277594, "uuid": "6a4e9ec1-5c99-4445-b9a1-6ac84df9eb2c", "value": "T18923D129C560A81CC73E4C7582105AD272097906D9D9EB9A3585BB0C3FC2BFB53EF9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277594, "uuid": "0175a273-fd30-40c6-a742-c1e2af383cf4", "value": "768:eeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:VoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646277594, "uuid": "4bd3ff11-d290-4f10-8ff1-bb541187e52a", "value": 47638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646277594, "uuid": "6b457869-649b-4c64-8122-9e28967c7c1b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646277594, "uuid": "ebbdeb53-cfc9-4271-bbe8-cd852aaa9aef", "value": "Address Update.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0f31bd-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320977, "uuid": "93da6b45-e921-4b8f-b243-93d964576ecc", "comment": "Malware payload (Heodo)", "value": "d8548d350816def0172b9da07e25ccfd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320977, "uuid": "54776354-4752-4e39-a246-b7233b70eb60", "comment": "Malware payload (Heodo)", "value": "e1c3e7724e5fc6135b10e4cd6a64c5945ea6807e71624ef3d4b81e913a90b194", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320977, "uuid": "0fd4fdf7-1a90-44d2-959c-09344b9ec032", "comment": "Malware payload (Heodo)", "value": "73f995828733c84f43e9dbae329b4f8a8324fba5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320977, "uuid": "1594d228-98d8-4d7f-9ac9-972809bb7008", "comment": "Malware payload (Heodo)", "value": "3f5bebf9fe673dd4ff2adca72843682d6af69e5b8a8886f61848262a0fdcb4a44a53f814cd6aee17a28b62b074dbd5b3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320977, "uuid": "f46ed5e4-659c-4f25-8e2c-79740a53a7c5", "value": "T1B023E126C1706818CB3E4C7681006A92730A7901DDD9EF993199FB4C3B91FEF57AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320977, "uuid": "22a0a975-f3c7-4455-9666-e59aa186f005", "value": "768:KqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:ZrVo43DwtT5fTR4Lh1NisFYBc3cr+U2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320977, "uuid": "42a8ce15-b063-4314-b5a8-850519ff4f9f", "value": 46701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320977, "uuid": "cd57630d-fe16-4cc2-aa75-3960b49d931c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320977, "uuid": "3b9098c6-08b8-4e01-b32b-17867896bfd7", "value": "Insight Medical Publishing_4.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4645def8-9ab7-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1646287249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287249, "uuid": "8388eb82-f5de-4551-95e5-6ea9a129f45e", "comment": "Malware payload (OskiStealer)", "value": "feff5af028a4ae4b803c78b5d689606c", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287249, "uuid": "8f33d314-cf2c-4242-bf79-21d334431956", "comment": "Malware payload (OskiStealer)", "value": "e229a00da6f5a060901cd6a46c810039d9e5bda1c78b29e81d04f138d1ebfa8b", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287249, "uuid": "7c568398-9c49-470d-a1d6-7e8397e29b9b", "comment": "Malware payload (OskiStealer)", "value": "c3c81e46f5525d7ff3c7663febcb3070de7cfa97", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646287249, "uuid": "f504688b-df10-42f0-88dc-676f7a340e65", "comment": "Malware payload (OskiStealer)", "value": "12c60ce8e8c039ff24df9070f2b6ca12030192ef6c43cc37241d0f7200ca0216c3a09fd4a480e73bfac714d71df0f394", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287249, "uuid": "64d11af9-88f2-43ce-9dec-b03b716a5936", "value": "T19D04124B6412F8A1C9626CB8C5269015D284BA0CD4B5C01DA570E3BFBBF92DF5F97B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287249, "uuid": "982e8573-bfe3-417b-bcec-28a21a5b0b63", "value": "3072:xTFYRDyEsfM3jQ29jH2tYiUiL4z3o5q1mTBOQvqmL7VlaQutBguM/xSVFW6h+g1B:xTeRmoDNMRUiLqx1gB1xaBI9/2x1ngMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646287249, "uuid": "5b782e92-fef1-46a7-a9a0-e8e8739f6061", "value": 184221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646287249, "uuid": "0454b928-f550-4b39-aac8-d413e2c98ff6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646287249, "uuid": "7e32355c-421b-48de-9894-e0655ed81844", "value": "Remittance Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d66efa2-9b15-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646327687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327687, "uuid": "108f83a9-2f88-4fa9-9b92-8d42f892c210", "comment": "Malware payload (Quakbot)", "value": "4291469d4293c9168214ffc1d78a6b13", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327687, "uuid": "921d6e0a-d01f-40b9-b7a7-bae13a695be9", "comment": "Malware payload (Quakbot)", "value": "e269497ce458b21c8427b3f6f6594a25d583490930af2d3395cb013b20d08ff7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327687, "uuid": "e5b82759-478f-4ed0-a607-d89290474fff", "comment": "Malware payload (Quakbot)", "value": "7c237d5ad0899c251bd2c04244bda38f9345f7f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646327687, "uuid": "fa788fb1-e897-4215-ba74-fdc73b5e8429", "comment": "Malware payload (Quakbot)", "value": "5e837e19e628cba2507abdabc42bc939c1b244b3021f7cec0edbcbd19423e20bdb1dd54bb7695961a39bf25b55c02b42", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama163", "colour": "#3268D0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327687, "uuid": "d8822a7c-fdf2-4086-95f2-5f98f26047dd", "value": "T179B4BFB875146CE1E6BF163BC995ADE803762632DE87D8CE506477C709733A1FE1280A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327687, "uuid": "f57bacd0-dc6a-4bf7-86e2-a731d531627f", "value": "0383b6e78c7f005efbff386cee23786c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327687, "uuid": "9ec9d49f-54ab-4c42-8cc8-594b95d44bc7", "value": "12288:vnKiMBsfsXtxbohL+/JkjFbK5BFHGiIDwqJ6dYgH:vA6fevoVaJmFbeBF5IDt6dYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646327687, "uuid": "6197aeb7-281b-4f88-81ba-314cf0641ba2", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646327687, "uuid": "48364e65-0d85-42fd-842b-58c00fdb91c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646327687, "uuid": "5fd0d305-3be7-4ba6-a0b3-645702f3e131", "value": "9570151.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf6f04d-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "2bbbfe37-1a59-4e83-899d-a0dae0a25a6d", "comment": "Malware payload (Heodo)", "value": "26ab57ac7d22b0fafad26dfc36cc3553", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "51864c9f-5917-4869-9fe3-ec29a0f9cad0", "comment": "Malware payload (Heodo)", "value": "e272fc030adfda51b43a31d6fb35c13e6f0a8289bf8a0e883166f43d771feb7d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "512067c1-0d90-4b15-a459-ae2b4091c116", "comment": "Malware payload (Heodo)", "value": "1fcdb9cfd97d317e847816e8df82833b848aa361", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "eeec3648-7a14-4d72-b18e-f0aadf6cc686", "comment": "Malware payload (Heodo)", "value": "48630de3e38adfae4e17f2c6d3f53a8a53c23c78985625711cc42374de2bae257e256043865d453f0f5a858a45caf1a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "a6340ceb-b416-448b-bbdb-c1596f231c65", "value": "T146D41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "0134f547-bf43-4315-84f7-87eeb8750b2f", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "a105cb1d-ea68-43b2-9ba3-5287843f1922", "value": "12288:DjN/Z2wkRrA9CRDCBElAjHDsndSyHOrNvEP0Oua:dEHR+CRryfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265651, "uuid": "b4252f35-9674-466c-9a15-4c8bedfaacec", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265651, "uuid": "f82698cf-d6a6-4c59-bb5d-c2716cd45031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "cb707991-1ddc-4045-a632-cd83b2591a1b", "value": "emotet_exe_e4_e272fc030adfda51b43a31d6fb35c13e6f0a8289bf8a0e883166f43d771feb7d_2022-03-03__000044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0bd08e-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "11298911-9175-4e48-ac60-7b1279194bbd", "comment": "Malware payload (Heodo)", "value": "bd48a1f720a34c88dc28cace0f8e6d19", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "1f00d0ae-cfdb-49e2-b8f5-aad0f06a6edc", "comment": "Malware payload (Heodo)", "value": "e29b34bf27d40e8680df9bf6a2b11840323478553f9446e9369359d38b406643", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "7ef0e925-ae5c-4b0c-96b7-158ebc700d3c", "comment": "Malware payload (Heodo)", "value": "65e8ba73e72f1743eff5e1f23b6bf46f4622718e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "5e779c62-c75f-477d-a470-507334273549", "comment": "Malware payload (Heodo)", "value": "989665630c8d4dbb58621dbf17680078b434b7ce67e0504f4f11217492818212b7fcceefbcc1402c710e6d3a0a384db2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "6a4769b4-57fa-48c9-8f56-49e6f2b85639", "value": "T16DD41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "578e09ca-da7c-402d-8f70-426a82d5e431", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "08454549-e92c-44b2-977a-b9d09463c6d4", "value": "12288:DjN/Z2wkRrA9CRDCPElAjHDsndSyHOrNvEP0Oua:dEHR+CRZyfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265651, "uuid": "21c3ed1c-dd17-42b3-8b8f-8365186644e5", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265651, "uuid": "ef0b64b4-028e-4708-b549-b5df6dcc0fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "a74e6bf0-e717-4b5b-9c85-c4a2fb1d2908", "value": "emotet_exe_e4_e29b34bf27d40e8680df9bf6a2b11840323478553f9446e9369359d38b406643_2022-03-03__000044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5276a1f9-9a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "1466bbf9-ecf7-4889-86f6-d2fe27d584af", "comment": "Malware payload (Heodo)", "value": "f8a83cdc7586a0a4758eeb0b68cfa698", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "de8de15e-0d42-4778-bc27-79801bd9770c", "comment": "Malware payload (Heodo)", "value": "e2d387a8ba7b053b0c7f7cef4ed770017455a3d2e1114003659a038fc82affc0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "8f46c344-7ab4-417e-b900-40e1ef333117", "comment": "Malware payload (Heodo)", "value": "2a9762bbd6ef0f4982a26070d381925fa7ceafad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265794, "uuid": "e4009a04-8c97-4def-a9fc-e611d9e09a19", "comment": "Malware payload (Heodo)", "value": "474c3dcff8a228e47fed6f92378840a84f168222f46b4db210670e97ec5a787123cd610910994e83d61c4724812c0a3a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "e6026e1f-91ac-4d58-9566-8efbe1395efa", "value": "T130D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "be7480c4-7143-4892-8556-8e0a3a387145", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "ad687250-db80-4260-96bb-e5c4722a3f5a", "value": "12288:ZxpNJJJ2NHPoczJKOtIhxf3foRXIa5EPwvA:Zx2gczJKFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265794, "uuid": "e777d280-1041-4bdf-bd4d-b7eed5df8de0", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265794, "uuid": "b16a97aa-8101-4604-b961-ad83ef356aeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265794, "uuid": "0cae64ee-e3df-44cf-b40c-075f374afa58", "value": "emotet_exe_e5_e2d387a8ba7b053b0c7f7cef4ed770017455a3d2e1114003659a038fc82affc0_2022-03-03__000304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8295eff3-9b28-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646335883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335883, "uuid": "cffcc55f-bc00-4040-8b0a-f4a90f5008ac", "comment": "Malware payload (Heodo)", "value": "0d155d94b0ccf42c7849871edadcac0a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335883, "uuid": "2a754bfe-adba-47b8-974d-1fe086a65dc9", "comment": "Malware payload (Heodo)", "value": "e2df99ae8560da9d42b251081e426f7dc96899bb20493b32b21986acf8141e51", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335883, "uuid": "4022cb31-3012-433c-900a-325eeba39613", "comment": "Malware payload (Heodo)", "value": "15db4680ada1d0aa2ca326fa13dc3a21a09c954e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646335883, "uuid": "031f8809-a1a7-40c9-b411-c1824b0e3ce8", "comment": "Malware payload (Heodo)", "value": "6ac4eaee06b3c170aed4061cd3a7c2af4f7ec64d2b7395985a5a32c64cd65bccb406aa7f8a65de50914278235ebe8a0b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335883, "uuid": "e8e1abd7-20a6-4ad3-b5d6-ffa8fef86566", "value": "T178D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335883, "uuid": "113aecc2-9c52-45a3-a043-02820ef9f1b1", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335883, "uuid": "e38f267e-103b-479b-ab62-3a0f53c0e92e", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLtCjzhmD/bwb1r8Hc:Bg4IqjYTt20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646335883, "uuid": "bd9735c4-e55e-4ce7-adf8-c3f9713aef8b", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646335883, "uuid": "4f545d39-14ad-43a2-a494-4e9721382161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646335883, "uuid": "7c9b854c-96c2-4572-8420-1162b6ac635e", "value": "emotet_exe_e4_e2df99ae8560da9d42b251081e426f7dc96899bb20493b32b21986acf8141e51_2022-03-03__193117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89aa6df-9ac9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646295279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295279, "uuid": "61da88b9-2503-4281-ba48-fc110f994788", "comment": "Malware payload (Heodo)", "value": "3107c9b2e3e5c744d1652d7590b79af2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295279, "uuid": "41ed3fa0-1427-4e3d-b269-02234e253abc", "comment": "Malware payload (Heodo)", "value": "e36566c4c81906590a8babe644fb1102bd14556c39f178e6eb21d0ff2eae98de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295279, "uuid": "84defb45-5c2d-4a12-87b6-2f0fac3af103", "comment": "Malware payload (Heodo)", "value": "2d489d07ede76a1022463716764941664807690a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646295279, "uuid": "f3ce5e5d-3703-4ded-a9be-d5aecfced442", "comment": "Malware payload (Heodo)", "value": "240e349bb5769846d544e5e9c55ad5569ab0f5112156393b22f1ac1c4b73a0f4d1d5c3716def90fc88b475703e10010e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295279, "uuid": "156a4181-1012-4fea-8cf4-da735c2a7fff", "value": "T1A9D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295279, "uuid": "d6cbd294-cc50-46f1-927d-3807f7fb1192", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295279, "uuid": "7a8efdf7-42ea-49b8-ac87-2a225225c55c", "value": "12288:ZxpNJJJ2NHPoczJ7OtIhxf3foRXIa5EPwvA:Zx2gczJ7Ff3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646295279, "uuid": "63acadd9-b1fa-4f22-be4d-16cdedf6adef", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646295279, "uuid": "3b2c9705-824d-49b8-be8c-3a22a35aa85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646295279, "uuid": "e6215f58-b38b-4706-b1f3-74a1ab54fde1", "value": "3107c9b2e3e5c744d1652d7590b79af2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ee7c84-9b29-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646336263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646336263, "uuid": "94c87335-211c-4f5d-9b8f-d33784d54077", "comment": "Malware payload", "value": "0a169c6fa4c4af9f6d158e6d13b7573b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646336263, "uuid": "9d4f38b0-ae50-41b3-ad19-bebe4995e17e", "comment": "Malware payload", "value": "e3a7dddeffaf52026cd3ac1858014ad7dbe458c45645d638e242f4e2e3622887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646336263, "uuid": "f60427a3-c495-421d-a1bf-34dda241960a", "comment": "Malware payload", "value": "921dfc3ce22ee9551548e361568c1da4f792b823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646336263, "uuid": "2485797c-5a2c-4e44-876f-e3eadcddd4ef", "comment": "Malware payload", "value": "eca7243366ed071c8a457b1a1995c1cd606b46aad091b26651e4e586f5df64510f99e448e754e6df067da271fab5babb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646336263, "uuid": "e6aa4049-5a34-4ebe-b1b3-13315b303318", "value": "T14B052300667CD883D9A60770D6B98FFA2E6C1C2ADE74A70B5204BF5DBA726D0442DB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646336263, "uuid": "5f755a5e-c5ef-4103-9825-92e3dbfefd23", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646336263, "uuid": "0d1b6413-353c-4c2a-942f-bb1d5cd33f24", "value": "12288:rbEFDaO6qtpigx1KaCpsrs3x7Mu24mic3OYtvF9edHyX3hDXMaIRD4OJz/fiNkzz:rbEFT6q/iq0U4x72eCFMyXV5i7/fff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646336263, "uuid": "3bd2fb8c-eeae-4978-8005-5c0913e1a551", "value": 812464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646336263, "uuid": "5e70a84f-146a-48ab-92d0-f946d401c078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646336263, "uuid": "247bab33-9850-49dc-9f8d-e90d6f89b9a6", "value": "recibo03032022pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f26e97-9ad0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646297954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297954, "uuid": "ba66abef-71d4-4c2e-bc05-1feca2750598", "comment": "Malware payload", "value": "232ba68cafaa958370a3f70e0733ecce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297954, "uuid": "beeeadbf-9df9-433e-aca8-0f2a3c9f5b1c", "comment": "Malware payload", "value": "e5c8b0b5f96a56f408013a18b23951f0b2c6322081edbfeba5febc50c35f131b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297954, "uuid": "002de04f-94d7-441d-a951-decdd0714e6f", "comment": "Malware payload", "value": "fac9b8ec21a58480db65cc5f53f1e664c6e4e779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646297954, "uuid": "4b725224-c871-48ac-a9a0-76141d422f75", "comment": "Malware payload", "value": "f1fa769f71b86433f41a6ed7b452844601b6152c6ffe0247b72a71db50c76ec77fc5c737e46e811ec26587b04fbb50c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297954, "uuid": "4c5aee1c-018f-4ddf-9064-efaf98c51a94", "value": "T1BE23B89663898AB2D7290678CC27D9B44A746E75CC02732B57E4BE1F3CB171BF50A20D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297954, "uuid": "8f10fce2-e5b3-4cbd-a830-391bb083a466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297954, "uuid": "915c4536-a55b-44d6-bbf2-2a097e9d666c", "value": "384:c5DRpIzCzNEhVd6z6Iqf+trg0Td+/dkI1Nz+qQi2+mg5wgRUEO9Oufano5wACtQw:cFvufGkTz+56wgnuYotCtGB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646297954, "uuid": "6503a399-46b5-4d4a-bc44-2cfb71b8e7fe", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646297954, "uuid": "7ab7219c-1877-4c22-944c-e1134361b450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646297954, "uuid": "56418d98-1f3c-47f1-af8b-0fb55bca4fb7", "value": "232ba68cafaa958370a3f70e0733ecce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48662f3-9b05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646320988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320988, "uuid": "dd24e8a7-eddc-4a41-a826-fd1e138a5b9f", "comment": "Malware payload (Heodo)", "value": "7f948a19a7c0dc3d0cbfb52ed70b5890", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320988, "uuid": "38fdbf86-c7fa-429f-abeb-6b0712213e1e", "comment": "Malware payload (Heodo)", "value": "e5f5264d77aa9fbb200086086af64ce647b1d79a3fa2b717eeefa8b9f738a4b0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320988, "uuid": "cdc9439d-cd9f-49a6-9048-a1d2987ce54c", "comment": "Malware payload (Heodo)", "value": "3b5ab746c8521cd43f4f0cf13fe888dc5189c019", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646320988, "uuid": "9265a18e-814e-458c-9329-0421e8609508", "comment": "Malware payload (Heodo)", "value": "0705740338efbb289b420432c3389af070a79fb305566c167a7fa847a8c937203373faf469694b59dd845b17b25751e5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320988, "uuid": "6b9ce93a-8113-4bdf-88fc-58fd26059cb6", "value": "T11B23E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320988, "uuid": "07fcae94-800f-4315-9d01-45d5f6bb54b2", "value": "768:O/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:O/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646320988, "uuid": "04673053-985b-4eb5-9ad4-1048029dd12f", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646320988, "uuid": "54a38dbb-93f3-4013-bcd8-669ef191bdf1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646320988, "uuid": "4f1b5be7-5dc0-440e-8049-b273d0089783", "value": "omicsonline.net_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d4b147-9b0b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646323564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323564, "uuid": "e5c42bad-7698-4b9d-80d7-9cc4e7af04c2", "comment": "Malware payload (Heodo)", "value": "93f1fc4a8c3768769e2bfa4cef34ee4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323564, "uuid": "8b401746-6617-4d17-ad1b-ebbbb8cfc28f", "comment": "Malware payload (Heodo)", "value": "e60e3e025d395d0fbaf8744ff786882d93e662670358c1205aa6eac50312b6af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323564, "uuid": "eedd8ae0-56d9-4f2a-b9cc-032216123a31", "comment": "Malware payload (Heodo)", "value": "4ad7adbf94046f3d4229d451692036475f478e59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646323564, "uuid": "724d0478-eaed-468e-857e-dcde4aacc6cc", "comment": "Malware payload (Heodo)", "value": "1353724fd498cce9e7e1ce162c0bd2e0e173f60b70160e312be83b5497dd9eaa16b3f7b534aaa0197a91106925a8de61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323564, "uuid": "cf04e2e7-43a3-481e-a318-b03efdef9da4", "value": "T161353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323564, "uuid": "9b221fd5-8d65-455e-b19c-53c698c93ece", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323564, "uuid": "f594716e-1b45-4044-95b1-71d46601947d", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZ41EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZmytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646323564, "uuid": "d32c4b70-8c97-4799-9da4-d2bc96347b74", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646323564, "uuid": "377624b1-99a3-4c87-a803-0f40fa41c113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646323564, "uuid": "4870bd63-ff3f-4499-a6b9-b9f9da8ba001", "value": "93f1fc4a8c3768769e2bfa4cef34ee4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93915266-9ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646300263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300263, "uuid": "1ad253b7-214e-4551-97a6-924dd8b76f39", "comment": "Malware payload (RedLineStealer)", "value": "7d9abd6d967badd13c368ac48b489434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300263, "uuid": "a2f8ee7a-9bc3-465b-a8f6-0aee31e247a5", "comment": "Malware payload (RedLineStealer)", "value": "e628c99752ab3f0c27d4b95bd6917afefbb9e417faa7f6fc01d6001f73bd6a48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300263, "uuid": "80ad3c7b-faeb-42e7-a048-5ed7d54830cb", "comment": "Malware payload (RedLineStealer)", "value": "d1c783053b6423861f4943c3fae74924a65380f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646300263, "uuid": "d311a7c1-6992-4f59-a1e2-5ee6776da25a", "comment": "Malware payload (RedLineStealer)", "value": "d3497efa9b32b00d17784918f7bbadaf70376a2e3f56d5642308383de443371e4e8a1e55c4feef5e02c5408f827cb684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300263, "uuid": "5d51a34a-b91e-46b4-a2ae-16b57b9affd0", "value": "T126C423795D0FF54AF0AF8FF2B696E9030B95618768C2AE6547DC3BD3A428734770402A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300263, "uuid": "1c512b4c-95b4-4b5a-92f5-147684cb22b8", "value": "a46b056f1965aa9a62c3f21951e41446", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300263, "uuid": "25996fd3-cac2-4173-adc9-550ea1206348", "value": "12288:rxSi3aGlJIVSR9RYOIx0SkFK/lGRgOUqmq9kR6lhKXNLnLh02oLwFMX:rMUyVS5FIx0SkFK/cRgOnmq9g6sLh0fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646300263, "uuid": "25b6525a-f392-46fe-81ae-8903019dd24e", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646300263, "uuid": "6df7ebaf-abf9-4606-843b-0cbe2a41f456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646300263, "uuid": "f8de7e97-6c84-49fe-8fd7-af8a287e6d8d", "value": "7d9abd6d967badd13c368ac48b489434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cbac3b-9ada-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646302277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302277, "uuid": "58983393-94c5-4ec9-b686-8bc70b3d46fc", "comment": "Malware payload (RedLineStealer)", "value": "a4ad32dc5c0845a72b616ba4126b0a19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302277, "uuid": "850a1b31-bc4b-40c9-affe-7f10f1bed858", "comment": "Malware payload (RedLineStealer)", "value": "e64a65d3a69e8f73be9e412ea79a19b31f962fa2aa3adac1356f04b36a6dc553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302277, "uuid": "3118b3b0-5ccb-42a6-a31d-6b3de559b434", "comment": "Malware payload (RedLineStealer)", "value": "81006db8784c26f577279e4afa69706e5f5adeb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646302277, "uuid": "ed9b9296-3f3f-4eea-8553-c635570b7d90", "comment": "Malware payload (RedLineStealer)", "value": "1c8719e4d3e6660b7c329223c5b1b3213e3f936487aeb3a88e6430c80fa09382ec727e2ba6f7213bd56d6ff18795bab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302277, "uuid": "bb8531f6-0875-4409-9d22-2f7633acbdc2", "value": "T19DB4C43439FB5019F1B3AF75DAD87597DAAEB7632707E84D208103864A13B82DD8163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302277, "uuid": "e2e020fb-bd73-4fdc-aa12-b5fcd5ae91b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302277, "uuid": "d4a9ea77-299f-46e7-bb74-36ed469ec339", "value": "12288:kOpYCCoW1Tvzlfj/yArmNBFN4MClenKmWlk/fXm:kOpSVruWu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646302277, "uuid": "5f142860-b706-41cf-b777-719b194cc966", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646302277, "uuid": "10b34288-5c68-4945-9dc9-6760550c5507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646302277, "uuid": "5c13532e-34a6-46a6-98dc-648675fcec4b", "value": "a4ad32dc5c0845a72b616ba4126b0a19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0611cada-9b1b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646330090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330090, "uuid": "9e739739-696b-4271-984d-ae4aafe60173", "comment": "Malware payload (Formbook)", "value": "f0beaa7c8f49daf08ffb26f8c3d82c0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330090, "uuid": "5fad0a86-32a8-450b-a310-af11caa4e22e", "comment": "Malware payload (Formbook)", "value": "e67cc534268af81a2d8a0393215542586fa7b17581ddfacda7c2f8d0e44c5e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330090, "uuid": "37c58b19-1cd6-4d61-b60d-22d93d9d7b25", "comment": "Malware payload (Formbook)", "value": "93cc06ab2462c14e82c7399cab1e6019c64d70aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646330090, "uuid": "cef26fa3-fed6-4bde-90fe-112338417c20", "comment": "Malware payload (Formbook)", "value": "d3a21e0d0ad211a3815a5226d9540fc204e51ba41a69e1afb318113cbf7b30a59dbac35fac6d8dce23ac15b5e53a37d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330090, "uuid": "d2de26af-6652-4321-976a-bceac1b72b94", "value": "T14274235896E15B23DA826831567B7AF8C3B6F2CC47E00B5F4B942FFE6C1358285C6349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330090, "uuid": "eeb479d4-f9ce-4d22-9010-179962d2e0b4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330090, "uuid": "e151b1e1-aca8-4a77-8399-a39ed1eb730d", "value": "6144:rGiEDoOy4C4kGThZh6yZ3eARyothlfh8O0swKhdlcpV5HBc+mI0tOvH:4DoOy4C4ksN9ee9hlGOSpVdBc80tOvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646330090, "uuid": "2b63ebcc-b344-41c5-9a35-d7444f9966a6", "value": 347056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646330090, "uuid": "296f23cf-a713-4f72-a17a-2ca8b0208095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646330090, "uuid": "a16e8e38-4f86-41ef-854f-5aa8051243e3", "value": "PO-4116309989-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c30d2c-9b08-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646322329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322329, "uuid": "05a32722-28dc-415d-b2d1-d6bf685f33c5", "comment": "Malware payload (Heodo)", "value": "bc73dce0a2fd2194554bb0acdef692e7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322329, "uuid": "94e9b7c4-6ce9-42c2-b926-d3344bd23662", "comment": "Malware payload (Heodo)", "value": "e68749ea1bd46e1273b4ade300e2b6afd2a5fb2236fea1bc83ad032b05456c28", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322329, "uuid": "78a9d680-1d55-47ce-bf32-e27ee7d9ca5b", "comment": "Malware payload (Heodo)", "value": "1ae9c7c1edfbaec8d04d2f795d74f7a811300af8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646322329, "uuid": "d3a3e986-0f14-4478-90cf-c31b2290f319", "comment": "Malware payload (Heodo)", "value": "faab449670c837853eb723fafb1aaa7b7e8dfb95b8e082ddd2764e97a693ec8cc325993081248385e893272e5b193e6e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322329, "uuid": "4136d198-f2f4-4d27-a594-d0228bae49e5", "value": "T1AC23E136C1247828C73F4C3652007A92725A7905EDC5EB9A3185BF0C2B95FAF53AE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322329, "uuid": "9ba8a41b-e4a7-4e1f-8f55-f356b3706c3c", "value": "768:6/oODOevZCwrvtt6zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U24Z0y:6/oODctT5fTR4Lh1NisFYBc3cr+U2Un3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646322329, "uuid": "c3746edf-a07c-44cc-81ad-3e38bf64a33e", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646322329, "uuid": "7ec69050-97dd-47fc-801a-c098d76fa6d0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646322329, "uuid": "8db81454-6e3f-4df4-8dbf-3dc4d0f19b00", "value": "IhreRechnung 2022.03.03_1548.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e9ac2f-9ad2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646298817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298817, "uuid": "8a24a447-7477-4da5-8e44-d920f348f343", "comment": "Malware payload (Heodo)", "value": "01649ebc208f31d3979ce2a6a6397be9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298817, "uuid": "88a3fe74-107b-4a4e-99dc-fefcc39a5b15", "comment": "Malware payload (Heodo)", "value": "e687ff436bace3f975a86502e59469f1d9b50c1bd6135305efe05696c9943538", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298817, "uuid": "85e7832a-c04a-49fe-8a46-61670ba1b3a1", "comment": "Malware payload (Heodo)", "value": "41b8edc67992d2441bd01d77c0bf35e6b7442abe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646298817, "uuid": "0867343a-310b-41b2-82af-6ec72fe06978", "comment": "Malware payload (Heodo)", "value": "6cf25dfecf09af307e99dd1c8891ab179629d87a3eb7c429a048ba89590774e0aa7442dc17146d1439643526a0300313", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298817, "uuid": "e467191a-c265-4dc3-8da1-6e31bd08ce64", "value": "T16F353942BA48C5BDF04E08B9181EAA69667E1C447B3296D7338C7FDDBB319F90832517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298817, "uuid": "1b9a42f9-58ec-4cb7-ae5c-b0c988be5451", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298817, "uuid": "fd306f32-90fc-4804-81c0-02356582a6a5", "value": "12288:C4rjnpAeev7HmOsVUCfbWierRcDFtLlirkf/csMEPe6MpPfXxiDjM+R:5rjpAbv7HmOsiR1cDFXiQf0sUPv4DjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646298817, "uuid": "638889db-165f-49ad-91d1-e28a13494c86", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646298817, "uuid": "f9b21d98-e5b8-4830-af84-75e02f2a323e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646298817, "uuid": "7bf7f20d-e59f-4e84-9cd5-bf8a903b5c17", "value": "emotet_exe_e4_e687ff436bace3f975a86502e59469f1d9b50c1bd6135305efe05696c9943538_2022-03-03__091332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03334b2-9b3b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646344120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344120, "uuid": "c2113c4d-48e1-4e62-9a9b-9338fced80d9", "comment": "Malware payload (Heodo)", "value": "1dcf775414ef00c96c7543d5c107a554", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344120, "uuid": "9eefee07-3877-406c-906e-ccb973ba4c0b", "comment": "Malware payload (Heodo)", "value": "e6c5391d60b15c3dcc7c5a80265fea2ca176ac17ac29cd00235c7a664347c90a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344120, "uuid": "9f7b2f90-ad0b-4fb7-a05c-cb5ed3589f58", "comment": "Malware payload (Heodo)", "value": "8f820c22681f826993bc2c4c981f6f0c8f7179ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646344120, "uuid": "44afd474-b545-4c82-be12-bc2ed6214c0d", "comment": "Malware payload (Heodo)", "value": "f7511d0a26949fba3c10360425dd165b0f2d85fb7ce2bb5d335e377db2a05ff360698a8d8362894887334b5a8c821108", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344120, "uuid": "65705446-eb8d-4d4b-94c5-309c3616b103", "value": "T181D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344120, "uuid": "95da3e52-d30b-4458-a1a8-b251a761f606", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344120, "uuid": "8dd2094c-a905-4ad6-b85b-f3937e04c8f1", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRL3CjzhmD/bwb1r8Hc:Bg4IqjYT320D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646344120, "uuid": "c0441663-ddd1-434e-9c94-3741d8b061dd", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646344120, "uuid": "052ec5cf-8016-46a5-913b-631af8f1ccc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646344120, "uuid": "b26a0033-2d46-47af-9be0-8bd600bf5d37", "value": "1dcf775414ef00c96c7543d5c107a554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd44657c-9a84-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646265651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "a04b4168-3aab-43be-ade2-51e7538f2489", "comment": "Malware payload (Heodo)", "value": "f0f95a361660dd8700095e8e05f1a5db", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "3bf1e3d1-5478-46c4-8e84-f9b66ea2d4dc", "comment": "Malware payload (Heodo)", "value": "e717035585dfb2c3741e7cc0b45b175afc3969d35077ca9525a953716d347d0f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "29d2afa6-ba3f-4572-b290-27587e5213c1", "comment": "Malware payload (Heodo)", "value": "85aea9b5905ef441623253a3fd0a96ec99fde509", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646265651, "uuid": "16632bf9-b7dd-4a78-993b-1620e999991d", "comment": "Malware payload (Heodo)", "value": "ba34d57d58b808336c3e9f4d662f00fcfa811e00c3c0703811bd007593b5add578475b9b3981e379b31328287c416c79", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "ec5b666a-d270-465d-977a-c139266e42c6", "value": "T1F7D41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "91516630-df09-4dd7-84ea-8b49417eb830", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "5b5471b1-c7ba-4653-98b4-60dcda0aadd5", "value": "12288:DjN/Z2wkRrA9CRDCIElAjHDsndSyHOrNvEP0Oua:dEHR+CR0yfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646265651, "uuid": "ce5059b2-8e50-4ff0-8887-d28b4c798c8e", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646265651, "uuid": "c477a6ec-f147-4930-9950-fdc09d387650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646265651, "uuid": "3308f940-606a-4c48-808d-b30de98f1001", "value": "emotet_exe_e4_e717035585dfb2c3741e7cc0b45b175afc3969d35077ca9525a953716d347d0f_2022-03-03__000046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d93063b-9b42-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646347015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646347015, "uuid": "b250e045-373f-4f6e-9c8c-2f5fbdf3edaf", "comment": "Malware payload", "value": "9f71fdb83fe1dfcd15db9556d9bbdcf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646347015, "uuid": "42936f2e-4610-4bb7-a221-d2548a59aa60", "comment": "Malware payload", "value": "e745791e3faad64dc3c475e87b458ac60853d5ca429a32b812c6bacbc841ef99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646347015, "uuid": "cf494066-f4fd-40a4-abd7-6c586d437ff9", "comment": "Malware payload", "value": "5bf6a725c3d716e8c5321f3b99634d1436b610bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646347015, "uuid": "35c09075-e266-4876-a1fc-49d5142045f9", "comment": "Malware payload", "value": "8680d1d4633a928ebc66ff98d180e2bfc8ebb3ed8bbd35504ab10af1d8ce1c9e7f783309cb09ab6b28af252ec4cb69be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646347015, "uuid": "4687e5da-2202-4315-90c3-f1b921367c00", "value": "T1B205D00438E68034F97A8BB1DEC4E7F09B2EF225E149B0F654105E157646BBE8949EFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646347015, "uuid": "49b7729a-84c0-4078-b3ce-b510ed5dcb45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646347015, "uuid": "cecaa2e0-9b0a-476a-a794-483cc458966e", "value": "24576:ANXGFprbH5APmsw3t7z9GzV0SIqQ6O+W:OGFBbZAus+59+V0Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646347015, "uuid": "5f020609-17da-455c-9b12-e3f2d19481a5", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646347015, "uuid": "657b09c9-91d5-4e73-aa22-8c9fa8224ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646347015, "uuid": "868f20af-2fa6-45d5-901d-33c9e4ca8e88", "value": "No. STB42020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9a1889-9af4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646313403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313403, "uuid": "6d156de4-9538-422d-852f-42610a9018b6", "comment": "Malware payload", "value": "24f228413859f623c16f5652ba52584a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313403, "uuid": "1edba774-37f4-430a-8551-a10f832f1cc8", "comment": "Malware payload", "value": "e8a77687cfa32d0a0492f43ea9cc76e52d888226ffd39fdcf7694f94e838cad6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313403, "uuid": "df70cb29-277c-4f45-91d1-866dad0fcfba", "comment": "Malware payload", "value": "8174312802249bca5ca582a6345a9635825b1d83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646313403, "uuid": "b6005714-7ed1-4342-a030-dc4cd4af318c", "comment": "Malware payload", "value": "c984af4e6dca9b619ec5f39e9f2dc2a55a5e098628d7f1d8241caa917b179c4f230dc1b20da632ce0a2a8560e1c2457d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313403, "uuid": "2a420319-822c-41e8-bbde-abcdc4f187b5", "value": "T11784220E3BD1C4DBED166F7227B37706D7F68D200210489B27560A7EE9A126B0F46D8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313403, "uuid": "c811e9b8-f1b2-41e3-b47f-7c8179be378d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646313403, "uuid": "04566494-ddc6-4c79-9122-3850a0db261b", "value": "6144:owzlNEivhFV3porZLJcMmHnbnBga11K/GuYlqLif+YE1SA/CjE:3PvqrZLUHbBgmK/PLS+T1SLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646313403, "uuid": "8c68059e-a1c3-4086-99bd-d3f99613a873", "value": 381744, "object_relation": "size-in-bytes", "disa