{ "Event": { "published": true, "date": "2022-03-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-15", "timestamp": 1647388981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "52930437-515b-471e-b492-dfd1f478d5c6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3febec-a465-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647351498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351498, "uuid": "8c0f00d9-d778-481b-83e0-1d1a9e423bd0", "comment": "Malware payload (Quakbot)", "value": "eb57f8cd71e9945a2f3f9c567bd3c95f", "object_relation": "md5", "Tag": [ { "name": "pwd TW4565", "colour": "#9D497E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351498, "uuid": "b3447c82-9bdd-47a3-b75f-e26890796263", "comment": "Malware payload (Quakbot)", "value": "00412b7f1271b078c983e7803bdb860f12f77679573edde045617765a1fb80a9", "object_relation": "sha256", "Tag": [ { "name": "pwd TW4565", "colour": "#9D497E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351498, "uuid": "f521bcae-3933-42e7-b33d-1bf12a4250c9", "comment": "Malware payload (Quakbot)", "value": "ee4bd7f5a6640c69f11e2fee3782e5ba8507d144", "object_relation": "sha1", "Tag": [ { "name": "pwd TW4565", "colour": "#9D497E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351498, "uuid": "6ee852e4-c7eb-43d6-8a94-805b1d14ddde", "comment": "Malware payload (Quakbot)", "value": "0197f67fae7c1b98ac52a92ba22be119b147c54fecda91720e8c5ab6e24b729d244b25f1db9784b4d6d7c547a0e68afd", "object_relation": "sha3-384", "Tag": [ { "name": "pwd TW4565", "colour": "#9D497E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351498, "uuid": "c3dfc9b1-dbd4-4c0c-b60f-7c23e4709f00", "value": "T156242315E6E1C39197848A31189E8FE4905C2BA82AE03EF48C78595812FD77FBD1DE4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351498, "uuid": "26b63709-5fda-4215-91ba-2599a0350785", "value": "6144:2fgcNLl2JdscPGm8W9CBBQF73KQGuYu5mmNBqFeZfp7:wj+Jdscj8C73KkYoMG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647351498, "uuid": "d06f4adb-01c7-4726-9855-a8895a906126", "value": 223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647351498, "uuid": "af0dd521-9b35-44d1-8a5a-5cc6f755479f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351498, "uuid": "cd8a8a88-ffdd-4d11-b162-790a97140640", "value": "atmodets.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4dcb5c-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "93bd29b8-5c26-4d11-9d25-236a7ac5af6f", "comment": "Malware payload (Heodo)", "value": "724d5e8e2c9c0ca3ce7802f362736622", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "f8b76528-4d82-40d9-9585-550ac5965246", "comment": "Malware payload (Heodo)", "value": "00735fd872d7b3bf8789aaaf9d11b6acd92955213bd7057a4f498db5c12980c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "87a899a5-15dd-433a-86ec-ec618acab34f", "comment": "Malware payload (Heodo)", "value": "5f7e0f2078aa85ce176a11fac15104c12e18c03d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "961bd722-55b8-4b99-ac47-d99b73d8f83c", "comment": "Malware payload (Heodo)", "value": "f844bc47ed7160feb45e264217e9ee82c57cf910b49bffae9ff12e095569dbe73ef5bdeb94ab33cef5d6d8de96514bb4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "7d41649a-b02d-40d5-822e-55c7d3d7fc15", "value": "T12D256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "671559e8-6536-4ca4-b829-e4546527d6db", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "91874b4d-9f79-468d-942d-c9ee2513cf56", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1uWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6QWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302836, "uuid": "d14c5869-9513-40a5-ac47-b04aad42589d", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302836, "uuid": "e7130081-82fe-4e44-970d-8dd7129c4142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "9a83177f-63c6-46a6-9cd4-4e3cbe77b4ec", "value": "emotet_exe_e5_00735fd872d7b3bf8789aaaf9d11b6acd92955213bd7057a4f498db5c12980c1_2022-03-15__000706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be9862a-a450-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647342478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342478, "uuid": "ff0a283d-d7d3-4d42-889d-ece56412c4f0", "comment": "Malware payload (AgentTesla)", "value": "58853cc0217f4a41cb431862fc25a79f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342478, "uuid": "8f4e434a-7924-494f-82c9-487d6e30b445", "comment": "Malware payload (AgentTesla)", "value": "00ba32cb7e0f1aa7dee8d476f579c8390343e1952d1c9eefd4bb973508d1f0be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342478, "uuid": "eb267068-2185-408c-a483-8d033e60b468", "comment": "Malware payload (AgentTesla)", "value": "1c6a43a25b4435387e73f03317c782d5082910ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342478, "uuid": "944beee6-b190-4f4f-be3a-b3ebffe62b98", "comment": "Malware payload (AgentTesla)", "value": "941424d4cd6a87b4829284a13a760921d0677b3e327cf20af792d76770aec3264918d41cb6f30cd63d235f49f9cba089", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342478, "uuid": "d1a0036f-ed59-4281-81b7-e69648e219d3", "value": "T1AB25DFAC32C4799EC663CE76CA642C14EA31B07BA717D203914705DC9A5DBDBEE112E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342478, "uuid": "ab43f6f8-a725-412b-8772-b9dd67a94e80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342478, "uuid": "a0f2fb85-5f13-44ae-8a03-49de5d50fa11", "value": "24576:3sPUwOB/8r5GY0qCMMVg8fABA9NnI8BzS8Elzq:3xfBUr30qC5g/8IWzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342478, "uuid": "397f9559-d269-4591-b5d2-68b8f5cbe227", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342478, "uuid": "ba77d19d-8fb8-4dc1-9a4b-0e56fafcd449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342478, "uuid": "c7cb90f9-db87-49b3-9ae6-33a0f22659bb", "value": "Ecolab 1503-220010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a8c7d2-a488-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647366620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366620, "uuid": "0c97cb0b-3508-49f5-a72c-10e99a002b15", "comment": "Malware payload", "value": "1502c16dd62f2fd9092cc115ca514ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366620, "uuid": "58ca7f14-b591-490e-9c99-9f1e507b3dd3", "comment": "Malware payload", "value": "010c12e1e63eaf97585fd0d8abcb349cd9e515500ce16471c29b2877de276cb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366620, "uuid": "1faad4d2-511e-46ea-af96-e39360de478d", "comment": "Malware payload", "value": "a8cc7186b91acf4519e52eea0bf19984f6d2f188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366620, "uuid": "fd4abcad-ceb2-4fd2-9a95-8752aebc0868", "comment": "Malware payload", "value": "3db5709e416073ee50817be702d0def18aeb2ca8c95b7321f713caf50b695012144b9e3dd647d361398c4b51d06264ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366620, "uuid": "40c0746d-d9bb-4b28-b1a0-7a612983f2df", "value": "T16DB402718FAA0062C95BCDFD8090553B9562E0560B37AEE3085679FD8CD57EB22F24E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366620, "uuid": "a78bc1b5-2403-4d81-9433-77b71496e0e1", "value": "12288:QTWL0exBq8n9k2OwgeszYdmhxtGhujaRdFhXz:mWL0eKRwgeszXXQh0aRdFhXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366620, "uuid": "98de94ae-0d4e-427d-8e5c-b7b41250303d", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366620, "uuid": "88e2c50d-631b-4973-a669-3ade0782e306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366620, "uuid": "89f61ba9-f3ab-4694-9a87-39d36d051523", "value": "010c12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5763035-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333770, "uuid": "00a7ada6-9f14-4c46-8bd3-d2ce3276559b", "comment": "Malware payload (Heodo)", "value": "4570da818a476e410e3b1634b13753bb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333770, "uuid": "fee0c95f-78db-4c4e-b007-18bfaed01bf1", "comment": "Malware payload (Heodo)", "value": "016c877d5bbbef94ceab249d7429c7ee47498e0e2760dafe918b1969767974e8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333770, "uuid": "2751d6b7-3e92-4eba-a465-39a2ac335128", "comment": "Malware payload (Heodo)", "value": "80e6270a1386ec7a3537bdc4d1fcf3698f4f9252", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333770, "uuid": "5bc362ae-cead-4b68-9636-f3a7bb81e2df", "comment": "Malware payload (Heodo)", "value": "2cb6cb455257c38c9aed8f6f524e3bcf8c36fc8b420c68c8543bbcf83251fe4c2ae98a303aa90697fc076b4e03beb2d1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333770, "uuid": "fa313fea-4365-421f-9838-caaff56c996a", "value": "T1EA73E11EC522E19DCB2700BDD2CF4FEB948F75153AC0E47A93C0E94D2B4895AA74E64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333770, "uuid": "258844fc-5629-4204-a963-2ab8dc9a8fec", "value": "1536:qS3FXUcSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM7VI0E:p310tzSmICpH7OZuvZGsMnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333770, "uuid": "0f2425c9-5fe2-492e-9013-d0d5282a7ecf", "value": 76170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333770, "uuid": "6ffb4367-0e13-406c-8fce-6d1d244878c9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333770, "uuid": "a22ecfbe-4f21-4db5-875b-2c02361300ce", "value": "72.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aac6753-a488-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647366635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366635, "uuid": "25c6ab4d-b018-4a1c-aec6-c0d922b2dbc9", "comment": "Malware payload (Heodo)", "value": "13e8797f46be7eb9dde8471b33ae40fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366635, "uuid": "091bef1a-7f8d-4bb8-bd15-defc9c1752d3", "comment": "Malware payload (Heodo)", "value": "0192c1806e4b2a34701c3aa4381bb25fb1048eaf4550da341b0f41857d80c82f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366635, "uuid": "17a38ec4-38f4-42ae-aa72-0130a8a2d5d7", "comment": "Malware payload (Heodo)", "value": "30aee5fd3925f1cb51630cd0391a5b92a08e84c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366635, "uuid": "8bdeabfc-9656-40f4-b16d-5c9c0670659f", "comment": "Malware payload (Heodo)", "value": "b5dd68fbb4c500ed5bb288dd5923e4ce6e41af0cd45b29eb131e58e5b71d3216c69424b7a5fae5ea37a66c44b6c28691", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366635, "uuid": "3db37f6f-b06f-4732-be2a-58c047841e6d", "value": "T1DDD46D13F123E4F6C0D715758A11632092AD7B669FF7E8F2FB78E51C2A24093A735A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366635, "uuid": "c229ae86-c33b-44cc-8d7d-4f97be64319a", "value": "20e817a5abb68c6cd46e7e211273f8bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366635, "uuid": "218d79e8-2d10-4117-9f9d-f9a231b7089c", "value": "12288:xJmJ6J4hBJbczkt85joskU02CrwuXScPi:bm44vMtoU02CrwySH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366635, "uuid": "ba554707-13cc-4ce5-bb43-4e6408c93062", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366635, "uuid": "0acf3758-c3d9-4802-89e0-8a52a3dffc23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366635, "uuid": "5a6d27bb-e8d3-4121-962d-180c20adbe81", "value": "0192emo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a8b053-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326173, "uuid": "1d018986-0f83-4ebd-b726-abab9ba4356d", "comment": "Malware payload (Mirai)", "value": "a6c26fd21e24c2a044bbef0c7eaa779e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326173, "uuid": "4dd7ba6b-49ab-4972-be01-6f0f6b404a0e", "comment": "Malware payload (Mirai)", "value": "01a63e373936d2f47b2c8f48e280627424a6909d03ca646874e9952efa261dc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326173, "uuid": "cdd63d3c-d1ee-4a69-b712-82e94ab33f9e", "comment": "Malware payload (Mirai)", "value": "6c85ff27602d92ad463118e09fed40653e4b0cfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326173, "uuid": "8d92a658-42b8-4578-be5a-369965f676c8", "comment": "Malware payload (Mirai)", "value": "cdb0d8e96c4a435dd149738ec544806b243a008191a132cda4f977ae007d10101531360e4c8ffdaa6713d2b651e49395", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326173, "uuid": "07993605-542a-4fd6-b99f-5425a414e2ea", "value": "T127832A9AF400DEBCF88BD6BA41664D0EB930A39016920F367767FE933C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326173, "uuid": "0ab6ed3a-f38c-4a24-8b49-ca137d532d22", "value": "1536:qLf0+QM5PHyVwi7f2HUiEy+DlOo7qL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5f2+DM9SJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326173, "uuid": "59109c86-1ce1-4fef-a531-880ebeadae5b", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326173, "uuid": "6aa7c25b-7f73-49c4-9a52-8b6b7f2d864f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326173, "uuid": "0ba8bca6-53b8-4901-b668-60a8b1d4a5aa", "value": "a6c26fd21e24c2a044bbef0c7eaa779e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0031293a-a435-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647330808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330808, "uuid": "60e9c76a-c67b-4836-8af1-e051a68e96ec", "comment": "Malware payload (AgentTesla)", "value": "575dc8b1a65d8573f3825234fba356db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330808, "uuid": "734904b8-c35d-497b-87bb-e620a1e732cb", "comment": "Malware payload (AgentTesla)", "value": "01c015d00bfc4c14cb2a4b80433317efde8996d4b05be63197e9c9ed6d9c232f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330808, "uuid": "c89a5aa4-94a6-4c0e-b16e-5d2d031efea7", "comment": "Malware payload (AgentTesla)", "value": "6b63330b9988f1286d4850030e33573ae9f5e897", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330808, "uuid": "8e73b7f3-6380-47c3-9a7f-1331d5c72031", "comment": "Malware payload (AgentTesla)", "value": "65b45af1adacfc877d9bb4abab729e2bb19d4d8805eb2754e5d5520c203cc0bd55c90ee00f4fccb9867f41703a7dd34c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330808, "uuid": "07048bff-3be1-48a6-bc4b-076323791e2a", "value": "T1ABD19E5C76EC1810F16F02F9C29E6E130C9C131B871E4A959F40A6157AF7AE81F26B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330808, "uuid": "f2e1df4c-5907-4759-9284-8843223d477a", "value": "192:XH58GtFpf8bAaxQW4XdVuEyLVucFhgD1tbI:3eGtjfSOVu7LEcFhgDP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647330808, "uuid": "8006ba88-863d-411d-9189-8df9581ee52c", "value": 6413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647330808, "uuid": "bc7fa3a2-c245-4ff8-b534-bf27c439c66f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330808, "uuid": "78095f6a-22f0-4aa9-96c1-abb7a893e37a", "value": "RK-098765432456--09876543456.PDF..Lz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b9f890-a408-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1647311789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647311789, "uuid": "2364465c-38e6-4320-bc04-92e26148140b", "comment": "Malware payload (AZORult)", "value": "825c59ae87559d42096137794b6d68f1", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647311789, "uuid": "d7b35844-0b8d-4520-b6fa-64a33abffe9c", "comment": "Malware payload (AZORult)", "value": "02004bb456c1fccd80b6b560f2feda55cfafddf9a2dad0f382ff65040c8306b9", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647311789, "uuid": "65633550-a720-4ca8-b3ad-b6fd9aa57386", "comment": "Malware payload (AZORult)", "value": "9e65fcfd445f45d3c630bb07c9e8b6d6143d485c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647311789, "uuid": "b7d8e903-5ca7-461b-b893-304bf9763d97", "comment": "Malware payload (AZORult)", "value": "69796baa2c29c162bb98b333ef3edab7047a07dd451c2e395f12897aabe6ef2212d4358d3d48a708b5d85eb05800db4c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647311789, "uuid": "8b92e8b8-5c88-46f2-b166-ed66fbb46e44", "value": "T1D8E3131DBD781F6CDB751A3A0D2B0A572A2CC840AF5C56D3180C3BA68D70769BF4D29A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647311789, "uuid": "29bb1253-609b-409b-b721-102bc426b238", "value": "4e75452814808e64e61ec2e93added8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647311789, "uuid": "6542bc3f-0fda-4ea8-b7d3-c061724d58a6", "value": "3072:SJLFFBRAAd05h3ynGB7g6UprTiNdjG3PXsA+Gsh1oXT3fMu/MnqkjHMoCDfsGzO:SJLzBRAjdgFpfiNd+PcA+GshGXzx/GjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647311789, "uuid": "e79e5f86-5883-4074-b8c0-f16552ebc01a", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647311789, "uuid": "61cbc756-86e9-4f16-9dc0-8ec5df698b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647311789, "uuid": "d0fb9af4-29ef-4f2b-b0de-ad76eaa7dacf", "value": "02004BB456C1FCCD80B6B560F2FEDA55CFAFDDF9A2DAD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348d4ee0-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647353659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353659, "uuid": "b5544f93-f746-433f-8e18-d157643b8810", "comment": "Malware payload (Loki)", "value": "0bc774079532e4777bc69fc6aa0555f0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353659, "uuid": "630c4ac8-a1c2-449f-922f-59a186c1ece9", "comment": "Malware payload (Loki)", "value": "024054036331df11944a68987f3e3479e05eedacce61685a95d29dc3c1b2b09e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353659, "uuid": "6da3ac47-e242-4959-a098-0c4448d74d5b", "comment": "Malware payload (Loki)", "value": "7a8aec81b8c868e9461e95c3e2c85843f8c509ff", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353659, "uuid": "b4801f10-13fc-4226-9a39-28358da159e9", "comment": "Malware payload (Loki)", "value": "ec1bb6bcb8eef41fac24425016fccf6c6f07a6c1d415260dc4b5f3e5a937352eab17c131568b740235c4a8041d697483", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353659, "uuid": "469c3b8b-dd26-4ee8-b32f-aea5f697ad92", "value": "T15E14120A7D0FB390F6BF8BF1089B8F4412B59E7325844181DA297FAD173E6C259953B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353659, "uuid": "0ecf0ef9-c0da-46a6-bc4b-dd8d3cb37ad5", "value": "3072:gHha4F3j1ODq3VqaUdij6QnnBDHT1iVTSVfmWYFZj7F7wEOWBDuT+v:Uh53pNVqVijXn11iV2+PLFUEOaDA+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353659, "uuid": "53015e95-d19e-4b8c-a2a9-279d010c0732", "value": 190632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353659, "uuid": "240293fd-7263-4678-846a-d1128560500e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353659, "uuid": "3d753e83-ffe3-456a-9c64-535823e96b04", "value": "payment details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ff06d2-a436-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647331376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331376, "uuid": "0e29f402-7ae9-4364-837c-39b5f1109fab", "comment": "Malware payload", "value": "b0ab12a5a4c232c902cdeba421872c37", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331376, "uuid": "a2181720-d850-456c-9451-7644155908a5", "comment": "Malware payload", "value": "026868713d60e6790f41dc7046deb4e6795825faa903113d2f22b644f0d21141", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331376, "uuid": "b6faafb3-0cba-4998-9be0-eadf775e13d2", "comment": "Malware payload", "value": "a8e7659942cc19f422678181ee23297efa55fa09", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331376, "uuid": "d7126720-d073-4721-81f3-8571c877e946", "comment": "Malware payload", "value": "25feb342c5219f8a01ae5248e71ff5250ea95656454d26b1c335b058b07604e146e2c28ddb404d62d96555d22aa07e9d", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331376, "uuid": "0ce2a496-f12a-4a39-ba2d-46c0838fecd4", "value": "T19734AE707181D046F4594B73A9D6D6E873227D5ABE4FCF0B2020B73D3ABA9949F0588B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331376, "uuid": "ff77b14d-6298-45b0-8d08-ce5ddf52ab51", "value": "6144:Lk3hOdsylKlgryzc4bNhZF+E+W2knAcYi4uU4pVZ8lx+tSeJBWC:5iLZpVZ8lx+tn3WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647331376, "uuid": "b78fd248-5a1a-4a6a-b4a4-c2cd56ad8e5f", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647331376, "uuid": "e5d2a9ad-b8d3-4598-9b16-5e26d10cb7d3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331376, "uuid": "fa404d69-0117-41b0-a57d-436cc909b785", "value": "Cooperation terms.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5a6614-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353649, "uuid": "d08afec9-7c77-440b-a39a-55e5a16226a5", "comment": "Malware payload (Formbook)", "value": "027928c7890f5881ec7220ea61df4e37", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353649, "uuid": "72ff1836-b000-46b0-8c83-dde88d5e0313", "comment": "Malware payload (Formbook)", "value": "02757dd8fef68a47798ba84051c8945a27fd3eed6a2e8d3e2ca15b39a4042068", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353649, "uuid": "cb6806aa-cb0e-40ad-a343-8cb722ee36e5", "comment": "Malware payload (Formbook)", "value": "e614a26c65582a4c46eca93c7ef8664fcf255e59", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353649, "uuid": "d4db5ecd-c400-469d-9a3d-fc942ccb4d1e", "comment": "Malware payload (Formbook)", "value": "92fe8cbeac18e9ae0854316fe2d5e9054d3390eb6dedfe7bfdd3455d17d0352a03ddda0ba6208c09ddeffd97f3d4cda0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353649, "uuid": "1bb436c6-aae1-4746-9241-8cdbdefa15e4", "value": "T1EC1401A8F2DBD3D8F09753792D089E58B15FEE4E05148ACA343BBE1C90B7C451D293A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353649, "uuid": "d7b856a9-66f6-43e8-9e0b-11cc919a9537", "value": "3072:nodANeMQ/Sdke86xYPPoo0DSCJ/y4QszaWAhalO51f62eYwHp2zzY:odV/SdDxuqSCpy4xaWAVX621wHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353649, "uuid": "244bb068-5489-4011-86fc-0342b29cf9fd", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353649, "uuid": "ba23cb76-8cf6-45c7-992b-5f865e843123", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353649, "uuid": "baef36a6-974b-4f56-9150-61dd94b0787b", "value": "Deeds office document.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3a477b-a450-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647342800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342800, "uuid": "4c4aabfa-58aa-4288-a23e-a5145d8f9091", "comment": "Malware payload (Heodo)", "value": "640129e15e07531375cfa9c2c0dabc92", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342800, "uuid": "193a6389-d24e-4e8b-b448-8afc279bec5e", "comment": "Malware payload (Heodo)", "value": "036a3d12458994e20e724e2ee1f050a6285d37e465c73a358a175c0a6f4b6212", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342800, "uuid": "03c10a36-029c-4ca3-b6a1-4062d6a07c59", "comment": "Malware payload (Heodo)", "value": "2e7c921b9f9a23f14e6fddafcf5145e271f269a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342800, "uuid": "662c3694-80d8-4240-a259-2cb7271294d0", "comment": "Malware payload (Heodo)", "value": "644fc8888d4c1f5ad5563dd56da5578eda8d207e4964a176db45742193011eba4f4c73149c4c23b832e72b8a07d7f46d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342800, "uuid": "9615f32f-195c-4c40-9a6c-76929141bc57", "value": "T1F7257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342800, "uuid": "96d8e8f3-b29c-46a8-aa12-efeae65c9efd", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342800, "uuid": "c27f603c-1a0c-435c-9f4a-c542213ed9dd", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYOVP6FuR6shQLj88F+Krf6:v6oycln8cACitP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342800, "uuid": "d36505fa-1096-4f75-9bb5-55c77e594cc6", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342800, "uuid": "ac1aeac9-d94c-42c2-81c3-b69c66d78420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342800, "uuid": "d1460aeb-1caf-409c-aa10-be89e10727c2", "value": "M5UWidQBvNIpC2sbGAjFnY7eHUBgmJO4xa.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe47684-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647353027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353027, "uuid": "a7404361-79a7-4095-9ab2-443e1e50cb1e", "comment": "Malware payload (Smoke Loader)", "value": "80cb82d19b9d0739f249572400ffac2c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353027, "uuid": "6a546055-adfa-49cc-8921-e3fc2f33f1ac", "comment": "Malware payload (Smoke Loader)", "value": "03f51d4a7f2c32c976148cb7b8085a4799f3781eb8f912e7577bb41b819b57a1", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353027, "uuid": "5fcc567f-a137-4601-99e2-c8c065d8620c", "comment": "Malware payload (Smoke Loader)", "value": "9fedff403545cce9d6b2e25e81165de10c0aee64", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353027, "uuid": "70595f31-59ba-4102-a368-d3a5c357796b", "comment": "Malware payload (Smoke Loader)", "value": "a7fb1bcdf169b773e11dc5683ee4a5da02e8286f1c552bf8c2f45b13e5d0e9a910d71704f0b4fe96532fca68a316f8a4", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353027, "uuid": "d895b66f-9c8b-435d-b862-0670d6d847bc", "value": "T13334CF227690CC32C59355305924C6F26A3FB532A9B6C5077B95C73E1FB03D2AA7A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353027, "uuid": "b68f74a1-fdce-4b12-89c6-ffd6e6081644", "value": "937be297ca9fffccd10ddba731ac45ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353027, "uuid": "74800abd-515b-4788-a7e9-fef356b778a9", "value": "1536:hfouUPu7VPGgmRSPFiwA4gkGxoktnKUZBrCp0iueHT+Dr5m2RZes2ets2:toC/XwGqKUZBPDr5m2RZes2H2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353027, "uuid": "adcfc8cb-be18-4688-9c99-7c6b1588a26d", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353027, "uuid": "7ce1afdd-ed59-47b9-a279-7ec95ff1ba3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353027, "uuid": "1c346938-8d38-4a58-a12b-24496a3d4225", "value": "80cb82d19b9d0739f249572400ffac2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eeb90a8-a462-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647350321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350321, "uuid": "ee657877-ddbc-4e9b-9914-6a07afbab210", "comment": "Malware payload (Quakbot)", "value": "b6fab2820571181c390af87ae02b027e", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350321, "uuid": "fcb138ca-bd7a-49be-a0b6-b0d0eb76ded5", "comment": "Malware payload (Quakbot)", "value": "042a16b8333f8670f71e220b7ee514c10874d1f310b547a051b7e08582f013f3", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350321, "uuid": "76738eca-3d29-441b-a813-20b60b1ed244", "comment": "Malware payload (Quakbot)", "value": "0aa5f77948979e666341d61a35ad085228d35025", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350321, "uuid": "8d6e97d4-9015-4bc2-ba29-41f7001ddf8d", "comment": "Malware payload (Quakbot)", "value": "30003f535b52dd64cfb0751a0edb3f373ad2f1aaff7d3b4be591578aea865463908c112364e38ef287ee949ced1a0732", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350321, "uuid": "3f9ed7b8-c97f-43a7-9004-3e53967d204d", "value": "T17134E116261461B1C2EDB978720B0DC292EF707EE906F9244B5207FA7F423FA8D5D1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350321, "uuid": "31d7f193-2da7-4d4c-90d5-f457f72e6b73", "value": "3072:nrpvZ+51+mCVdcmF/9OZNCsRCbOI59VzmWBgXEnkZtPaq4LwTGPCXVD:rpvY1MzcmfO4bOe5d/OIwTHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647350321, "uuid": "9890c1d5-6d47-412c-9d0b-83faf7d6c224", "value": 244127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647350321, "uuid": "afc06774-256a-4397-9289-5e6de6a426d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350321, "uuid": "cd6983ac-284e-47a0-a269-d30142673e6f", "value": "osteau.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d1f0e0-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647354498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354498, "uuid": "9daea644-cbb2-4332-8ecd-0687b9375cc4", "comment": "Malware payload (Formbook)", "value": "9bf299b5b3cb87a9cf645ddd4aa31359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354498, "uuid": "66d7d52d-8b8f-4f59-8a45-14f99d9fcb97", "comment": "Malware payload (Formbook)", "value": "059bdd3a82690647000d29fd9d7957782518cf71ab9c848666992508c4bb0c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354498, "uuid": "d1be6986-32c4-4cec-bc0e-81e0c68e6d52", "comment": "Malware payload (Formbook)", "value": "defc068fbb720a7e383fa3f809cf2a8df8aee01d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354498, "uuid": "80f202c3-f647-40f6-9a68-68057a821d64", "comment": "Malware payload (Formbook)", "value": "956d3d4bb7795a3d9f6081def82d96a539a437ab87b8a2c9297158df917369af900d7a39d505c828501c253eee46a040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354498, "uuid": "79742cf1-8f7b-4e19-a9c4-d9a1ccdd7ca4", "value": "T1CF25D0AC3290799FC623CE76CA642C14FA3170BB6707D203A157019DAA5DBD6EE117E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354498, "uuid": "7f9ac4a8-e3e8-4d28-b44e-4f2834c700fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354498, "uuid": "58f65a76-ebc8-482e-8678-e9fd3c3c1976", "value": "24576:9rmHwOcPaMAiziKwRcX5CNeHqM0jTH4w0LYitl8T:ufcyq7XYeKXEw0L/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354498, "uuid": "ec5a27a2-44d7-4a6d-8e14-422ce42a4c5a", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354498, "uuid": "ef1c0cce-0e9f-43d6-bf7d-adce124eda5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354498, "uuid": "e83bd121-a177-4d37-8e3f-bdc3b7f3c7d1", "value": "9bf299b5b3cb87a9cf645ddd4aa31359.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515e180b-a448-11ec-9275-42010a9c0029", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1647339105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339105, "uuid": "84b3dbb2-2774-4d67-ba5e-3e39a8457b59", "comment": "Malware payload (Gh0stRAT)", "value": "4895005be7f73e1121d578b60b7248db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339105, "uuid": "05f77807-b0d7-43eb-8fdf-e7531a4d1093", "comment": "Malware payload (Gh0stRAT)", "value": "05d631ad7d8022ab213b9a06afabd4bba17f6bb9fd96f1f0a8c89257445b3f89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339105, "uuid": "7444bc19-f3a9-4d22-9596-0850e10c11fe", "comment": "Malware payload (Gh0stRAT)", "value": "f429bd6b49313f955d4580f4f2e4be84e36b2c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339105, "uuid": "08c7b377-2028-4401-b2a7-98bf8a6e7d8f", "comment": "Malware payload (Gh0stRAT)", "value": "748c8ef315d2dcedeb308e9f1cfca0cc62e31827acff03d82e4bf437a17894b3ea407802f341b8fb0c1ec71399a759bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339105, "uuid": "ce7fce83-7455-4648-bd39-b8f8754c2e49", "value": "T148E312D5859E2FA7CCE998F708E6391F7844878C6BD806898D51707FE2EBE394274B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339105, "uuid": "90f19615-6a1e-4abd-8d06-ae36c894a7ce", "value": "319fe90009d9ce0aa4e432b3b8307a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339105, "uuid": "f3f32704-c1f5-414c-b1a3-2977e0a69e2f", "value": "3072:Dm2t+PdK2H+hOIg24AP56wv8OevSfxf03b2QEvIw+R0h5uqy:DmpVKe63kTS5fpQEnRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647339105, "uuid": "9a3eb939-b55d-4149-ad6c-900a14b667c7", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647339105, "uuid": "82eb4822-a0f8-45f6-aecf-ba70d112bea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339105, "uuid": "66d9e31f-267a-48bd-9724-a0be62fb101e", "value": "05D631AD7D8022AB213B9A06AFABD4BBA17F6BB9FD96F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f17d2b-a435-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647330814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330814, "uuid": "35237976-a22d-414b-9a33-2d4be5f4595e", "comment": "Malware payload (AgentTesla)", "value": "71c2d41b23a0ef6bddd5cca513f46dd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330814, "uuid": "1fec2af3-7ee3-4a11-b6f5-1f5d5f6f3754", "comment": "Malware payload (AgentTesla)", "value": "05ef80081391bbd33e0f7fa89d9b1b3eca8be6265c3728e223282e1f61739ec2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330814, "uuid": "e0f92178-df73-404f-aa92-2dc3052b8b1a", "comment": "Malware payload (AgentTesla)", "value": "505ef1ed4c4d9a7e92e94b24b89f42dee33e48ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330814, "uuid": "f13dba85-f9f9-4a4a-80ba-46e035e9f531", "comment": "Malware payload (AgentTesla)", "value": "b34be233cf281b7437cf16c03e79b2d9d3db286d2e4d329947700c2135f3a53a5409a386466b12116ce23db91963c116", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330814, "uuid": "bfa4561d-ee67-4d97-9c85-1dcac13a80a8", "value": "T1FD52F85497A8DAF9D8760ABB5CB39B101729F216D8259F1F39C9630BAC137120973F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330814, "uuid": "9ebfe2dc-c438-47d6-85bc-bf9a2d743ea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330814, "uuid": "e6f82a12-d606-4ea5-90c4-6457a7c0eaba", "value": "384:1pD3siNdxxO3S9AflZrcouiiay9ycyrsR2vZItROUn:1jyhll8ycyrsR2vZItUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647330814, "uuid": "b8293182-f919-4321-818b-ee69a2e3922e", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647330814, "uuid": "997744a2-ed29-4111-b14a-a226e59f430a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330814, "uuid": "088ff70b-3e12-418b-8d9c-a7da9649c5ab", "value": "RK-098765432456--09876543456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025fae0a-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333818, "uuid": "209b944e-cf68-467c-ac60-ffd6abee33a5", "comment": "Malware payload (Heodo)", "value": "949d22a1dd5b066c1e109709cb493ca9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333818, "uuid": "5d1a4a1a-c938-461f-825d-2d22795b6fbe", "comment": "Malware payload (Heodo)", "value": "05f3909b760ec8b9563a09f98a256a7b02106d5974ddd8eb9d87d197f00106e7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333818, "uuid": "2a929dcb-2776-4a36-a550-eac368a04322", "comment": "Malware payload (Heodo)", "value": "d85876959bdfcb6bf560fb6aedb4d5dd0d73bd62", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333818, "uuid": "b635346a-97cf-4b90-a9fc-c75488ad6bbb", "comment": "Malware payload (Heodo)", "value": "7bd99fe7d193e74fb3d9e4672c697dbfcf79f2a4a9026eea7fb4ef343065c1b35b41d4394562dd33ae8054d184e2ddd2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333818, "uuid": "18ea4bc5-5cc6-4652-91e4-799603260fe7", "value": "T14C73E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333818, "uuid": "f6617f54-5cf7-40ed-8b53-c3473d3e7d0e", "value": "1536:GuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:AtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333818, "uuid": "4ebc04c1-24c6-41cf-8397-5b9ccf4837cf", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333818, "uuid": "cbbe56ca-1d34-45f4-9221-14aa488f35f6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333818, "uuid": "3e354e93-9ffa-4141-a569-ba5a17b4c575", "value": "omicsonline.net.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11cc728-a431-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647329387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329387, "uuid": "c81027cf-7f18-4341-9d69-fa4a2fc796ff", "comment": "Malware payload (AgentTesla)", "value": "a10d531d9a97cb291a94fd1f61186548", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329387, "uuid": "ce3aecdb-27f2-4253-859d-db2a0f611a87", "comment": "Malware payload (AgentTesla)", "value": "06111376c0450844b35e73c1982a193e5e2393789dcd4d092ed47eb7d211d867", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329387, "uuid": "4917db00-ce89-442c-b60d-bcd73b1a03a3", "comment": "Malware payload (AgentTesla)", "value": "e8f757b388be7bea6aa29fe4c5fc06bc439e81e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329387, "uuid": "260d1b50-1775-4f0f-b497-da1e3ee32acb", "comment": "Malware payload (AgentTesla)", "value": "b7b300e85d6fabad6db40cca253aba9bae81a1a2d4260e877e08b42405baaa83eb88dcb00e09063000ba92cd929a395d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329387, "uuid": "ae7e8c37-e89b-48d0-b430-a349de4e7e1c", "value": "T14F25F1A03E596FC2E5384BF4015B966EC3F32D662E13D57D1EF02AC7081EF069569A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329387, "uuid": "a85c1eef-1c8b-44ed-86bf-3998653d8fa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329387, "uuid": "c18cdc94-6fce-4d88-ad11-c37df52fb802", "value": "12288:0SB3gtBqDDg7+f5zuXjVmPmvbZuJqkZNbymGp9fXzmAY2cfElBDAFu4uzNlpdh1A:0SBy2gif5iz3bOuPPiYBDAAVzLDmhzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329387, "uuid": "2d27a98b-02be-45dc-ac53-4b5b0ed2cb30", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329387, "uuid": "8fcd7a71-0764-458c-b6f1-40dca0daea0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329387, "uuid": "279108b7-5bd8-42e0-a4d4-f70cd8888217", "value": "FAX4685893HFUE847E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6345dec-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647363433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363433, "uuid": "8929d8c7-7caf-4c41-acb7-f38b9564e5a0", "comment": "Malware payload (Heodo)", "value": "2ad5c50ac6449a654861831829d3715b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363433, "uuid": "40559108-6f7f-4b6e-b6eb-4630aada7da6", "comment": "Malware payload (Heodo)", "value": "0623543875210671de297d570cf606fa31e6a8a9d865730091f49fec8d08cdf3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363433, "uuid": "02728757-e900-4e59-b08d-f6083cbf9e6a", "comment": "Malware payload (Heodo)", "value": "eae93a58b55fb0c22f7b5946bc47619dc64f000e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363433, "uuid": "9ed11688-133f-4814-bd89-29fa78f28acc", "comment": "Malware payload (Heodo)", "value": "bb74d094b5d492e72b007b90afa270446c82bda471d75a6117176bd8db56dde2994d9901fd33dee0e09082e695da5555", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363433, "uuid": "114c965c-40a1-43e8-ba0f-07a378c94c75", "value": "T184257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363433, "uuid": "bcbabf41-5e5c-44bc-a002-97709908e467", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363433, "uuid": "ee2f0837-df36-4209-8a1b-0120f3c3bac1", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlGOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8ul65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363433, "uuid": "a336460f-55aa-46a7-b455-d5472aa6f2bc", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363433, "uuid": "be40b634-f0e3-4a9b-a275-17d24f721b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363433, "uuid": "c4df1d0d-e27d-42ae-b32a-2c075b79299e", "value": "lPDO41nupmTLknEIK3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0868ba6b-a48d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647368618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368618, "uuid": "88403fbb-74eb-409e-a85f-c842c6e5b653", "comment": "Malware payload (Heodo)", "value": "fca6aec1b0f90079fc01f82e198bab1e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368618, "uuid": "12478ba6-ff7a-4d12-b8a9-071620810b20", "comment": "Malware payload (Heodo)", "value": "062e8beb435ac2c1a1fe05cec54eb8e42a073ba74e1df62b1ed8a2020843a61f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368618, "uuid": "6d161a97-401e-4efb-b459-586a10c470e9", "comment": "Malware payload (Heodo)", "value": "bfdc856979ebad8b1d03e66f1c4012e77295671c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368618, "uuid": "db7dbc8b-06ae-41dd-be74-5eea83536181", "comment": "Malware payload (Heodo)", "value": "c4c0ee47d882dc74128e3d3e52a85b2854760981c76e8250067f44afbd75d6abc5b8f2640406234d160ce5e7d9f98dd7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368618, "uuid": "10507d6d-ddda-4a1d-829d-ba1fcf256a01", "value": "T10A257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368618, "uuid": "a031074e-979c-4071-ae71-d016e9fd28c3", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368618, "uuid": "a0f1e3f5-a9ea-4691-a8b1-f318d7de9f5e", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYOVP6FuR6shQLj88F+Krf6:v6oycln8cACilP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647368618, "uuid": "c8a89c93-8b8c-4a6f-881f-dc8d2108f9fc", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647368618, "uuid": "df601643-2984-46ae-aa28-f9134ed2ddb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368618, "uuid": "6c9fce2a-5483-4a6a-bf43-e6ee9119dac0", "value": "rfs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bd9126-a495-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647372235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372235, "uuid": "032e1a43-c2f4-48f4-843e-2356d49617b4", "comment": "Malware payload (SnakeKeylogger)", "value": "1198534eff0ca700ece37457ad5e2b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372235, "uuid": "13a782ed-540f-45b0-9e3e-43cc89453f51", "comment": "Malware payload (SnakeKeylogger)", "value": "063c4ae42d64081d50fecb5ee3d0f5ed835c8351964e32ae2bc222172d7e0b3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372235, "uuid": "4ac0d99d-1870-48f3-b7d0-0f3f11b5bd31", "comment": "Malware payload (SnakeKeylogger)", "value": "728daf9d3a51c5382e24fbe3bef9e2c350062193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372235, "uuid": "bbfd2f79-b137-4cc9-afca-6e12fe5e02a4", "comment": "Malware payload (SnakeKeylogger)", "value": "55a4b4c8fda8f15e54f1dd5e74a64e61e0091a4803c068ddc9d70a72de08dd2d92cd3609a3ce4de95469e4a6a34340c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372235, "uuid": "7e9f5f20-4ef3-4056-b2c2-8f47c1439a73", "value": "T11115CFAC32847D9EC523CE36CA652C24EA3174BB6707D203914715DD9A1DBEBEE112E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372235, "uuid": "09d0436b-a45e-4def-9648-4cf77ec0c897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372235, "uuid": "d8231fff-c623-4762-b0e7-825153127a92", "value": "12288:xeAASEiEb4kwOEocElaAk1EVtAgpbfyfcjvdQAtHdgvDdJUCXdwRwChZal2iBW2P:itzrwOCAsib6fcdQa9GIsdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647372235, "uuid": "0a53d967-140c-411c-b9ad-3b737d76346d", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647372235, "uuid": "b252891b-749c-411e-abc6-618f9dcb5581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372235, "uuid": "23f9c703-9d89-478f-8f44-4e55b45d939b", "value": "JR_FHM_DAB7400006479004597_147-637593641117581330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b0baf8-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647353124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353124, "uuid": "e5821c78-4946-4aa3-bd8a-db318b8d0422", "comment": "Malware payload (ArkeiStealer)", "value": "950f20fd7030eeefbcb66ba979bb1f84", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353124, "uuid": "35987dc0-d448-4f3f-9655-4d0e35e5a431", "comment": "Malware payload (ArkeiStealer)", "value": "06a2cc9679d1a40622c13a9c00ecfa94aa037b2ea0d045c354b32d20bd43509f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353124, "uuid": "6b20a69c-0735-4d05-acb5-e87baa89a8ef", "comment": "Malware payload (ArkeiStealer)", "value": "eef44ec2a42c2f47612657e8d5a199fc3a0ebec6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353124, "uuid": "c8a4fa07-70d4-46d5-bc08-573278d8bed2", "comment": "Malware payload (ArkeiStealer)", "value": "545c7edba2af644f63bab3926856de3532436f3ac72b0d10479de1d30cc69200363e584279924d0b796f4a45d33f5bc5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353124, "uuid": "3db065a6-b301-4fd1-824a-3cad9f0f3445", "value": "T199D412237E60C077D0D599B14915CAA2253FBC311BBA820337952BFE6E31292EB79717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353124, "uuid": "5e720553-d91c-4df5-bf6a-40611820ef4c", "value": "f200cca5de76c997fe9d5620fa14f112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353124, "uuid": "198320d5-3880-4384-9b2b-87b411836eff", "value": "12288:DJjVeYeRpXYZkPWSOzL10uLtH5R9a+qv7mhJaug:dVejXviVNl5PqOJaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353124, "uuid": "0d20159e-1a9c-46f8-8df5-a7a5b5d5e053", "value": 628224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353124, "uuid": "216f169f-c664-4eee-9df4-c7e5fcafb908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353124, "uuid": "410075ed-5c3c-48b3-8180-4528f9d84a5a", "value": "950f20fd7030eeefbcb66ba979bb1f84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556681ae-a467-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352426, "uuid": "0bab0f57-c227-4793-a718-e625792cde48", "comment": "Malware payload", "value": "b15dce8cfbfce552ec0c11fa0c1857ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352426, "uuid": "7b6eff15-625a-4b32-bb8f-5d204fbdf65c", "comment": "Malware payload", "value": "070e1d3241ece85f2e300ba40d0b1060f8746332a9c6e9e9c0396ddf1841e319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352426, "uuid": "cd734a58-a66f-4cbf-8e39-18ea3735c567", "comment": "Malware payload", "value": "5d52f12f540222d177fb06668d47b331d8d5e176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352426, "uuid": "a37a91c2-4a8a-4af6-92d8-5289bff1ef47", "comment": "Malware payload", "value": "10afaa2851796572e0adbd48f199fe8e9a8d4655ed53beff857299029bfc172d532246af05aee7f0aeb4ebc088fa0572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352426, "uuid": "e2e80bd7-bed4-467a-89c1-2425e3279503", "value": "T176632AD37A889786D8044E7AA97B8E101E37BF15AD06B60E7584F35F0FB73C0AE12654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352426, "uuid": "f34e853f-d91e-4260-b12e-12d4f260e164", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352426, "uuid": "c59f5e11-ee68-478a-8ebd-7739fe77fb5a", "value": "768:twxMeoHy6vFCxDSTHS8f39WLoSbCLDa9q3Bx7hHqfR1D22He3L46v5F77AOAn1X:tLHtpnf39AoSITxx9ER1tcMeF77in1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352426, "uuid": "8ea54e3e-08cd-4d99-b628-a94b6a8e7e25", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352426, "uuid": "90a9235f-8e70-4694-b9b0-42d69c1cc52a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352426, "uuid": "4cf75d70-17a8-46cd-9d3f-c33fa5a50f0a", "value": "CONTRACTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c157f4-a447-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1647338795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647338795, "uuid": "1618e328-d72b-47bc-8c38-721965fa9fcb", "comment": "Malware payload (njrat)", "value": "3c89c12664b98a432fec7e1b9ccd2db2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647338795, "uuid": "6ff91a07-ec02-4ce4-9421-4ea8a3a9a048", "comment": "Malware payload (njrat)", "value": "07a4bc5a4a12d6d36ee0484e98a39c60cb30aff0d55c88d79edf9fd137667aca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647338795, "uuid": "2f4fd22b-9960-41a7-a340-b1b7c6bf277d", "comment": "Malware payload (njrat)", "value": "8504a45dfc37145c919ecd2c492de4b262386425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647338795, "uuid": "c7b5132f-3688-4331-bf12-2b296a38065f", "comment": "Malware payload (njrat)", "value": "33fb6dd6b3d8403b9ae758ac32a0b6092c335ec7076acdeb05178637428795fc46fc8a8df8c0f94a24557acfb9343b75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647338795, "uuid": "cee69678-21e0-46b1-807f-bbc427b99558", "value": "T117A37D58978D6F13C2FE8BFF88D2B2568329C1278E47E34FE48525A499523E7144268F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647338795, "uuid": "ce265ee7-bd72-4c30-8ce8-5ae1c52262a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647338795, "uuid": "e620aab8-793f-44fa-9dfb-70de7dc09d22", "value": "1536:GS0c5SSM1nx0CuPwwUKC78X31YZoghALIpOFtPGg7:GSNyf7mYZoJLICB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647338795, "uuid": "5e548a2b-650b-40f9-954f-401befa20462", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647338795, "uuid": "a11135da-518c-4f7e-835d-ebbde67b64ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647338795, "uuid": "abf91007-5501-413b-9262-36bd50fedcc6", "value": "07A4BC5A4A12D6D36EE0484E98A39C60CB30AFF0D55C8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee5dd32-a487-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647366051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366051, "uuid": "75b075d3-2e8f-4f1e-83f6-e71e8bc34d49", "comment": "Malware payload (Heodo)", "value": "fed448dd2ba85016c1a5a8084443508c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366051, "uuid": "8192726c-82b8-4f95-bcde-a34f671a55f1", "comment": "Malware payload (Heodo)", "value": "08785f87fe88f697b9922a1f1f310359e123aa1a8d7cd463fe02ed74b8908918", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366051, "uuid": "aac8db58-363b-4c14-b5cb-2083d20c7c4c", "comment": "Malware payload (Heodo)", "value": "b89072e102cc5b8ec14908d370b158b6052dd135", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366051, "uuid": "7e4cbe1e-a63c-4017-8179-ccb1eb017b9d", "comment": "Malware payload (Heodo)", "value": "61b8f6eeb268d1d537ab4427693c780748269e814edca286f4974bd575448834312e2763129f2e6b2712e61bce92aca4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366051, "uuid": "340e0206-e042-4216-a965-ec91be90c02f", "value": "T18C73F01EC232E15ECB2710BCD58F0FEBA50F791929C4E5B69780FA4D17049AA634E35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366051, "uuid": "62cbd379-b589-48bf-b26d-e9b61da049d4", "value": "1536:/1iiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlVzc:/1iiCtzSmICpH7OZuvZGsMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366051, "uuid": "e3df9cb4-99e4-4348-ae4c-e3109e3424eb", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366051, "uuid": "cc28ba1b-c186-480b-88eb-8dacc9909f8b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366051, "uuid": "853c413e-d551-4859-9303-fdcd93aff58b", "value": "adjuntos 5181.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfa112f-a456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647345058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345058, "uuid": "d757b3c4-61cd-426c-9019-47796899d6d6", "comment": "Malware payload", "value": "fbb885377a4043cd8d50bc2ac7a091e6", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345058, "uuid": "eebebab0-6b4c-4b8a-b90e-dbeb999a984c", "comment": "Malware payload", "value": "08aac5f0e04dd1c12acc7f5b781d07450e79f17a2b278aa8a05e918c4cb7b851", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345058, "uuid": "ea91e8f2-281b-4017-b71a-99e09a13f835", "comment": "Malware payload", "value": "c2842cb3c510fe778ca752cbb3260cb9cf6c95b6", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345058, "uuid": "dd1d7956-33ba-4505-8a88-43733f6407f5", "comment": "Malware payload", "value": "2e9fab4fc0f32632e872558480b1b20d75a8dbc54f4cc8899d834a8eec409e4e5a0f0f46b048b93ca9eef21a41b474b2", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345058, "uuid": "64bb3fa4-9229-4eff-8464-372f25634f68", "value": "T159410CEBDD4C207CC1F359B44E0F79EC525C181E8070619B97F5F4415A0973A74829CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345058, "uuid": "2b35c7c5-4416-4c82-9682-faf807e48078", "value": "48:95PEjGojoLQU/Nt0nflDM4JSfvtBEkzSlM:/PAGVloflDRJS9BE/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345058, "uuid": "2832efa1-b900-4cdd-a66e-dce59ec1dafc", "value": 2007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345058, "uuid": "fa5e10aa-88d2-4210-9f4d-08be16bf62da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345058, "uuid": "e7a44b5c-a85a-4ece-acdd-05f22799a560", "value": "impresa_184.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e24ba91-a466-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352092, "uuid": "889ea5de-a14b-4f49-9a12-26bfaedb820a", "comment": "Malware payload", "value": "e8e9b167a4d33da313279c14a4b1e6d6", "object_relation": "md5", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352092, "uuid": "cbeda58a-aa19-4f9f-85d7-2b234195dd18", "comment": "Malware payload", "value": "08f606317d3c102925f4f8a7a01af417e54a0c7bc04cfa3b542db44c05c2ce0f", "object_relation": "sha256", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352092, "uuid": "351314d4-f8f5-4bbf-957c-35b2058e79b3", "comment": "Malware payload", "value": "518342cb17e7699e80d728afe9d98dacc075fa27", "object_relation": "sha1", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352092, "uuid": "a534f478-a805-4a75-9cce-7ac9131669b6", "comment": "Malware payload", "value": "08c20ec1c48411e0d410f553777f66e328ccc55beb1769a5a1b335c5ec72f92d2afa65776e6a3f9d71bbaf28dd873278", "object_relation": "sha3-384", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352092, "uuid": "cf449628-41f9-4081-8b17-f6dc40018d01", "value": "T1A142AFA9C59B7833D63362B8557978C1F48C0EC39140E7CC3008BBCA765A3E4AB43E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352092, "uuid": "04234442-7890-4b7d-935d-aca833c621c3", "value": "192:Q86oNmaOJ2wc3rMKkTPukcx118H111M05AgPekKiD2h0v26wyvaaNSa:Q86taIhTuHgH111/eVuhv26wyvDNSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352092, "uuid": "8208fee0-4ecf-4066-b47f-8c12817bba0e", "value": 12300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352092, "uuid": "f1f5dadc-37f3-4efb-b06c-42623a73c3f7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352092, "uuid": "fd754171-7b49-4a28-ad2f-d817916fb47d", "value": "Dominant_Narrative_Ukraine_Russia_Hutchings_Szostek.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1243260a-a47d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647361762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361762, "uuid": "318c69b3-9e0b-4abe-a120-d542f28a3b55", "comment": "Malware payload (Heodo)", "value": "a53d3af6ea43736b0a82def3594bbaa1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361762, "uuid": "2e42aa7b-0225-4489-944b-b47a3de63d1a", "comment": "Malware payload (Heodo)", "value": "091c3305d7b07492bd39984a824fe2c6065d4a2e6a14b4cdb4e607501de44728", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361762, "uuid": "0cb0d4e3-ea19-49fe-9cb9-c0def047be52", "comment": "Malware payload (Heodo)", "value": "023841061fcab0d5a58d75186d02330c2aa2a4a7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361762, "uuid": "d7fba230-dfa8-485f-9e01-50290b92242e", "comment": "Malware payload (Heodo)", "value": "1ccfdb5ec8f309b96b48a44d0b39a337f06382c53fcedbc0460c2d55f1ea9acca80dd2c6d92d53da1b2e6ababe630387", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361762, "uuid": "d4193951-9dfb-40a1-b86f-168214b2172b", "value": "T17533D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361762, "uuid": "ed824cf0-0e54-491f-99b1-fec78e26dabd", "value": "1536:4AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:hcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647361762, "uuid": "a7402310-7437-43bf-ae3d-c99c6d2f39e6", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647361762, "uuid": "8f864d10-3dc6-4c99-8554-871ead8927b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361762, "uuid": "9021f13d-eaf2-4b8a-a3da-cdac52ab8d2d", "value": "Rechnung.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc231fa-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "d2ca0f25-e8f4-4eda-b6d9-788bd0384c7d", "comment": "Malware payload (Heodo)", "value": "529aeb739fd4b1627b42a6e75b4c9b76", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "09e17b61-f813-4676-a52c-c6024bca8c80", "comment": "Malware payload (Heodo)", "value": "092044cd7f7f09ec196b6343429a1f439fc5a0dbd0491d2cbbc6f0f2fd5427ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "6a75a3e0-9d6c-4ee1-9f6d-ea95599a850a", "comment": "Malware payload (Heodo)", "value": "f2ca3cff07c73d4796a40aa7b6067b82068597bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "82245bb2-fbeb-480f-9240-7b0fa28320df", "comment": "Malware payload (Heodo)", "value": "c9707feb605dc5cd8bb5f86edaf5ad77d6f0e76af96c99fa5841d3f877bb898fcba876ac2146fabfe6c9f96f5e26bcaa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "e9686302-47c7-4e35-8ecc-d0e0310a6dad", "value": "T1C7256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "4186d375-d2bb-447e-839b-58633f48d702", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "94d82c52-ad45-41b9-b2ac-484b11967c7d", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkZwLBeUNKsuG31Pt8H:3dlV0EnIT/wgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302695, "uuid": "d15304ac-7d44-4074-8692-a39ef4cd984d", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302695, "uuid": "b616a9a9-436b-4d03-ba12-342362cf546b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "a53c1ed0-d4fa-401a-94a7-d4cfd61d28be", "value": "emotet_exe_e4_092044cd7f7f09ec196b6343429a1f439fc5a0dbd0491d2cbbc6f0f2fd5427ed_2022-03-15__000450.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e712f896-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647353529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353529, "uuid": "6722bfbb-5188-4255-a7b7-fc07b9b7cfb2", "comment": "Malware payload (Loki)", "value": "e8c464b4de8bc3a3ddcb3f9bab4df161", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353529, "uuid": "4b1ba797-4167-415d-9a89-6d8bf7509791", "comment": "Malware payload (Loki)", "value": "096fd6fe12c3b9de085ca5ec1123a627839553a8afd822bf77af2b442c7d84bc", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353529, "uuid": "21fa72a4-3de4-4234-a1ac-cc1ffc8df6b5", "comment": "Malware payload (Loki)", "value": "67ec3fd830d0e9a2dea7273372ae69c274d5da31", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353529, "uuid": "2e615412-2274-4c4f-baee-ff2d9b144438", "comment": "Malware payload (Loki)", "value": "d80842044f6caa95922f22ad20ac2ea982f269bf0ecf7af4299314914822929461ee2b1e62bba89e323af61416b7a454", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353529, "uuid": "72514d8f-6339-41a6-b92c-02d14c3bfeb0", "value": "T1C4140109B88331CFF9321C781DE6F824C3A5EE67D6AAC7467491FA36D67663D6610C20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353529, "uuid": "5cf0981c-28ac-4041-a2d7-27f2dacc454a", "value": "3072:TPdpcHaLMZo8x+2PduKKsarHCjITv13kDOzWaAQ+ZmMtZ9ULlQVQ70kjxxlKoeVU:xpc6LAoJga2Eh3A2x+Zmk8y67pxvKoCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353529, "uuid": "28db004d-8f6c-423e-921d-195631a25ffa", "value": 190712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353529, "uuid": "b64a35fe-44bf-46b0-81a5-72ba1b82c852", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353529, "uuid": "fb4f65b6-ac12-4c6a-a69d-359cf11ecbb1", "value": "Purchase Order 140322.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6c7650-a468-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352974, "uuid": "5b05e42e-3656-4896-9f6c-91823e50b205", "comment": "Malware payload", "value": "fc5534e88ff9e4d34639c77340cf10ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352974, "uuid": "b6ca238f-9f63-4b3f-a934-6ebf57714059", "comment": "Malware payload", "value": "0a097664fb1eaf2848b19a7d328026926fe81a48369a0f58658860c17621cbc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352974, "uuid": "c10b8efa-9b92-44a3-b043-aaa9a8da3a42", "comment": "Malware payload", "value": "eedc06e7400e81d597517b9e7cb62480887f8c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352974, "uuid": "212d3f0b-9071-43e6-a51d-e37ac7c34a60", "comment": "Malware payload", "value": "a6bca2d68a19ec44857c119fb07b3c3e84579d5657410e5036fb84c47746bf2761ce99a2ff1545728d8e7b5f1b18a7d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352974, "uuid": "ae8c105b-fe16-43e7-a542-cc855f60cfb7", "value": "T1570602AD6148336CC41EC0749133ED49E2F6151E4FE8E6AAB2EBBBC077DA814D906F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352974, "uuid": "d8d3ea63-0cf8-4687-bfe2-9eaea56588f5", "value": "662846a830425fa665ff33b3d69b6003", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352974, "uuid": "0bbc1131-4e89-4d88-bc9d-204cceb5f0ae", "value": "98304:v/+qvxMFR4He952wuw6sADHqED+M9xY2qcz1Las:e52g2rv37DqQYiz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352974, "uuid": "65e27fef-3640-485a-bd5a-23f118b65318", "value": 3715584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352974, "uuid": "9e3262ae-b7aa-47a6-86b4-66d16a071df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352974, "uuid": "83389172-eb7d-438d-a022-946c6efcba58", "value": "fc5534e88ff9e4d34639c77340cf10ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a5cd41-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647348963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348963, "uuid": "41ffde93-7952-4c99-9a8c-bc62ed4596ae", "comment": "Malware payload (Heodo)", "value": "517096f22d2a0d7a8149229007a8bfa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348963, "uuid": "9d6fce0f-a6c0-4b53-b1e3-412008e4abe4", "comment": "Malware payload (Heodo)", "value": "0a5c7480279f7c18a921b206a11a53a6a751878a1b07890f0dc2c27ef7b39954", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348963, "uuid": "a6e2490b-a274-43d8-a9f3-299602c47571", "comment": "Malware payload (Heodo)", "value": "94e1012dd0189a7a70219e12839ae00bac45e05e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348963, "uuid": "71d1fabe-4099-461d-ae8f-114f0420618f", "comment": "Malware payload (Heodo)", "value": "e9217781c25bed8473f2d788f4db3b5fe2bd5262888630cdff48572b97c69a02ea6ccf562fdd3e91c8f9a4a315d48aba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348963, "uuid": "88e57e51-8b3e-437d-bf60-a88a003e1dfc", "value": "T153257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348963, "uuid": "c2e48812-389a-4ef2-865a-375eda6d211c", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348963, "uuid": "498b984c-e49f-4e74-a5fa-f1e1f54f8214", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlfOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Tl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647348963, "uuid": "691c49e8-20a7-4df6-994a-f733b6ff92a3", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647348963, "uuid": "71fbe1f1-3a9b-4537-8ea7-f0f70a73c99b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348963, "uuid": "0965dc89-f3a6-4533-ab6b-23b9f9636956", "value": "517096f22d2a0d7a8149229007a8bfa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9977e5-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647363310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363310, "uuid": "71a94b23-9032-44a4-b0be-8b34795e4f28", "comment": "Malware payload (Heodo)", "value": "034704df789ee6ad7a81d2359c946b9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363310, "uuid": "4c2fccb1-4ae6-4b77-ae66-ec277383b207", "comment": "Malware payload (Heodo)", "value": "0bb73f62ed092263491775a0e5e992375e017257c0f5570f3bec0f9e3e2eb33e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363310, "uuid": "18afbd97-e244-4132-904e-d4e1e491627a", "comment": "Malware payload (Heodo)", "value": "348e7d48fae91f4623a1caf7714b5712c2a3b254", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363310, "uuid": "0cc17b53-df8a-4277-a39c-76a86b23b998", "comment": "Malware payload (Heodo)", "value": "958e74d18acaff3e8e853d926840642b6e5f13b5c1a05541ddaa7e662a85a09daf9f819bbeb90f6f8c49eb95fdc72db1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363310, "uuid": "bf563281-59cf-481f-a58c-876170ea55d6", "value": "T18E257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363310, "uuid": "065bdd12-fa63-4d84-b4af-de82c9410b6a", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363310, "uuid": "4299510f-3b16-4ec3-ab63-90bcb1410f40", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlJOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8tl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363310, "uuid": "bb499c31-e7fe-4ac4-b642-7ab15d54e7c8", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363310, "uuid": "0b7f78ba-6498-455d-892f-7b3949b7fd35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363310, "uuid": "d735e878-47a2-4e67-9e3f-5976b21de86f", "value": "034704df789ee6ad7a81d2359c946b9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e1cfa2-a430-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647328804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328804, "uuid": "069a1005-4729-4f79-badf-a296e63bbd6d", "comment": "Malware payload", "value": "ec46cfb246930dd474196209a38fdee4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328804, "uuid": "ec7b0b04-a080-4ced-9703-c739309105e6", "comment": "Malware payload", "value": "0be691947c0bec056b8a4c8f0a10961e2b0fef1c00d26c5f065dc42f7314d83c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328804, "uuid": "db6af4f5-038d-411f-b871-57a3f5066187", "comment": "Malware payload", "value": "2af0016e0dcaaa96d5307e072012b7ffa55f8f38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328804, "uuid": "ad94ac46-2d35-457b-ae44-fbbb854d1acf", "comment": "Malware payload", "value": "02bb9921ca919c419cd06f510ff7e697d8032127b8a91e3f03d7153f947e274b82ebae69130aaf9c2f1de5b129d06246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328804, "uuid": "3b6091ed-687a-49d4-829c-691c8a0e1555", "value": "T174167E43A9CCB576CB9B02372A94DA3811E82190D7484B02FBFD397ABFC6AD1354E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328804, "uuid": "f95fd128-6ae5-458d-8e62-c3b3be08dc42", "value": "4753904c40d638a1bc745c65b88291d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328804, "uuid": "bce041f1-8366-4aa7-9815-facd4e12e08e", "value": "6144:2wV2VDV2VYV2VDV2VfV2VDV2VYV2VDV2VTV2VDV2VYV2VDV2VfV2VDV2VYV2VDVE:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647328804, "uuid": "5fb6a450-aa07-40de-8f9c-4aaf002d0a83", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647328804, "uuid": "06c13700-cb77-4d7f-b4e1-72a8c8175028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328804, "uuid": "73d587f2-7a55-4bc5-900f-18d56c45cf44", "value": "0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38fa254-a486-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647365952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365952, "uuid": "587724a1-37dd-4a8c-934d-d9d2e50ea6c2", "comment": "Malware payload", "value": "b0864289f09d4f400ff18bccd2fe858e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365952, "uuid": "c529fa93-1c42-47e8-b3c7-845d5de70b49", "comment": "Malware payload", "value": "0bebe910efbed34fe37976921cdece0364c0548ea2938404d3c66287b1b37667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365952, "uuid": "e9031008-737a-43dd-a543-964c56c69234", "comment": "Malware payload", "value": "345ac756ae1b5b3230c5032e96bb4976787fc447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365952, "uuid": "50a79176-5a19-4c50-b69f-7826523859fc", "comment": "Malware payload", "value": "f2d069b48a9f226dc517c23e4a7aa504ed13931d55b07cbd15775ab29ab5abde05bb380c0a63b85c3970fd6eb377db0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365952, "uuid": "ebb8168f-8d2f-461a-a091-62a3f56d66e5", "value": "T1F0B36B9112C7136FCA54F5B1D69D8580C6CF6E223A6ACFCB850D243EDC396E213BAC19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365952, "uuid": "dcd887cc-81cc-4ddd-b244-8e7579d44b71", "value": "cabb359ba9fec61f2974e3f93c3aa507", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365952, "uuid": "1428989b-d037-4264-8625-5b9284a88eb8", "value": "1536:tw1pb8ioaUuT+UPiQMqPNHz7Ekxqk6WMR2kCyU3lAnwkOzNrd/w0BLq8HpQ6+uJl:tju7TNiQMen1xqKwCTVEyzj/66FJt+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647365952, "uuid": "b1f82223-f1cc-44fc-8d40-f7239f70b609", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647365952, "uuid": "510a5371-d6d1-4d5a-8015-d36986c7c1a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365952, "uuid": "4e00107f-0e86-48e1-a683-2cc9dda29e29", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.30373.22850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d4de1e-a491-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647370521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "c9f64811-0f22-46b1-b572-9184f335303f", "comment": "Malware payload", "value": "4ab6020e27fa8ba52eedb1bfa81a70c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "796c18f7-1958-4876-a6b2-c31b6fabe96e", "comment": "Malware payload", "value": "0c44bbe09f91b4b37f26d5f3d85af572ef3cc4ea361636e8b1b19a057518f5bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "eab194eb-7de9-4814-bfc6-95fa2161598e", "comment": "Malware payload", "value": "174aa06579b06f32feb2cd4a413e50e2dc6e5e3a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "fb97c08c-3554-49f7-81d2-6732e18e23a3", "comment": "Malware payload", "value": "64cb4dc55f59f5c2ea6205aee9378c41ca53a546468e1802d5d343cdf181969eae898cee80807e85c48bc24dee55304d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "30173d5c-1d34-416d-bb6d-7677d10083ef", "value": "T1C5E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "403c0840-eb48-4d65-b5f1-35450d74f776", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "2dca997c-069d-4ed8-a2c7-2a8b5ac44de9", "value": "12288:KFxGsTPy4BHT4Sj1zfEf7ABqDLkWynCsZ:obPy44Y1wf7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647370521, "uuid": "ea9e1193-cae3-4d13-9ee5-4bcb5bf77207", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647370521, "uuid": "3eb8a150-6523-47f1-ba40-d7a2af64df1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "443f58de-2435-43d0-a5e1-11f0d4ff5e9d", "value": "emotet_exe_e4_0c44bbe09f91b4b37f26d5f3d85af572ef3cc4ea361636e8b1b19a057518f5bc_2022-03-15__185513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48840371-a461-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349827, "uuid": "eb982687-af8c-49d6-8757-4e4fe6181b0e", "comment": "Malware payload (Heodo)", "value": "7d6168d1dc11baff83440e35bdba4a98", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349827, "uuid": "89b70305-46ba-425c-868f-55928fd0c320", "comment": "Malware payload (Heodo)", "value": "0c5ec75c5ac66da04efaca4cbdc885640d9a6c16aa5658e03aa7589d446269ca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349827, "uuid": "832b8095-80ae-42f9-8d29-c7bef24cc336", "comment": "Malware payload (Heodo)", "value": "d6ddeb5998c36da7b4ffa1d1db29c2a0caf0ff46", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349827, "uuid": "64809179-4498-4292-ab57-e4a7fd2acd13", "comment": "Malware payload (Heodo)", "value": "0eba116c31b39fa4a5379306fb55c85731276f4659ced3aca90d8738c5f6400ed403abb5b3dbaed70ae65d0077f95813", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349827, "uuid": "e0cd305a-ad85-4d66-bf6a-8223d3250d1e", "value": "T1DE33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349827, "uuid": "57a978a5-b4fa-49fe-b557-555ebe0875ee", "value": "1536:0AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:dcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349827, "uuid": "ed5b3da5-d8a0-437b-a342-5c895d828b0d", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349827, "uuid": "915fc4cc-0a54-4454-9d00-af6b0a7681f2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349827, "uuid": "af8c126e-aaa9-445b-935e-ba2ae9762bdc", "value": "gescanntes-Dokument.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db76fbf-a49a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647374451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374451, "uuid": "58dbbc76-22c3-4339-a102-330f1dd0fef4", "comment": "Malware payload", "value": "dcdcf0b3d302215d0d498841d9d840c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374451, "uuid": "ab51f911-0514-47c0-8eaf-077d635c4e6e", "comment": "Malware payload", "value": "0c9e4f6f28f58fa67af16751f72b9520639592a4a775a3ad50c832e1323b7ebf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374451, "uuid": "ea7b5a9a-790a-423d-abdb-455f46ec7a20", "comment": "Malware payload", "value": "ed1110c4313e78bf9ac3882e96c725b46b0c12f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374451, "uuid": "2be822e7-dccd-4e0d-be07-03bcef94d517", "comment": "Malware payload", "value": "0094417821df153403ae52c599a95b5a0bdbd2a01091d362b1c1bba0f026bd19444bab69368e381a2136381e59870a43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374451, "uuid": "a57a08bf-4e55-4433-ab47-1866bddd3288", "value": "T19BE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374451, "uuid": "69520347-bb33-4e0a-94a6-4863d17537ae", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374451, "uuid": "e6eda6cf-a053-40c8-985a-9ec80b337f3a", "value": "12288:E94YBCR2xP7guDo463OP4e3siSOZjb2woE+MhJT:2kRAguDogPTddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647374451, "uuid": "d3d02ea1-6feb-4690-ba7c-dbe31550ae40", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647374451, "uuid": "4780f434-67df-4790-b75a-619748a40a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374451, "uuid": "24214ea1-b6fc-4e88-94e2-6ab1c50bae3e", "value": "dcdcf0b3d302215d0d498841d9d840c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dcb39d-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333774, "uuid": "f5c596c8-b330-4a3c-b914-a818b90f3bd8", "comment": "Malware payload (Heodo)", "value": "952484269c7a567ab315067866490caa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333774, "uuid": "dbef9bf0-db99-4a56-bfa6-c842aaf9bd13", "comment": "Malware payload (Heodo)", "value": "0ca9f1b39049d0a028bc1e56c4a791f0f72e36666cd5200c0b45b484fc326fb1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333774, "uuid": "b5c24c85-d5a3-4d04-a25c-d1e85e0f9166", "comment": "Malware payload (Heodo)", "value": "28c976c30bf3e3956ac80b959d28461d62a26442", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333774, "uuid": "0571991c-b8ea-4249-92dc-9be83633e589", "comment": "Malware payload (Heodo)", "value": "31b5d59dc0573022ddc0efd08f1c25073933959582e0c3c9fa804e4cf612c344b608297b06e35fe27148697ec41ad3e2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333774, "uuid": "19d7d79b-f8cd-4ae6-ac44-c9913d61fc86", "value": "T16D73F11EC532E19ECA2714BDD1CF4FE7A04F79142AC1E4BA9380ED4D2B49E4A674E21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333774, "uuid": "62b4da77-cdf0-4bb0-9d5c-410b8e3faeaf", "value": "1536:wheXF/Sto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMbV6Jr:whUItzSmICpH7OZuvZGsMwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333774, "uuid": "13e545ad-65bd-42e7-a63a-81bc79548177", "value": 75275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333774, "uuid": "4e608d92-f1e2-428e-9973-3de355ffab57", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333774, "uuid": "326cade7-4d22-4113-b116-0c51df252132", "value": "DATEI_025531926.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f7a3d6-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326139, "uuid": "90be44d0-96de-4e29-bf6c-05b5fab8e941", "comment": "Malware payload (Mirai)", "value": "47382d1adf2d2ee78be8025c20a9aed4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326139, "uuid": "9430beaa-0a84-405a-af44-94e909ed1c50", "comment": "Malware payload (Mirai)", "value": "0cb388692aca836263810710905e928580e4b5cd216b58fd1d2a14edc9033d01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326139, "uuid": "b19dc33b-fcab-418c-8b7f-3836147dd886", "comment": "Malware payload (Mirai)", "value": "802f50c242a6f208fbd8691498d426928b173a2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326139, "uuid": "74660228-d36f-408d-9bef-c09a6fd6ea0b", "comment": "Malware payload (Mirai)", "value": "e8615197e8e695f891e8bb7ccdafc9ebb6e6fa25d559c0017426e01c994040894bb444ebaee8b512d78aea846ac23cd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326139, "uuid": "4e6fda21-6c65-4930-b47e-321dbd5eb278", "value": "T1B8735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326139, "uuid": "0319006a-0198-4fe5-9c7c-21d91a2efcf1", "value": "1536:b/DYQYs1ZokODichmx15UzOHIt09bfsH18ruUGDKVQSi:zDhzUkODichm9Uzk40h0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326139, "uuid": "0254028f-3556-4e2d-aadd-af15f31c6584", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326139, "uuid": "b5d3f620-946c-41f4-af86-f64679758070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326139, "uuid": "38fb43fc-0f8e-4520-821d-b19065170c9a", "value": "47382d1adf2d2ee78be8025c20a9aed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7e4811-a492-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647370988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370988, "uuid": "104c95c2-eea7-4638-836b-bc6c0ae42d3c", "comment": "Malware payload (Formbook)", "value": "f65cb753103398f8ebd7354701913ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370988, "uuid": "8b36a6cc-3156-46ea-8e80-fb71d5aed173", "comment": "Malware payload (Formbook)", "value": "0cea3c4ef4eb71c1bf7307d604c7414a1b375bcd2e077cd861695467ccf0fef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370988, "uuid": "2c7bee50-8ccd-45b2-afc7-ee1d3f9557c0", "comment": "Malware payload (Formbook)", "value": "4f797b0abe0bb9a563723b26fac234dd25bd3a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370988, "uuid": "48ff06ff-7fe3-4f4c-b228-0b1034bfaad9", "comment": "Malware payload (Formbook)", "value": "95f1c02a4656cc9c55245b98f55ed4513ff6a0ce0615df26eba8393d9fda9d0cdfa1347842f46589f23fcf808c339269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370988, "uuid": "cd0a8592-b167-41e0-9378-65bb4b115fad", "value": "T1E725DFAC32C4BA8FC663CD76C9652C14EA31747AA707D203914705DDAA5DB9BEE103E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370988, "uuid": "5c12170a-0e35-4f76-b9d5-77083f96636a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370988, "uuid": "67c48654-e593-4004-96da-96c8acd03b6b", "value": "24576:1MPwOJCF7iiiaz9I626sGtMgnT8mme0juo0O:1MPfJCWiX4ottZHEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647370988, "uuid": "baefe32f-a5bf-43db-b1ff-167f127121ce", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647370988, "uuid": "17aff0e5-8684-40c1-a588-0a95b0cb78af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370988, "uuid": "06407000-6abd-4c6a-a6f1-f725f5c7fb80", "value": "nM0P6rOZbadMt2j.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9809714d-a492-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647371006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371006, "uuid": "6c8c1b3d-b107-49f0-a6af-013de2aaefa4", "comment": "Malware payload (AgentTesla)", "value": "8af25393e4c6c91379d729d41cd05df2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371006, "uuid": "d1dc0062-4ac3-4feb-9941-9add7ec1fa0b", "comment": "Malware payload (AgentTesla)", "value": "0d18cd018fb4178ef6cd7fb6a0febd36bd50cab28ead35ec92b102b2c83a2342", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371006, "uuid": "a415ed5f-dcad-45e2-b41c-6fcc3c8952f6", "comment": "Malware payload (AgentTesla)", "value": "9f6e5f7f8c750384ac86aa08ce3f277dea4229f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371006, "uuid": "92490be7-35b9-4495-811e-79b55016775f", "comment": "Malware payload (AgentTesla)", "value": "02c96d33a8e74dd1ca462170d0fe47b974b924256055fef95fc4e80ec87734b7f6f4837ae982aaf755c308f52e241bab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371006, "uuid": "535518e6-57cf-49fa-95a5-09e619efbc6a", "value": "T1BCB2B691D28085E5EEB907B69C37EC05026B7E7DE871EA1D649674699F733C30063E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371006, "uuid": "42bb712e-faa7-4bde-bb39-bd60ac466de0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371006, "uuid": "c2eea669-45b1-45b6-930c-9812c698041d", "value": "384:BAAt+Cdex/3S67oF0DFkrM5PN8KAhhmhxTbn5YqqG7:SAty5pRYmE+xTbn5Qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647371006, "uuid": "9932b4df-17de-4c84-893f-74ce32f48bf0", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647371006, "uuid": "4035cbfe-4fd7-4e9b-82ce-2e36997097d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371006, "uuid": "ba0ab0c6-eb84-4bc4-9381-a8ab31e7a117", "value": "Items.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a42598-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647349252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349252, "uuid": "4b80ea70-6001-418f-9f90-276fd33f4a52", "comment": "Malware payload (Quakbot)", "value": "c792a13f872e0915f1180df663309294", "object_relation": "md5", "Tag": [ { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349252, "uuid": "bb0fb568-f682-469d-a96e-2f3684993368", "comment": "Malware payload (Quakbot)", "value": "0d89ab0b02d0fc989175bbecf32cd39f889c03d02e8542ddc6ca8417e9dd6ab6", "object_relation": "sha256", "Tag": [ { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349252, "uuid": "60858dda-5d90-40c2-aff2-d7227e80a490", "comment": "Malware payload (Quakbot)", "value": "02522552e678ccca9bf8e488a1059892e3c0db34", "object_relation": "sha1", "Tag": [ { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349252, "uuid": "697976ad-9c8f-43d0-8dc9-35b2f75c037b", "comment": "Malware payload (Quakbot)", "value": "bd3d50be6ba3ab9de2893d6c41215ddd5ad848e3b4e0b9f99b08a9dc7b377652caecbfd29e007b6e3117c33c0dd7d988", "object_relation": "sha3-384", "Tag": [ { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349252, "uuid": "f3e9b75e-f1fc-4c88-9a0f-3afabf716e74", "value": "T129C3BE5BA0155F42D66946B4FF071DE81F01235EA8C2B6AE12562C8A3F663B32FCC35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349252, "uuid": "82e09fd4-c5b5-4bdc-927d-f9ab368bd0eb", "value": "3072:0Az2AAfDixLbLdbLwgmfMBs+KjHQzVZcNB:0uwbiQPEBs+KzQLcNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349252, "uuid": "1430cefb-9f4b-4691-bf15-f3fa1f4fb9ff", "value": 119977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349252, "uuid": "c1c0854a-6928-4caf-9e88-e507a7fb351f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349252, "uuid": "c96ddc54-4ccb-4f70-ad34-79d790875a31", "value": "REF-1721783077-Mar-15.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770fb064-a466-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647352053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352053, "uuid": "8d6608f7-a50d-4004-bd7a-6d7272e1c02b", "comment": "Malware payload (Heodo)", "value": "abc99eb1b07539d7acd4e6418a59149c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352053, "uuid": "b37b6ad5-de1c-4fcd-b615-4b0ea5b7f1a7", "comment": "Malware payload (Heodo)", "value": "0e889d938c45d69442a31b0b229aa0adba53d189b6bf1f6d143e58c2eaa68835", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352053, "uuid": "828289fa-e9fd-464c-ac8e-b128ce711064", "comment": "Malware payload (Heodo)", "value": "bedead89c11c2c4dab9bfecf243a8f4743972103", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352053, "uuid": "21f57446-abed-4850-abd1-cc12b176f671", "comment": "Malware payload (Heodo)", "value": "5f77c33ceb0bb1c2a2f276a60adf4346bfbaa6c63d139bb4573b2b48b1463d6e04dba238f540f7eac2e94175f7fe3da0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352053, "uuid": "994c261e-150f-40d5-b2d6-5b9060dd3778", "value": "T1F9257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352053, "uuid": "ba8c7195-312b-4584-811e-015d45746776", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352053, "uuid": "dfff1f79-b6cf-491b-b42e-6636d764f8e0", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlKOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Cl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352053, "uuid": "e6409795-8cef-4f3f-afc7-c7030dfb7409", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352053, "uuid": "1dda9453-874b-495c-a986-6fc6379f9784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352053, "uuid": "c609d0de-406d-4852-ab59-c7149eeb84fd", "value": "abc99eb1b07539d7acd4e6418a59149c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee91987-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326162, "uuid": "02e1e2f2-eb26-4320-bd72-cdd7d2e52665", "comment": "Malware payload (Mirai)", "value": "752dd1ee94a5c5dbdae88cedaeb5617c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326162, "uuid": "8801a657-3185-40bb-8a2a-9b27b77a7e93", "comment": "Malware payload (Mirai)", "value": "0e8e74be607da43c14bebbd2d89381b2ac81553e06928ec9326111dc727d97ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326162, "uuid": "ac4bf67d-b0ef-45fe-92ef-6de150e24cf8", "comment": "Malware payload (Mirai)", "value": "98a86cfb5d58399cafcf087ce3aa524399174cbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326162, "uuid": "e73aa7b6-a0de-46fc-b6d6-f9546bc1e382", "comment": "Malware payload (Mirai)", "value": "daa9872d2f1d7d73cd2b008557c125ddced36c231903a2d742204985eb9f745925fde2c3b0e11f0a242cd1ade71ead5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326162, "uuid": "e6f124f8-6daf-49af-be92-183fb29ec734", "value": "T16673B70A7E329FACFBA9523447F78E11AA5833D527E1C585D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326162, "uuid": "81152886-2ad3-42d2-94d2-8f2cc8a04678", "value": "1536:3IHb8FMv77EKQHlyPR1Fa6yBm3froxvdeEOPFal:Y78ivnEKMyjFa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326162, "uuid": "add0e897-f237-498c-94bc-165cf530f3db", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326162, "uuid": "a6b43d41-e007-41b7-a7df-8c38870f769a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326162, "uuid": "c8ef2cc8-ee07-4089-bca4-a601c388e12b", "value": "752dd1ee94a5c5dbdae88cedaeb5617c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443d7612-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647354115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354115, "uuid": "4bb36818-d362-4d56-bade-bbc4eb9a8cc7", "comment": "Malware payload", "value": "36303294cb58efaeaec2003fb13fe54c", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354115, "uuid": "f3562bbb-8da2-4c13-b097-f046796f8d87", "comment": "Malware payload", "value": "0eb08b7f8cd7fca6fdbc44048fd35528c0db438ac81fe38d3e5966933fe78ba2", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354115, "uuid": "88679838-aaf5-4d37-afcf-d076b29393cc", "comment": "Malware payload", "value": "bb3b21b5490e5d8de8289345967a33361f926d06", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354115, "uuid": "ff47399d-b165-4e5d-b813-284cf2150a87", "comment": "Malware payload", "value": "b67d3273a1e96e236bdcda1a47170223f897e7cbfc9476f849fac192f7488d225c796fb686b280d1c3612cac3a218997", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354115, "uuid": "4fc3f587-6978-46ff-9a9e-0a75ce0b4fae", "value": "T14001B1B12479C2648EB0C333F52B69C39330C1A650F2D3EC644E814EA1E5188CF607E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354115, "uuid": "4b33cff2-22c1-46cd-9a19-47696993662b", "value": "12:x3voQByxH5twMO76JohgesFskSX7KtnGyhnGQnG2nGmSRrF7BA4qkz6gt3I:x3QUyt5twMI6ChgeKFk7KwnBL9hBF63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354115, "uuid": "64683706-3f1c-4592-8685-419d9ee360ea", "value": 776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354115, "uuid": "bd1c799e-7b90-476c-a8b5-547bdafbd4c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354115, "uuid": "aa0ba850-1bc9-4869-865b-4708b401967f", "value": "teS9dEYv.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c1e4cd-a492-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647371131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371131, "uuid": "fffdfe54-374d-4923-8620-729f8a2f8ab4", "comment": "Malware payload", "value": "9c333bf972a7fb7ce2b96c5f8a4694ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371131, "uuid": "be3e42ec-6638-49b7-af07-96a153a2de71", "comment": "Malware payload", "value": "0faa2fd392903e7a4add9aaf7dd8a2be1d795c15aa3571791f11afefd181c47a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371131, "uuid": "26f5d139-0558-4070-80a8-b53d50dca7ae", "comment": "Malware payload", "value": "0ab6921d5cf82b1c2ba44a989614a2fb827fbc92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371131, "uuid": "fa47b734-940a-4dd2-a8f3-1460f65d910e", "comment": "Malware payload", "value": "f31eab2a03b46468522dd239f679bcd02a143593ff2c6fab40f5fd3e97db2ad6bef5ef35bcf0ba21e98e224341820768", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371131, "uuid": "9cfcf31d-9de8-4812-aa5c-5ea0de1ec8c3", "value": "T189257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371131, "uuid": "0d9a4fd9-ed1c-4696-955f-3d03099cc847", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371131, "uuid": "2c3cc12a-e40f-4645-a4be-0d6191f51394", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlrOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC87l65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647371131, "uuid": "6c40786e-9188-42c7-959e-15d1af66d765", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647371131, "uuid": "216c6015-0f99-457b-b3ba-216b391508a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371131, "uuid": "3ba79a57-b9f1-40b9-b5c0-53b653246514", "value": "9c333bf972a7fb7ce2b96c5f8a4694ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c37c128-a461-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349941, "uuid": "ea884ec4-8c0c-4368-92e4-51b55abae412", "comment": "Malware payload (Heodo)", "value": "ffbd8338026404b8d7042cde690d1732", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349941, "uuid": "adf93c33-1c57-4260-8eb3-94a7b97adb12", "comment": "Malware payload (Heodo)", "value": "0ff73411fa40e11a2a3d034b56ba9e2b50932e7f637ef2a9e149ac064270154e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349941, "uuid": "e6973961-732f-45cc-b6f3-0b2558988bda", "comment": "Malware payload (Heodo)", "value": "16824a3d748ae966054f163be3724e80e87cb5f5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349941, "uuid": "fe3b44b3-89f5-40e0-a0b2-223c54b7d809", "comment": "Malware payload (Heodo)", "value": "d2057a1e3a671ea9cf564a0155feb3641d4f72bf97b3743468297a1d75e19168b6838a4dba5041ac872878ec12ac68d1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349941, "uuid": "c199b85a-9134-4328-ac4c-ddffa96e745a", "value": "T1C133D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349941, "uuid": "fe8b8779-ff66-40a4-bfc8-0d2bed8860dd", "value": "1536:UAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:9cEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349941, "uuid": "e3c9fa73-03e5-4cb1-a807-840e32f3d69f", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349941, "uuid": "b753ea3c-0829-4561-bc7d-f610e11ea24c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349941, "uuid": "2cc2b6c4-080f-4ff8-a462-3dc0bd52500a", "value": "Rechnung-im-Anhang.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbae60b-a463-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647350937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350937, "uuid": "a48197ac-6631-4145-ae74-71a592968def", "comment": "Malware payload (Heodo)", "value": "699bd8bec91a55be43d67a10f0f669ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350937, "uuid": "59e354a3-32c3-48a8-9593-94175659784c", "comment": "Malware payload (Heodo)", "value": "100f827425fddebbe86bd8063a639e9151e5bff8de29664c338acd3473047a1d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350937, "uuid": "999a4de7-4346-4d69-8471-00133be9d9f3", "comment": "Malware payload (Heodo)", "value": "392ccf873e98e37adef898aab5259d715e2189b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350937, "uuid": "1b0128de-38ee-4661-969c-94fc9aaa57b5", "comment": "Malware payload (Heodo)", "value": "e6b185229d58a13a31cc98a07922686ac05461efce93c70f4d55441ad62adc055d7ffb0e0966d898e9ea85d43428eea3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350937, "uuid": "c5f63d29-6e18-4f76-8152-00a22151500b", "value": "T127156C0377D3D4F6C6570B3701019A7432A67F628B63D1BB3AB0A97C2BF69D29624712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350937, "uuid": "2a112ada-0107-4359-b62a-ba2258ec05a0", "value": "a75fbf174f418163882037d6ea99f755", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350937, "uuid": "d6353eac-76a2-486e-afc8-0fb2df7367aa", "value": "12288:R8q2m092irmW0bUvW3ZYI3tNZzw2gYGly:R8rrr0bcLAj6VYGly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647350937, "uuid": "03600a92-1221-4f6c-92a8-7924ca4ceb1c", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647350937, "uuid": "0e5c5db6-0197-4e8e-9904-5e5fe372a448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350937, "uuid": "637180e6-49d8-485f-95cd-be995024b4f1", "value": "emotet_exe_e5_100f827425fddebbe86bd8063a639e9151e5bff8de29664c338acd3473047a1d_2022-03-15__132849.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d155529-a3f5-11ec-9275-42010a9c0029", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1647303342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647303342, "uuid": "06ecf7ce-fb82-45e5-acf3-bc6ef146940c", "comment": "Malware payload (YellowCockatoo)", "value": "224111b329069402367824ea687ade9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647303342, "uuid": "ebeeefc8-2334-4b11-80c7-24ce98d785a1", "comment": "Malware payload (YellowCockatoo)", "value": "102319878fdf85e6c178540fc1bbedf61f533e1f9464c085781dbaef6f1e0c3c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647303342, "uuid": "29604347-f2b1-43e7-bd64-341e05e8bb14", "comment": "Malware payload (YellowCockatoo)", "value": "5cd540f21d4a1b30f35599bd7870a694e687f616", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647303342, "uuid": "fb488d67-a1db-423d-87fa-5f5475c4cc61", "comment": "Malware payload (YellowCockatoo)", "value": "c171f85a7aa8d300fd0dafb00b61382b76d7bd2b72ad9695acfff5dca5ce8fb3769c2c77269b26dfe8f7ad8763f07be6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647303342, "uuid": "97a9e301-6c79-4340-9330-bd72cc2f4b04", "value": "T1A7D3D681738DDB90EB6C9AF8F8170330E33450ABC5627367A8717AF99E555A85B042CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647303342, "uuid": "aa29b1e3-e2a9-47cb-97bb-f6a434fad277", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647303342, "uuid": "b93c75c0-a4d1-41a6-a108-2fb55021ab54", "value": "3072:o35/yUpVrMYE5uRov5IyC2/jIeRiz9YAFm0Teu:0/VrMFmovp7/IM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647303342, "uuid": "f9036f6f-edc7-4935-b09e-6c9583f3befb", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647303342, "uuid": "1a605260-e46d-46da-b133-0374cd7ed2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647303342, "uuid": "63b11c2b-956b-4e0d-abc4-c75b0b0f3b29", "value": "deimos.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e6d1bc-a431-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647329091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329091, "uuid": "b9d7171d-8c3f-4237-af0b-7408116914f4", "comment": "Malware payload (AgentTesla)", "value": "5357a3c2a8fbb0e11e6a7fdf569ab911", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329091, "uuid": "a8b5dbff-d3a4-4dff-9615-1a6fdcb15788", "comment": "Malware payload (AgentTesla)", "value": "10340006dca85cd3382940a905e2fa3b8b4d092de8fe41b52a8323456e4ff0fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329091, "uuid": "469a7ee6-17c1-412b-b786-7ffe0acf54e9", "comment": "Malware payload (AgentTesla)", "value": "4a0786484f30954073919f68c6e623dcba4a539e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329091, "uuid": "dbe8a06b-d2b1-4566-af20-7a2449ca34b7", "comment": "Malware payload (AgentTesla)", "value": "efeb15441fea65fea18d67b7ce6e5350d8b6077cd1006bee61a745385ea0b65ffa6437864c8b2b90bd85cee3f2a545e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329091, "uuid": "f39aa531-d9b9-4e8e-a0b5-70f32c41580b", "value": "T133F1D601E3F84B35FEBA0A726897A3408334E712586FAF5F6944134B6E122D541A3FB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329091, "uuid": "cd2cbf0f-b2fd-4e0f-861d-ccaa24766f89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329091, "uuid": "75993b39-5d48-4586-a89a-dddff84e0a09", "value": "96:189cNdm45cfnLVljNWirY7/Ohiagf0JhHlgLSbJxe+KW9BkKhL5rXUq5zNt:18MB5cvzjNWirqWoZsJhFgLYMxwdbUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329091, "uuid": "f784311c-82ef-4a89-bcdd-5f8112c8825d", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329091, "uuid": "e9f9a56e-a85a-4cc5-bd7e-265e2af044e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329091, "uuid": "c83f8eae-2a0e-4139-826a-3ec6cdbe48ee", "value": "DHL-Airway Bill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90cf343-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333803, "uuid": "a97a9365-bdb0-455f-b51c-f75e0c93f0de", "comment": "Malware payload (Heodo)", "value": "ef6a22ecdec69a247641d893d9e4e8cb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333803, "uuid": "d0027d36-e616-485a-ac60-51ffdec9e6f9", "comment": "Malware payload (Heodo)", "value": "10a0cd1de6c90086c8674cfb6001ad8715d6e0e046e03044ba1aa034a50b0f96", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333803, "uuid": "b59d7b0a-c796-4831-9e27-5395cefeecc5", "comment": "Malware payload (Heodo)", "value": "b12d5ef53b0367c6886e957ea3000746d5c72a4f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333803, "uuid": "bb71bd4e-c845-473e-a7ea-8db438f40c9c", "comment": "Malware payload (Heodo)", "value": "cb70688ddea318e4969eb9371b67bfeb9fdbb026663d25096fd7fc4a9ae2a87eaebeb3c750a7ffffe395694adc50c859", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333803, "uuid": "588cfb64-d590-4ac6-a22a-71003a4de74d", "value": "T1C573E11EC522E19DCB2700BDD2CF4FEB948F75153AC0E47A93C0E94D2B4895AA74E64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333803, "uuid": "68626824-2ca1-4df8-b637-44d68e3e0cdf", "value": "1536:6S3FXUcSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM7VI0E:5310tzSmICpH7OZuvZGsMnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333803, "uuid": "2b976bfd-44d9-40b6-84b6-d04f84b27355", "value": 76170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333803, "uuid": "50dfff99-0758-4ccc-a52c-f0b7bd956b2c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333803, "uuid": "e4246f10-9a9f-4141-a01f-8bfb1e4530b7", "value": "Info_05805.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d4280e-a459-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647346461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346461, "uuid": "4f24ab7f-26a1-491b-adad-96ec349f928c", "comment": "Malware payload (Heodo)", "value": "69a718a8bbdefda5a014af4fee522e3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346461, "uuid": "cb0034fd-13ba-4348-8c12-eea8b2eb0b02", "comment": "Malware payload (Heodo)", "value": "10a6857558b644397cb60a2eddc0240b64ef0fc7f269a4ea6516fc8d74ee5ea5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346461, "uuid": "528fd0cc-cd48-4396-90f3-7e43d361cea2", "comment": "Malware payload (Heodo)", "value": "adfe6dfcf2890ef9f1dd90885e77bdadd4b47df3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346461, "uuid": "6cb4d166-0fdf-4319-8a50-16b9736f6f68", "comment": "Malware payload (Heodo)", "value": "84b2f2092b7790631bb38beefcdf2ff0631f4790942aa8cf0589d8b6ede63609930dc1b28839390642bf662a1406082f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346461, "uuid": "cc642d5d-4a29-47c8-853d-9c3d5b498f15", "value": "T1BC257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346461, "uuid": "8e418648-0f13-4f48-bee2-47829a77697c", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346461, "uuid": "806cbc5a-dcf6-4ed3-96ac-9f73fa7937d7", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYtVP6FuR6shQLj88F+Krf6:v6oycln8cACigP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647346461, "uuid": "04994123-e480-47be-a6b9-2dc9bbad2e19", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647346461, "uuid": "b2d4263a-9d19-4e40-bdbd-f7e601a9743a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346461, "uuid": "725e7acd-3aa9-49c9-ae48-a155bf9b2ec6", "value": "69a718a8bbdefda5a014af4fee522e3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cf7dfb-a47d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647361986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361986, "uuid": "414b7def-ed65-4080-9bee-6245572109b5", "comment": "Malware payload (Heodo)", "value": "b1dbade8f293da96c94a2a51c6c8a6a5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361986, "uuid": "02c70f3f-769b-441d-a1a0-8a9c0e0fe414", "comment": "Malware payload (Heodo)", "value": "10ce50d6faf63448186dd63cc6ed54337dc3a3578fa999351bebd403347b16b1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361986, "uuid": "2fe645ee-7f88-4016-a0db-724590badd30", "comment": "Malware payload (Heodo)", "value": "6ff6e2a220938c7515db86e78dea4c7e1e58ee3f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361986, "uuid": "b48f2144-ef4e-4fa9-9f6d-774f9189e639", "comment": "Malware payload (Heodo)", "value": "38324cee49c6f88aa636a814d52b313eef3b55a248f20d24a339761d7d8721027992c96ec69a06106499db11519e3a09", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361986, "uuid": "550181a1-df7c-46fa-a80f-29183a3d3d84", "value": "T17D33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361986, "uuid": "7733987a-224e-4563-a187-6ee1cf77e410", "value": "1536:YAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:BcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647361986, "uuid": "6a82e0a7-7508-4c83-b69d-a4e79e56d2e4", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647361986, "uuid": "96ecc7fc-bf71-417b-b0c4-977a04f7efc4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361986, "uuid": "92368706-e7a2-4f1e-b78d-4bf94f675f22", "value": "Rechnung-im-Anhang.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0eb557-a48d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647368951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368951, "uuid": "2dd2b5f1-bec5-4d4b-8019-5847fce7dc18", "comment": "Malware payload (Heodo)", "value": "b2504289a3bf0da0ef9afe416706b63a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368951, "uuid": "772daa2f-d06a-4304-890e-287c009337f3", "comment": "Malware payload (Heodo)", "value": "110c96632c9e9d7a243aba0ac562750aff97248ab8cde00a0ed2d522331b52ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368951, "uuid": "0fe4ceb5-e449-4f4f-a7f6-cfea925aea85", "comment": "Malware payload (Heodo)", "value": "98d14a6e163d5df2d295cdcb02ba6bf175182112", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368951, "uuid": "8e198471-acbb-473f-bd21-eda05a61c1e2", "comment": "Malware payload (Heodo)", "value": "495b9e0ad7602acf7640696bb1b09d40a95e1d7abbe6f140c3f7d0c66db8b150eaf4a24212a1e31c8ae85ac36afc6b5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368951, "uuid": "ebdbeb22-ae34-4112-8046-d5779855b467", "value": "T108257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368951, "uuid": "6e38d299-5246-4036-9280-1515907aee76", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368951, "uuid": "e85e3144-9aa1-438d-81db-5413b344b292", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHY0VP6FuR6shQLj88F+Krf6:v6oycln8cACirP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647368951, "uuid": "a20f87e0-83c6-4cfa-b15a-a5752c4f0ad3", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647368951, "uuid": "3e052d4a-96c5-4b07-8094-fc80a2b0f443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368951, "uuid": "cdb79c04-a8a3-46c6-aa33-e378a0f3a9bc", "value": "b2504289a3bf0da0ef9afe416706b63a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a009bc-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647354580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354580, "uuid": "3f7bd509-afc9-448e-94c1-d1e8e3719b9e", "comment": "Malware payload", "value": "225c7c1041138c9dd1927eeefd298f2f", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354580, "uuid": "8569695f-b7f3-4886-9dcb-66d7cd064c7c", "comment": "Malware payload", "value": "11320aee1d6e4e625d457cdde1973eba4c7fbb5c26b0608c8e4394f4be8a45a8", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354580, "uuid": "aa52a78d-9878-4b34-8c30-5f1a72c24f89", "comment": "Malware payload", "value": "046f79f4dea89fb9ac2405b67d9767644f5a44ed", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354580, "uuid": "4efb7b85-52cc-469d-be6c-7ea413cd939d", "comment": "Malware payload", "value": "3b1a5c5be044d892ffbcc3855a0c1c1814b403ea18e61ebac6f4402770f4ae98380c77619a51e2f2609be87eccb25f99", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354580, "uuid": "f9c58b53-82ed-4110-a270-aa755d40279a", "value": "T16801AFB12469C3658EB5C323F26B69C2D330C1A650E3D3EC749E814EA1E5288DF617E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354580, "uuid": "1b694807-9629-421b-846a-af6bf093b4c8", "value": "12:SXCUU3voQByxH5twMO76JohgesFskSX7KtnGyhnGQnG2nGmSRrF7BA4qkz6gtIG1:1R3QUyt5twMI6ChgeKFk7KwnBL9hBF6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354580, "uuid": "0913feae-abef-4fa1-ab75-4ac58e6d957c", "value": 845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354580, "uuid": "46f553ef-16ba-4790-b148-ed336bdaa7ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354580, "uuid": "868754d7-ea5d-478d-8c34-71a67756364b", "value": "Wgv09uSk.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f388c5-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647333829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333829, "uuid": "3d7c8cb6-3b5a-41cd-8d87-d6207825ac64", "comment": "Malware payload", "value": "3fdc3dac72366d0c669e69e733a810dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333829, "uuid": "089d1005-489a-4eae-b04b-5ea625b21cca", "comment": "Malware payload", "value": "127e1a85111e4ac4745367168789e97408e93921b7fb41d5c77964fab957e85a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333829, "uuid": "9f0016e0-4864-4d1a-9859-d6ab6190b170", "comment": "Malware payload", "value": "d05efb17183cea6b81aaa70ceec7113c63328044", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333829, "uuid": "9ba400bc-091f-4910-b3d3-416c4d882110", "comment": "Malware payload", "value": "0d533157673953bc00089120bd0f538848ee7d40625ae326c279ff5546373b6f5839f3a3670c773e60b584c7f27bc119", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333829, "uuid": "1a52b7f4-13cf-4660-9fbc-0e0183f774d8", "value": "T1CB526C3DD4A78298CF4865F82A236D44599A3B6CD3DED6233ABC3770275292F9427078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333829, "uuid": "8402a618-6fee-4adf-ab3c-211a798089d4", "value": "384:t12csZ7CilldvvqQRjzVR1n+ChKIZF+NMu32+ej3t:sRxLqURj+ChKScGbR3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333829, "uuid": "4ff56714-7d30-4790-8212-8abaedfeaba0", "value": 13331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333829, "uuid": "3e56cccb-c4ba-4351-be20-8bdc264e2ba0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333829, "uuid": "d1e047db-f12a-40cd-8c58-a1288996a010", "value": "PO#78653_1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50af3f16-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353277, "uuid": "c927a23a-c1f7-4191-9633-b1f44110a301", "comment": "Malware payload (Heodo)", "value": "2abc57d9889fd0918f3011a8d723c851", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353277, "uuid": "e3b0a529-1e1d-49dd-b283-8341bf0f511e", "comment": "Malware payload (Heodo)", "value": "12c7011701b830f3f3de8af6e827fe14ed83edb43160e2bd13d90c33eeb567fd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353277, "uuid": "190a3af8-1339-4736-a6dd-ea18754a4c7e", "comment": "Malware payload (Heodo)", "value": "c30dce37d800cd28f920116738f8c6a83af79dbd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353277, "uuid": "1fca551a-5b3c-48f0-a42e-114a535288e5", "comment": "Malware payload (Heodo)", "value": "2055f91a676fb8fa02062417333ebba287dd7ea2288dafcc99f31b2f4b2699b9d202670f418298ef56dce25767670b6d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353277, "uuid": "af06eefc-da96-440c-82e6-d62928ba9d04", "value": "T16D33E01F9522F5ACC3136C7DCA4C59F5650D5893E089F62B08857B8CBB1B2E7178F286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353277, "uuid": "5b4dc825-543c-44bc-930b-3e8013886eab", "value": "1536:bFmPpcEglt24xZdRBzH9hJBrdEwwNXekVIc07:J4cEk2Kd3zdtdEwoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353277, "uuid": "1c65bd35-def6-42c0-a6de-a816cde292e0", "value": 50551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353277, "uuid": "8500a9a0-eb6c-4c05-9565-ab6f13f051b2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353277, "uuid": "a5bd7af7-9426-4d2e-8398-345301915609", "value": "Insight Medical Publishing_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6af5d7b-a469-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647353475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353475, "uuid": "8d5b5a2d-b376-4549-9610-35a20a860ac6", "comment": "Malware payload", "value": "f64cb8cc23f20ad38a34caa4c8ee331e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353475, "uuid": "b2b37bc1-ccc6-457d-bec4-dc0e175ea316", "comment": "Malware payload", "value": "136e81ce8d2d1381c9e3ccf17a68e1cfe07cc56ed2109b58c6edfdaca1c4ece3", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353475, "uuid": "b3a920b6-f2ca-4835-8030-c6f699be2c47", "comment": "Malware payload", "value": "142d36b62930b27ac19cb12f21b35310670b5ece", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353475, "uuid": "a77046f4-9310-49c9-b9ef-632088713ee3", "comment": "Malware payload", "value": "919ec6e99872ecae39fcbd527688893ab36f2a423dd4b4802bec2a92b13ecbd2f90894dad298a65b1295e340ff26626d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353475, "uuid": "e4725adf-ef37-43ba-994a-98a34906f81b", "value": "T1950412F1364E9164CE6AA236A4020A6C7D38FFB23D5A87B4B065770D47347834B972DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353475, "uuid": "dd5fe6b8-299f-4c01-ae87-df450159a3e5", "value": "3072:a3IMoIPkwtouuA3uT49WHAIgFOeV1+ZZvtztaQ/EONRDtjum:gITNwOXAyStIAaZbTsONR9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353475, "uuid": "9328a4b5-0b18-4dfe-ab17-7798fb4c608a", "value": 190216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353475, "uuid": "8a10fd75-4045-4312-9d6f-13df29c35498", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353475, "uuid": "02d95fc5-227d-4db6-9b88-d5a3d197c944", "value": "HPL-WCL-017051.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1508475-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "8267f960-8a5a-4e7f-840a-85300dbce27b", "comment": "Malware payload (Heodo)", "value": "0c9db96a16d2797ea61fecf90b7ea87e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "7c7b30e5-c726-4e36-a1a9-ba82db5e351e", "comment": "Malware payload (Heodo)", "value": "136ffd9b96eb477a061337293088ae4a139766394a0a6a3ba51eb9211455d177", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "699bd56e-23c4-4209-808e-f9abca57ae85", "comment": "Malware payload (Heodo)", "value": "b5467ab9ddee4791d86292e279204f3db8a9fdf8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "fdd7d33b-6b0f-4b5c-8d36-627f3b514418", "comment": "Malware payload (Heodo)", "value": "859e35bc65b5b3eb5b3435a2d95ed6af111cb37b285a80d4db9a44e2bfc1ae6c09cc472afbde61966aee0015827f00c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "9e4ead2c-5a54-46de-a71c-b6ed10a57246", "value": "T1C4256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "2e2ecec9-3987-4f8e-8c19-07a3b0502d71", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "0dab2888-d403-4718-b587-8d349dc0b1c9", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk10WGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6iWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302839, "uuid": "8576359d-4a74-4109-a587-d32322739c3c", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302839, "uuid": "b9e205a2-d30d-43a5-b04f-cae990e34bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "10755e93-53af-4022-8665-c8408b80471c", "value": "emotet_exe_e5_136ffd9b96eb477a061337293088ae4a139766394a0a6a3ba51eb9211455d177_2022-03-15__000708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2774c7f1-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647353208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353208, "uuid": "2eb33b0c-1bdf-41c5-aa24-eabf83dbec22", "comment": "Malware payload (SnakeKeylogger)", "value": "b337b161ec36f64c2bc64a241974bd76", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353208, "uuid": "e6e23277-fed1-416c-8395-26453e9035a1", "comment": "Malware payload (SnakeKeylogger)", "value": "139caf726cd0e8bdd5d0e244c2f34a926662f67833253a33822bf73e088f7f59", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353208, "uuid": "f9e0f521-090e-4d8e-a1ec-82c72c27c561", "comment": "Malware payload (SnakeKeylogger)", "value": "3157d5bf6682932b812e0e4f680d8db92dd213b2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353208, "uuid": "b9feab55-db03-4461-9cc8-b68b0425e430", "comment": "Malware payload (SnakeKeylogger)", "value": "b81f01141f85fe8e5bb1d1ac17f4888dc92cf331cde02350859fb1c7160036beca4c54c9eabb2735faa49b2b820cbec1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353208, "uuid": "b45c628f-e5a2-49d4-bc9a-18fa59643fe3", "value": "T1C371081453B9ACD2CC2059F394B1FD1101EAF5A79BCB1090776EE9E60BB33AB0B17848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353208, "uuid": "34c08dab-27a9-4a24-a8ee-6e3561fa6888", "value": "96:aGvsG6OXXkpMivMAoRFKAEXIwzz12Ps6bvYO:Lvt6OX0pMTFR+IGR2dbYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353208, "uuid": "d580e1c5-0351-40a1-8679-e1a565887743", "value": 3754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353208, "uuid": "ae8f5355-6d9d-4ec9-9d94-7ac31f3926b1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353208, "uuid": "7f8d1216-de29-4413-bcab-551b49cffc79", "value": "Tetra Tech inquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380a78b4-a43f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647335197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647335197, "uuid": "3a760263-f3e6-448f-abab-fafe16defa73", "comment": "Malware payload (Loki)", "value": "5ea83735198ec8b82975846ed25793a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647335197, "uuid": "998f96a2-8993-48fb-91b2-e1f6e52f63d0", "comment": "Malware payload (Loki)", "value": "13a20e11cd5a555f254458a08800d84b16cbc42871e9b26baef8b5e8ec958557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647335197, "uuid": "0308b8a8-0cfd-491d-ae24-84003203f1d6", "comment": "Malware payload (Loki)", "value": "244f8d70e96b905cb4d29e271ac2c521facd4a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647335197, "uuid": "950ea27e-4fa7-49fb-9dde-6aaf71e83fe6", "comment": "Malware payload (Loki)", "value": "756db8e538f2b540a55e8948963bf8c7ad399c899af449e7430bcff4ef7cc5d4caa8ab65e21a10df0c77ee91fcb3c3e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647335197, "uuid": "83e46024-0d3f-4ac8-b72b-d3c6d4492314", "value": "T13CF4020A73E85F82F0BACBFB85221A4443B6B229591DE7495DD330D719F6F008795B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647335197, "uuid": "887d72da-dfc4-49d2-b765-632dd08b80e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647335197, "uuid": "7f1f4fd4-72fa-41f0-9a94-82c7c03fc413", "value": "12288:gsmekwOEocExB1OQFnS+YwVM1EfxaYvJY/0Gdr8sJk7j4/wsH0rFF5mPG8:pmdwObw1ASWxtaH8sJk7j4/8fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647335197, "uuid": "8c0781dd-7ccb-4932-9ca7-8cd5821fa799", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647335197, "uuid": "76ca3da1-d226-48db-8840-4c30a03fcf93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647335197, "uuid": "04cdc1dc-a020-4b27-aa12-4d0bb4095b92", "value": "ASE048473.BAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3592381c-a450-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647342494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342494, "uuid": "54be1fdb-b091-47da-b20e-c065a33ea950", "comment": "Malware payload", "value": "2debfdcf79f03e4a65a667d21ef9de14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342494, "uuid": "8fb19b98-86b0-4a79-82f1-de5768fd49d1", "comment": "Malware payload", "value": "13b896d551a100401b0d3982e0729efc2e8d7aeb09a36c0a51e48ec2bd15ea8b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342494, "uuid": "0361031e-9ac2-4d58-9220-48bcd0c913ad", "comment": "Malware payload", "value": "4c49b08e9b258e0e5867d76ce583c159597b6857", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342494, "uuid": "d47796a4-65f0-4eee-a18e-cc97aac0d190", "comment": "Malware payload", "value": "ec10b8aeb960e0d6cf885cc8d8eddee5b93d663a7d9310bef5cd1ae4a59d93a42beae885a56421b0f0e49118bd2c84bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342494, "uuid": "1047eca4-a95e-4983-85a3-d55384e491f2", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342494, "uuid": "3d88bf07-ec90-40a2-a24d-23c2b8477808", "value": "3:P:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342494, "uuid": "81188b4b-7a04-484a-9de8-abcd36945d62", "value": 5, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342494, "uuid": "086d394a-4c7a-48e2-a76c-2e55dc66bad7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342494, "uuid": "dc28cb2e-c24d-49ba-abd0-e7d6216e442d", "value": "text.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1776969a-a3f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302930, "uuid": "291cb4e9-62de-4a3a-b2e8-36a96cc59234", "comment": "Malware payload (Heodo)", "value": "4f50a68b8d27fa3628a0c664a2be73cf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302930, "uuid": "cc4a2459-b9d3-43a9-a73c-930ab808ce4e", "comment": "Malware payload (Heodo)", "value": "13bd072f3fb77dd7a3c959dffcaa26f77048ce94b48e37945828f352472bc3d7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302930, "uuid": "4089ff75-0e55-4089-82cc-7c07a1c04a66", "comment": "Malware payload (Heodo)", "value": "964923e8ccf8795ae4fca956bcadde709c1ffb45", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302930, "uuid": "f954aa6e-86e1-4987-831c-49917101d977", "comment": "Malware payload (Heodo)", "value": "e5b37b68148c7e3731c5dd7dc130df05e10277b5aa2dd17e8743542d716b3f080f418f7c8176ad0c7a893520300f0e44", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302930, "uuid": "a24cbbb7-b3ae-4bbb-9fc0-9b317a05b72c", "value": "T18873F11EC132E55DCB2B40BCD18F4FAB940FB6193BC0D57A53C0E64D2B45AEA534A25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302930, "uuid": "914df73d-8305-47b7-874e-04464523c451", "value": "1536:oqSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzB3g:o3tzSmICpH7OZuvZGsMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302930, "uuid": "f746e51f-2020-4352-80a1-b16ce83e2696", "value": 75909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302930, "uuid": "50789fe6-5dce-48ec-ad05-d82ac193606c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302930, "uuid": "f6a51be1-8f77-40a1-a6f7-db33aa97f40f", "value": "Mensaje-3027007.zls.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74144e0-a456-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647345369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345369, "uuid": "2ff9afb4-9d0d-489f-851c-c49de8bd67bb", "comment": "Malware payload (Formbook)", "value": "cf357be3d21bde8728dbafe607aa9c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345369, "uuid": "00a6e043-d7f9-4c33-b413-5686ccbf6229", "comment": "Malware payload (Formbook)", "value": "143b1ed85fcc55420dcabccf16e229733eef4a3345c1a82ef4d668242fc2b700", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345369, "uuid": "b905b359-14b2-4db8-a367-e1db50ace579", "comment": "Malware payload (Formbook)", "value": "201ff0b3b306edae4b00cb4f1958b713cc58fcd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345369, "uuid": "82af3d61-f4cd-491f-a569-a22a8fce8211", "comment": "Malware payload (Formbook)", "value": "f5dd0a4ab3cca7285633288e3107b1e6afca9eab91672312f84e07077d0db7ff95664ed4f2ed81e23670385bcc9a623b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345369, "uuid": "2ed8f82e-9509-4e75-8b65-935629aab35c", "value": "T19525BFE96EB595F2F26F15BD08A79E78C2D1EF51D671611E3C28825086FFA00C0FB606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345369, "uuid": "e94458a6-ce71-4d42-b4bd-4d7ea6cd628e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345369, "uuid": "d8e09720-9078-446b-a196-f91c0912e0a2", "value": "24576:nK+zGJm7It0lB/ni3jEE6zpeZp0nxpxkih:K+KJm7y03/Ae4ynx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345369, "uuid": "403d4376-2ef7-4cc9-84ca-16b277d465cd", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345369, "uuid": "861585fe-1383-4110-9d3a-dfc946fed170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345369, "uuid": "fa59ff2c-12bf-4f2a-a403-70798ee1bc5e", "value": "TEKT_0136205,PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2f48aa-a3fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647305998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647305998, "uuid": "be6b0a1c-c304-42d4-9a88-aea914e39666", "comment": "Malware payload (Loki)", "value": "0031dfd9187e1ead59c63d61d78eea93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647305998, "uuid": "1dde7de7-e91c-437e-9d21-2c041bdf2fdb", "comment": "Malware payload (Loki)", "value": "14abdae343bd06a73ef28c3f094a883ea36e52540d8b5c9755e780a4fb1c9edf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647305998, "uuid": "269d549d-7cd7-497b-aa13-2fa1eec93481", "comment": "Malware payload (Loki)", "value": "df67632bc134441d119385b8c37e605433332a60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647305998, "uuid": "87253e8c-87e2-4a91-9e26-fe9d5acc54e1", "comment": "Malware payload (Loki)", "value": "aa77a901c7ce446575751c02c2c6b554151026905ef83af3ecb7d665523f1e0b8ded52ac6a06f431b875e31130bddfc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647305998, "uuid": "af8521e2-14d6-473c-9845-8e8a35b152fd", "value": "T138B417526B880004E2E3357B6C1F539065E3AC1F39985EF9677BF2DA26773A87CA111C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647305998, "uuid": "822c8e00-e31c-4cef-970e-dbe17f753004", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647305998, "uuid": "cc142786-a0d3-4fe4-81d4-155c36ef0448", "value": "6144:CGi/goYHqrn2P7WYSj6xTdfuGWwLiCwKK7NERB7+3F5qpx+tYRU:ygoYNflKNERJ+VMxMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647305998, "uuid": "37a8dd95-e3c7-487e-aeb3-a7c319a60353", "value": 503719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647305998, "uuid": "39a91b9f-e919-48eb-83c7-a61706044d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647305998, "uuid": "e90681c9-2db9-4746-b9cd-4239c7bf44b6", "value": "0031dfd9187e1ead59c63d61d78eea93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1783ee-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647363280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363280, "uuid": "0c38af77-ac72-4f61-8d04-537f8f6b1448", "comment": "Malware payload (Heodo)", "value": "74c80770e3286e3ea0a86eb054bf0110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363280, "uuid": "bb038b59-9620-4226-849d-1e861486909f", "comment": "Malware payload (Heodo)", "value": "1553472a12dbd446ab90b1f9c6de31aeed56a8d9a134b23055f286c13fa44539", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363280, "uuid": "ce228ea7-666b-4960-b77a-a1675aee7a79", "comment": "Malware payload (Heodo)", "value": "744811aca83c627e4c18e89ec0afa4fc661144fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363280, "uuid": "19809ba1-d05b-49f9-906d-a886d54df3c7", "comment": "Malware payload (Heodo)", "value": "d1872783572e11ebc5f3049621c5c6d458f0079ba9fe8de5d00ee41a66e6f4c63e0279ea9adaed1c3abde2fc1f41a3aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363280, "uuid": "0d03a8b2-b69a-4f5c-87f1-fb7403039a61", "value": "T1AC257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363280, "uuid": "924eb197-baea-4bf1-b3e6-8b595a4531c8", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363280, "uuid": "a636cbb2-1a8f-4295-87a1-cac32bb2677e", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlWOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8ml65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363280, "uuid": "932293ac-3e68-4fc5-b766-b99da9f55d52", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363280, "uuid": "646965ed-2b62-4c75-9a83-116d23fb2fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363280, "uuid": "86ae87ac-5710-4487-80f3-7cc2e7523846", "value": "74c80770e3286e3ea0a86eb054bf0110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3eee1c4-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353524, "uuid": "e0502263-5ff8-41c9-96da-fdd39ddba408", "comment": "Malware payload (Formbook)", "value": "1d1969d9663176af2ea3574d10417f3e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353524, "uuid": "d5862f9a-e81e-4586-a118-7ef3c35a6606", "comment": "Malware payload (Formbook)", "value": "15e73aadd7d7edd2a9f09e04b017ba66130bd8bdff00c2b6aef3443a4e9dd675", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353524, "uuid": "2c7a39b7-756b-46fb-acda-6d6172c9cde5", "comment": "Malware payload (Formbook)", "value": "01cd236cab14dac09fdc2305f5831ceddc7e8c09", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353524, "uuid": "889ec621-3f5f-4196-8389-17d05930056c", "comment": "Malware payload (Formbook)", "value": "64e2192769fd7df483f03533807e0eb49d2c2245980f26eaa228ecd9c279a9aaf1288aa0ad9e05d06e38ac0834248db7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353524, "uuid": "7ce62db7-28f2-4104-87fa-eee85ba0f2a5", "value": "T18014120C3D952F99F236A3BE0460F884205CFD74E9DAB852B04DF56E4A3644CD69B277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353524, "uuid": "9abc2dc4-42eb-4731-a885-1f829ae8b9a7", "value": "3072:OiJzJTdWqEuDgRu3cvXSUwsQW4T1REmX7nl5RcHCx63Yht2NY+/vCYzc+zRJo8:jVTdWqEuDYu3cfrQ2mLCYht2N/l1c8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353524, "uuid": "94d1802e-2582-4e3e-bc25-8ddca5c4b9cb", "value": 190744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353524, "uuid": "a82f4965-c5e6-4f61-8a37-2ac88ca79f17", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353524, "uuid": "6657465f-976b-4c24-a5a9-47dbd14fe3f7", "value": "producten lijst.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06ba44b-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "81940c03-3c05-477b-93bf-45b987285d6d", "comment": "Malware payload (Heodo)", "value": "42425ca738656e64b552e9c8f46d8140", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "14c21200-e8b3-424c-b31f-f06ea9d89493", "comment": "Malware payload (Heodo)", "value": "1652855b45a26ae2af4718d582cc2ff519869552354a830136e24d5d54388936", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "03b09f69-4947-45ad-aacf-6c4054e3349c", "comment": "Malware payload (Heodo)", "value": "7661f7e5084074d54a1b3392e0c064695ab82a3c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "5f3dc681-73e5-4df6-b873-e192265bf277", "comment": "Malware payload (Heodo)", "value": "53111f9b7aeada103e14a87c91bbd69ea9c1b32253dcd6bcd8836146b4ca30016baf7afd5aa21a2e03bf70ae5ca6e451", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "19e9cd9e-f192-4596-ae62-0d7e9a1b9476", "value": "T1BF256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "238d862b-9653-49d0-9d30-c6b309f4f276", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "9c74e901-93f9-4dbc-b302-3a381485d272", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1SWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6QWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302837, "uuid": "56facf68-70ac-4f47-ac65-c8ce2f04ed72", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302837, "uuid": "fdf0e1db-9ea2-4219-a78e-5cd80d971fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "2965d48d-9264-4637-89ce-7e43809cba9b", "value": "emotet_exe_e5_1652855b45a26ae2af4718d582cc2ff519869552354a830136e24d5d54388936_2022-03-15__000708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ce8f7a-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647353207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353207, "uuid": "06927f41-b9f3-461b-988b-5e8082f9debc", "comment": "Malware payload (AsyncRAT)", "value": "05cb0105023aba7f791601c53cc4dbc9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353207, "uuid": "60206dfc-c9bd-4e9e-a8f8-bf6aa6610029", "comment": "Malware payload (AsyncRAT)", "value": "167ab63563aa66280fe2c4462e0f1c6214c4fd061ec60f1fda236a6d96c0909f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353207, "uuid": "93435d56-723b-4c5c-9d3d-742bc14487e0", "comment": "Malware payload (AsyncRAT)", "value": "efc92228f854a371b67517bf4e3e3ddd04ce52c8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353207, "uuid": "671f588c-17d3-4727-b9c4-0c8f98a8ceee", "comment": "Malware payload (AsyncRAT)", "value": "474437fbab349a0d9a5512a2d9c7632d0f096572a12c4c1d93777a6ee943317d6f5fd09afdaae7a0e5bb843a1947c6d3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353207, "uuid": "b4758419-c0ea-4653-9574-38e043480685", "value": "T1B0126B7163192A93C407D6F3C96EFD67A586F6D0E3CBA800325CFE2513271248AF9446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353207, "uuid": "c0fc7596-2f29-4715-91b2-01f5a6d6f2e9", "value": "192:BXfn8/JCsufA6cqHdLDejRddt1/NRa6FqnsmvNoKwDafUM7/rr1INBpwLZZKK:BXfn8/BYA6ZLDejRdjzRJEJwDaDr+BpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353207, "uuid": "98ef718b-afc2-4129-ac37-be55d1257b7e", "value": 9672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353207, "uuid": "d23b42ea-8d40-4a98-a86a-62d173d6c748", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353207, "uuid": "c7f0cf39-17e8-4e66-a950-024a67b8db50", "value": "Fancourier 09032200754RO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ecc00f-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647334205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334205, "uuid": "c59fe3e6-5f43-4386-b6fc-5627c0032b97", "comment": "Malware payload (Mirai)", "value": "579e4aee38d8ba27e482d8efed2237f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334205, "uuid": "40236545-7aef-40ce-94ea-f3c20a0c8f1e", "comment": "Malware payload (Mirai)", "value": "16a00e3289a2fb34b159024b6fa6853499c4d3fce3c371a499461ec25eb339a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334205, "uuid": "bac612ec-a19f-4e1a-ac91-524b9b74c5cc", "comment": "Malware payload (Mirai)", "value": "0cc89bc637a0315103b33d27cfe1edb75c84e0f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334205, "uuid": "d286d8ea-3e13-43ea-87ef-bff8716c76a6", "comment": "Malware payload (Mirai)", "value": "fa4f848ef66147c4d31f674456537c6794aad84af9ae14b8ae06227fba95042706c3e13cc9a6a3e77e29fbe5dfe98113", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334205, "uuid": "ce044077-58cd-4c4f-9547-2330fd1a2c17", "value": "T127D34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334205, "uuid": "31d2fda9-4d32-4159-9473-9d2ef94f1627", "value": "3072:f0DvinprSHrDqtVyvB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDeyHJxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647334205, "uuid": "d19dd322-ad0f-43c9-a73c-2805acf08d4e", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647334205, "uuid": "4ca52083-2372-43ff-9c88-dc0be916c4ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334205, "uuid": "937ba4c0-dc8a-44ea-a0af-89f7b4295f46", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2335c77a-a44b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647340316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340316, "uuid": "0714c375-0d52-44d4-9715-e07097a48d97", "comment": "Malware payload (Heodo)", "value": "94c2a7e395cf92bdf65bcb034fe3c18c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340316, "uuid": "0ba580b5-f617-4fb3-b4dc-5604cdb77845", "comment": "Malware payload (Heodo)", "value": "16a75c682a9983ff6a6312a9fc4f7d8ac57cf75d5729d5c4627762fdba32f044", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340316, "uuid": "fea701fb-e4f0-4ec3-8c3f-a73d51521d7c", "comment": "Malware payload (Heodo)", "value": "52a4aad88356c9ea160985fb2747ad6948590ec6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340316, "uuid": "41d67708-d68a-4e17-b410-8ed0ab14bceb", "comment": "Malware payload (Heodo)", "value": "f90c8f9e1313c88f6b8081c71a9fc677c67b73a9ba11ca3913e01d68a19d26114a3c507fe4fc9a2a504b46f22f785bf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340316, "uuid": "e2836535-9fcd-4043-8005-ef198b231748", "value": "T17B257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340316, "uuid": "cee89468-9f51-47bb-82ee-599d91c114f1", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340316, "uuid": "6caa3b9e-f968-468c-ac17-d2ed522aa25d", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlFOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC89l65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647340316, "uuid": "ff36b860-48cd-4b5e-8c25-0c28643789a5", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647340316, "uuid": "930ac404-0d2c-46ee-a481-74f41ca9de0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340316, "uuid": "d85a4e09-1dce-4cf6-b2f5-f1758269e82e", "value": "94c2a7e395cf92bdf65bcb034fe3c18c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f505fdb-a445-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647337786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337786, "uuid": "ad4a6715-2adc-4723-8fc4-7ccdcfe5595e", "comment": "Malware payload (AsyncRAT)", "value": "9a2a2f2abc3bae90cbca3e564bb11123", "object_relation": "md5", "Tag": [ { "name": "ahkloader", "colour": "#89F162", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337786, "uuid": "830bd31e-dbb7-48e6-b68d-649a733ac455", "comment": "Malware payload (AsyncRAT)", "value": "174ab0c6b0889b8d8dfa0f460d465afceaafc0cb1a1273e9ad4ed55c86019138", "object_relation": "sha256", "Tag": [ { "name": "ahkloader", "colour": "#89F162", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337786, "uuid": "624d1a44-cddd-4d90-9df4-6a560d5004b3", "comment": "Malware payload (AsyncRAT)", "value": "c324fa4246cd93796ce9002298cf12f4bf2f5bcb", "object_relation": "sha1", "Tag": [ { "name": "ahkloader", "colour": "#89F162", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337786, "uuid": "c9535d19-d5ab-4eaf-b4db-56c3b992bfb0", "comment": "Malware payload (AsyncRAT)", "value": "a27a78a6e7141a763da774950f4f5209bc94590036209f5499bc2ef432a8794dc53e026c66dcd912fd30f9211ba8cc02", "object_relation": "sha3-384", "Tag": [ { "name": "ahkloader", "colour": "#89F162", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337786, "uuid": "0bd27313-9de9-447e-834e-ccdb4e14204f", "value": "T13E91E00CCE63C07AB6D07B8B42A14A638F4E40D9A1452212B5DD6F1D5815E7C7B6E2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337786, "uuid": "30b731ee-9843-4df6-8473-f4ee8ade983b", "value": "48:hUfmR2zydV2+SfiXmR2zydVZScwsxumR2zydVZS1wRXmR2zydV+SatLL891zyd6l:h2BkcuglL8tL6vecfL6vbEbFr3b2j3bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647337786, "uuid": "d1add36d-2c83-4035-b9fa-a79e28c2dfa9", "value": 4308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647337786, "uuid": "5befec5e-7935-44fb-a2cb-c1db6438e5c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337786, "uuid": "2e5ce1cb-e325-4b39-a3d1-a457fe3695db", "value": "ahk.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be3491c-a4b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647386286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647386286, "uuid": "5fdd1bdb-a9db-4709-a6fe-8935d47b7539", "comment": "Malware payload", "value": "5adf87a964f3f98312bfab8f30fb70d8", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647386286, "uuid": "7627485a-5316-4a9c-8bc1-7c6346a532fe", "comment": "Malware payload", "value": "181e8199c373271be6ab13287d4722e60d6839d4611893d1748d69d939097900", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647386286, "uuid": "20394a0d-b685-43db-82a0-19b8e699222e", "comment": "Malware payload", "value": "c0d578901b8e986bc57f9bf7a341b7adc3a883b6", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647386286, "uuid": "4cda4e9e-bf81-4700-ad6a-2ca7d5ac00a3", "comment": "Malware payload", "value": "b2ba76a478e63d6571e139acd4515b05ec2aea03eab4cc78752414c7d513d8db8ecce1024b03b41fe553567639bb2d59", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647386286, "uuid": "2f80ea1e-7706-4568-8a1c-1a523103118f", "value": "T1FEC4AE57F6E77A65E6AEC1BAC6F1C92D62B3309602B0C3CE774055492D22392483DB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647386286, "uuid": "d53be40f-86a2-4bd0-9534-38a773ea1881", "value": "f20a8db3e4a8c03c1ab177b2660fdd78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647386286, "uuid": "c6f8a4b5-4167-4546-8a97-3bd138e54958", "value": "12288:azLjlZHAt+AZrkOCH8bzbBSreMOi1uWD242S6+4W:azLhltAdkjcX1XDWeS6ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647386286, "uuid": "9a997baf-662c-4707-9d7e-d56bf470ad72", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647386286, "uuid": "a5b24cbf-5ad7-4552-a108-202e7a775c74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647386286, "uuid": "9f086542-695a-4eb3-b025-b6ad4f03862d", "value": "0001.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c07a6cd-a456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647345082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345082, "uuid": "434ebfa9-d779-49f8-9ec7-e726422902e8", "comment": "Malware payload", "value": "06ecf36fdf4997ed1dcf967fa247ef0b", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345082, "uuid": "313b3204-d1ad-4c6c-adef-b8f3f4644d85", "comment": "Malware payload", "value": "18677816a5dfb7de127cbac3a95a0327f05439e0fc3d2180935d79b68f885bca", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345082, "uuid": "dffbf965-5f3d-496f-b8eb-16b30c37456b", "comment": "Malware payload", "value": "2a1ece225aa13f880cea7c8a0c799f0c2ae12cda", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345082, "uuid": "aa178578-abf1-4d37-9872-516f15e32de2", "comment": "Malware payload", "value": "ea2d31a846e23dc0c1ef69432498cd78ff477254dee1f0080067282c8cd2f00094bbd35cd31059429d95add9ddd86634", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345082, "uuid": "de01fd99-56b2-4214-bbd8-561a5c9ab547", "value": "T146915AA9034FCAFCA613ADC495D85A43EFB685260A3CE6C4CF70BDF6241497CE0E1858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345082, "uuid": "231d7741-3304-4d37-9282-585384ccd693", "value": "96:2tIv1o8A2nEuw+eFJOeVjI6ZDp0q0Ri0mjul3YFPbUdO1R8E:2iNoQnEuwzFJOehIU6Ri02a3YFPbA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345082, "uuid": "ec5b2a62-74be-4b98-9dd3-038a23efcfba", "value": 4210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345082, "uuid": "280bf606-07b7-4383-b4c4-34e96c45d6cf", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345082, "uuid": "9f38c168-79e1-4e02-9d0b-fade899c070b", "value": "comitato_115.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24505f8c-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647352773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352773, "uuid": "61e3bfbf-7068-4445-a2e0-b1cd043c08c7", "comment": "Malware payload (RedLineStealer)", "value": "db2d2dac43ce23915163345172c950b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352773, "uuid": "a8d667db-17f1-4387-8417-dd519ebdf640", "comment": "Malware payload (RedLineStealer)", "value": "187db71934db21a107cc0a110db42241c7e70aff2dc5947971d68a411ae01b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352773, "uuid": "a3e66f33-601a-4a88-bd52-284d3d655711", "comment": "Malware payload (RedLineStealer)", "value": "ae16bc78209663c7d9eccd0104edb368293c8f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352773, "uuid": "162aa8f8-9870-486f-9254-075c82e76251", "comment": "Malware payload (RedLineStealer)", "value": "190490b3a2b4acf950b84ef50c25b9e67bf7c749d45de4f2ef92a0f5dd09b788c872983c90ca3cb3e7ad3b02d028a01f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352773, "uuid": "ba0a87b2-9fa4-43f0-97fc-62b005e00914", "value": "T1B494BF10BA90D035F5F716F859B99369B93E7EA19B3064CF23D426EA56346E0EC32307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352773, "uuid": "4e4c1d5a-431f-4096-b34e-1b6141e2543e", "value": "6728da03e60bbe718ffacc65d5c92de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352773, "uuid": "69cd6edf-18f5-41b5-8427-2703d36a2b11", "value": "12288:H6fHT+f/70At9a/p08MFVS+vzvzJABPBlVepEW7drL+XelR2UkAEEChKKqusmsyi:sPoVbPc6/s+7dG0SHdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352773, "uuid": "be2db436-d605-4b97-b49d-813f91232c12", "value": 417807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352773, "uuid": "8de6cb8f-72bc-46dc-9940-947ea62a0995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352773, "uuid": "932a6242-4045-4c56-a516-71efeb1e566b", "value": "db2d2dac43ce23915163345172c950b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdde858c-a4a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647380196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380196, "uuid": "61889439-b9d3-4f33-8e26-d54c50a763a5", "comment": "Malware payload", "value": "c4265def0f892fdf89d1a5a86462eebc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380196, "uuid": "002ab61c-ee0d-432a-8722-cc37c4c2c8a7", "comment": "Malware payload", "value": "189075fa95110a6152fea78eb3c98b0be9611ba0f9aaf6bdb4f6a38656120a10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380196, "uuid": "ef9f673a-2e02-417e-b671-db417e94a05f", "comment": "Malware payload", "value": "3cd1fa3571a8f7bbac335802bb9d27d895161aad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380196, "uuid": "3326c861-5d39-4861-8a77-aea9d2715fc1", "comment": "Malware payload", "value": "f26e03246a034feef6603588918eee17267459c101eb03cbf7265d21be5b8cce62ec1907e9741b24941dec16a0d8d206", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380196, "uuid": "f532e9d0-6766-4792-815a-4005721eab5b", "value": "T16CE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380196, "uuid": "bc96942b-169e-446c-ac84-004169f9b823", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380196, "uuid": "f794a40e-d123-4c41-8536-5e0372f51340", "value": "12288:E94YBCR2xP7guDo463OP4eZsiSOZjb2woE+MhJT:2kRAguDogPNddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647380196, "uuid": "994cd590-76dd-4955-ba65-7cc0f81e1ba6", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647380196, "uuid": "aa3e468b-0089-465b-bf1a-cdadb37d0ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380196, "uuid": "b7b51633-abcf-4762-9adb-c8960b1bc3a3", "value": "c4265def0f892fdf89d1a5a86462eebc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f50c68-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353985, "uuid": "f76a99be-b25e-47b6-83e0-f1a09b9a2f29", "comment": "Malware payload (Formbook)", "value": "86371d2f5afbbf91bc8a954925e7cef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353985, "uuid": "47a386d5-e0e6-45e8-b3b1-f01db8df20a2", "comment": "Malware payload (Formbook)", "value": "18bf5355781d1a3b96121a120a39d3e82235260a6c23fa7ed4fe4107ad5fb189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353985, "uuid": "4304f11a-539f-486b-91c2-d4f8748d6395", "comment": "Malware payload (Formbook)", "value": "86a9822cfaf28575e74b3c0b6712c379e319e802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353985, "uuid": "7b575118-575f-4860-9569-4022675b7e29", "comment": "Malware payload (Formbook)", "value": "6b2036aee95b07836771248195db54cc69ea21b6b7030de5ad8ad843031e0e04853d7371f95c5556e1cdf87d5aa37db3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353985, "uuid": "481e2713-1b70-46b1-9b12-56bdf5f831cc", "value": "T1747412836ED58C5BFC93853048B7672892F67D5E91D0A02F8A88FF3776B61C3001A6D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353985, "uuid": "b37a8e44-8479-4e01-8ede-f6991f4484b1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353985, "uuid": "e78a428d-e53a-447a-a93e-968fa6697f24", "value": "6144:LGi4zy110wvMXb1CXnczswAEL6NZbeRU/p/ibhIZjFgymO9SbB9RQVRg19:Gy1ywERQrVDbOzIZjFg89ARQPO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353985, "uuid": "3c96aa07-c29f-459f-96db-379cb7db1e8a", "value": 361480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353985, "uuid": "4ac03563-f350-483f-9adf-6768de445398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353985, "uuid": "960525f6-6383-4def-9bc8-af7be9b24660", "value": "bngfdchgfdj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64613254-a436-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647331406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331406, "uuid": "8ac32089-a5a9-49d2-a2bf-98f7b24c10a3", "comment": "Malware payload (Formbook)", "value": "8f0536162ede82c537c7ed772743d800", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331406, "uuid": "a077f561-525e-4a17-945e-f752183474e3", "comment": "Malware payload (Formbook)", "value": "18fa66b6d108179c5e151b85ff6a40c770cbaa9d02cb4af822fd91f43a78352b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331406, "uuid": "26138d53-ffa8-43ce-84d8-09f20ebdddff", "comment": "Malware payload (Formbook)", "value": "c462a10c2f9c2ddcf45a7e1a67931e189e95373a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331406, "uuid": "38853504-83d1-4008-a8ff-508917b5ef3c", "comment": "Malware payload (Formbook)", "value": "14ecd21e95d75fc813a15e880a3f373051008610cc23b640e30aa9e788f82f2706a0f528bc4f68b3e46bf872245040c2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331406, "uuid": "c518d121-2dc1-46bd-b09b-257d961b07bb", "value": "T12D1412C33DCEDB1CCD2596B7061A2EB0D8D6ECD421AFEB292C1FB4890536A9445DA173", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331406, "uuid": "080755f0-6d52-46b6-9885-589b3015006d", "value": "3072:J9yDwbO2mZMGkDmqk+jtIHZQHKHcVt6Ky5A8irQA0ahbuVSEeLpJYG3Ymycbj:PbOZZdkDuuEQHdvSK8ir0VkVJYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647331406, "uuid": "9d7be7c8-86be-4e51-bcb7-6d8e58a82391", "value": 190360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647331406, "uuid": "94ec7ef8-4b2b-4298-a11d-030d07476568", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331406, "uuid": "d8b0e476-42dc-4574-aba9-3a9707830eba", "value": "purchaseXrequestXforXMODUSTREBINJE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ec9fbf-a4a0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647376908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376908, "uuid": "58537973-1a70-4ede-bd8c-41375aa1148a", "comment": "Malware payload", "value": "7442b177bfc1d2436e582403e2e897e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376908, "uuid": "2f9708cb-8409-4c08-a3b2-c5fed02d0ff6", "comment": "Malware payload", "value": "19088faa561eb7d32ae8681227a42837a1a7f2f347b798f4fc325b90f50a5bf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376908, "uuid": "d51783d7-43e3-4c7c-b1f5-b38b33c1d708", "comment": "Malware payload", "value": "d8026762e8300d30c7868453404585932417dbae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376908, "uuid": "3ac445ca-b802-4fd2-ac68-7195cd93a0a1", "comment": "Malware payload", "value": "5e26a6b96e7e5bd5ddcd613a1aec8180ecf549816dcf052ca4a1303d23db57624a5d85ac067f18f062b25334e16d1946", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376908, "uuid": "dc5376cb-90b6-4801-8434-716d2263bf62", "value": "T119E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376908, "uuid": "90b6c989-d593-4f32-b20c-daa049f42436", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376908, "uuid": "4f0cb2a3-8e68-487c-8e23-bf3789fb9e3b", "value": "12288:E94YBCR2xP7guDo463OP4eesiSOZjb2woE+MhJT:2kRAguDogPCddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647376908, "uuid": "d3f42d3c-de97-4116-bcd9-c0f02ddfee14", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647376908, "uuid": "17b3bf3c-5285-4bf5-be9f-7614b47d9b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376908, "uuid": "a3f304be-1e3f-4ea8-9aca-7a5af9e8ed30", "value": "7442b177bfc1d2436e582403e2e897e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e89ef2-a41d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647320852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320852, "uuid": "74dd1d14-ff66-49fc-a3b9-7e7774ef466c", "comment": "Malware payload", "value": "21e5a0f33780f99f7f2ea11a62d38da5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320852, "uuid": "965748ef-b4e2-4229-a285-f359772e60bf", "comment": "Malware payload", "value": "197b9692a3419cea85319a5e531dd718d67f82ebba9842d1fe74c0a5fa318494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320852, "uuid": "43610a18-010d-4759-bf3e-2d12d5f5d64a", "comment": "Malware payload", "value": "8d42d0dff06de043dd946e85fb2aca3e526b7f83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320852, "uuid": "ccf396fe-396e-420a-8d60-a0e73835c535", "comment": "Malware payload", "value": "0a913636749fdf971fedb52e60c833ef1f2f51c97c91033dbdaff5d9bae6b261486ca537b969d515cc26e89a13011dfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320852, "uuid": "adfaddad-32d5-4dfa-a338-3d70529fe821", "value": "T1E5353303B59DF9B9FC19A632F181E984D3147D35FA8E714F93EE56AAB00960F18CD221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320852, "uuid": "942d8fc4-b078-4fd0-88a0-144a0c0e9f5c", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320852, "uuid": "05ad1350-d463-4b3d-99d3-609ac9612777", "value": "24576:q+1x/WkYMRkdNRljYB3/3kjjUpu+1glBwTF3x47E5CNXm:Hx/jYMRkdNRJYuMp3SlBwpxOZNXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320852, "uuid": "69323a80-44fa-402b-b258-f1cb5e6cb9d9", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320852, "uuid": "8c5902c9-8634-4776-ba09-7eb0f0db5dd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320852, "uuid": "24b628f7-7f87-41f0-96d5-004d3c5446e8", "value": "197b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b6376e-a473-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647357525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357525, "uuid": "1979b4c8-3e1b-4e4c-afee-1b8b54907aed", "comment": "Malware payload (Formbook)", "value": "ac688cf4646c2ba3e564a9c7425d0c0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357525, "uuid": "32940987-8404-4def-9ed1-df7a553c9ea4", "comment": "Malware payload (Formbook)", "value": "19d34ef30d521849caa19f1cf2adc2f4c8097483cfb436ff6066ad60387b630f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357525, "uuid": "92de473d-fc59-413b-84f1-c8aa37f1f5cf", "comment": "Malware payload (Formbook)", "value": "b1eb9b77b84c58cb394317f3a5f73e81741637b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357525, "uuid": "c77cd6d2-465a-4753-8375-c3ce71d9d16c", "comment": "Malware payload (Formbook)", "value": "3d6804731cb3984ac6827e44ec3529e3ebab49737d10be4b02e504d869a6034a3ec395134dffe3f7e597e042896edd81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357525, "uuid": "ba4f68ae-40a3-4d3b-b7b4-9d889573b5ac", "value": "T117C4BE596BAF8163F525FFBB7BF16B200285FEB1B873C24B28C82DE4565F2C55992040", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357525, "uuid": "9ab52296-b525-49b0-81bb-371e007ba75d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357525, "uuid": "0c947699-7106-480b-b317-f9172568b47c", "value": "12288:f8E+j/e1vBmrcInZIBk/HJZnOJ8r3F/mTBOXG:fSrigpneESJUMTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647357525, "uuid": "d8979c6b-d7f6-4317-a5ce-8f917c916646", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647357525, "uuid": "63dc2bca-69ec-4dbc-9a49-a96a25cc9a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357525, "uuid": "bb93ff4e-202a-4190-996c-acce73fd64e4", "value": "ac688cf4646c2ba3e564a9c7425d0c0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad54b3a-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (N-W0rm)", "timestamp": 1647354743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354743, "uuid": "180c2d4a-1d72-4ff4-944e-a8f389014839", "comment": "Malware payload (N-W0rm)", "value": "733d2df73587e4bd9107cb14b50fa05d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354743, "uuid": "5e06f31c-f4ed-4b7a-8994-2a10bd42fec7", "comment": "Malware payload (N-W0rm)", "value": "19f2ce2fa14fb93353ac9cfe8464ceca8e6684d04d39972770dab5caf85d500d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354743, "uuid": "04aba182-bd12-4b88-a81b-d39842ea6dab", "comment": "Malware payload (N-W0rm)", "value": "e203ee253f4d0f6d055c3164573a3cee2d793e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354743, "uuid": "74849363-789f-48c6-a32b-c69c1ec9b6bc", "comment": "Malware payload (N-W0rm)", "value": "804aff42cd5803e31692c6892410ff4eabd9064779a21fadcf2ef9eb2c1509dfc02d523343dce7f30b5c77b6cdc34981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354743, "uuid": "e78bef30-a77d-4f0c-8ae3-5a5db2d83725", "value": "T10E94BE11BA90C035F1F712F859799268B93E7EE19B3050CF62D52AEA57346E4EC3230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354743, "uuid": "01f4d64b-f97f-41e0-a5b0-a7a0050ca79a", "value": "6728da03e60bbe718ffacc65d5c92de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354743, "uuid": "b8821ed0-a5df-4cc5-b66f-52164ebd7400", "value": "12288:ERZdBcxEbpzn2iUd2HgmM7LO4qlY6R1tTWFm:+bpjHqi9R3TWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354743, "uuid": "445bb432-49f3-4154-bcbc-a42dfa243308", "value": 416791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354743, "uuid": "b717a3fc-b342-49d1-a010-70c3fb8114d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354743, "uuid": "c0d8e6e9-bdb0-45b7-b6fe-e73f39eb72d0", "value": "733d2df73587e4bd9107cb14b50fa05d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2703bef0-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647354495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354495, "uuid": "2c648887-ab08-49ad-b6a9-0d8fdb26c1f3", "comment": "Malware payload", "value": "a1e95c21bdaf5530e06fce37d0046321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354495, "uuid": "ec628d96-f1f5-4879-ac96-d9de42bb2edf", "comment": "Malware payload", "value": "1ad2fb13fc886bf181c2371fc214b43e348a0039128e56fdb34fcd41171e54b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354495, "uuid": "73e29b6a-be98-49b4-86bf-4b7e21553716", "comment": "Malware payload", "value": "021ab073d84e19dfe0b0097b8da168c1642bdff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354495, "uuid": "b4604286-41fc-4a5e-aa8c-f604aabe8a10", "comment": "Malware payload", "value": "d86625e2c982665560c1615cf2d3d2055baa0e66c4c98ea4acee22a0f8b5416be9d73632b3c6d1101b9c599b1d85d198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354495, "uuid": "bb80764c-ccdf-44f8-8851-3c1e87273f55", "value": "T1F7E57C16E2E400E8D9BAC578C60BD91BE7F178194374EAEB06B146B51B23BD1963FF10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354495, "uuid": "fce19f22-a1c1-46fa-bf2f-f6c8c0848997", "value": "49152:RAuRmjvVIHd7G4LjBU91mwoH4wAIOF+kmcIxJrJwKTKwjDa5Tn79SGVFMSDfryG/:/RLRLj41OH4wAIOF+kmcIxJr+fx3kG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354495, "uuid": "469944ce-7756-4a99-ad32-1a4b5cea1d32", "value": 3239051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354495, "uuid": "53c7c2c1-660d-42a4-99b2-e2a202f56a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354495, "uuid": "06685bc6-14a9-47c3-95f7-e6c22f07d13d", "value": "a1e95c21bdaf5530e06fce37d0046321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cd0c08-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333822, "uuid": "05bf73ef-cfe3-4067-bf16-060ef77644f9", "comment": "Malware payload (Heodo)", "value": "852e53cce21c9356e3ab56072c651821", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333822, "uuid": "502cb0aa-6244-4822-b970-1611124f6aef", "comment": "Malware payload (Heodo)", "value": "1c5b9be744e31213b6defc3c40976fca0afc36a61200ef3aa5b28f6476e8fbf6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333822, "uuid": "b0a676db-618c-4c2f-bf59-781dec67d49b", "comment": "Malware payload (Heodo)", "value": "f5c78276da8123bb860c0f745ea25c675a548138", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333822, "uuid": "d504c279-e61e-41a4-b737-261e1fdc92ca", "comment": "Malware payload (Heodo)", "value": "226f4f33b129fa9b713b1d2f9cb5ea403bbff5dce03f1d7b3aa6f659a6bb7778e004e19ebfdb193d5714ae97acb9f975", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333822, "uuid": "abb057fc-df29-48d1-af54-b92564231c8d", "value": "T13823E10E5D13B94CC3369AB983CCA2F6665976221093A91A3040FE5C3FC664BAF5F09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333822, "uuid": "51e0a1a9-1c16-4e93-95bb-9eb6975cd998", "value": "1536:5lFXmY3B6Y8r7mfqN1+TpCgcgsMA6VIcrW:5l1mG4YqVN1+TtRrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333822, "uuid": "b7dcf914-b042-4317-abac-47181625f57a", "value": 50114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333822, "uuid": "8d39c51e-7202-4920-9572-ae3970eb97a9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333822, "uuid": "7ad6dab1-8a77-4fdb-ac0e-bce365a089fe", "value": "OriginLab.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f80bf7-a493-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647371266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371266, "uuid": "06e59079-6c26-49b3-b211-fd1d776bd2d1", "comment": "Malware payload", "value": "4cc7337642555dfc746a2dcf4365ea0a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama166", "colour": "#284FE3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371266, "uuid": "85a82193-e13f-4343-9c5b-ef6e2bf2888d", "comment": "Malware payload", "value": "1d1f0fff3d63d81dd11df87501896fd6a8df5cb3d9fc0ee8ee566b2c21cf70ac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama166", "colour": "#284FE3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371266, "uuid": "0fc0644e-40fb-4653-bee5-05bb78cd98d5", "comment": "Malware payload", "value": "3b20f07d6f464acf7b21fc930b638a318b01be09", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama166", "colour": "#284FE3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371266, "uuid": "f13a4a83-a858-4c67-8c21-bee766679efb", "comment": "Malware payload", "value": "b69d2858b56fd214de8fdf47eb0e63a4976e2cf69fe994eea41decdb8ac6c6bb886c24ed228bb712a54c66f1e489af1b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama166", "colour": "#284FE3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371266, "uuid": "935d55db-74bb-4841-86a1-70ebd54e89a5", "value": "T18094F1137E8598A8F06D943694A4486A773BF961CAD0C8CBF35029AF1F7B4C0DC3665B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371266, "uuid": "900b732c-df8d-495b-91b0-c0cd9a46ad84", "value": "951b79bccb42b97d27d026ffee52a7e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371266, "uuid": "3ba7737c-c0b2-4bef-8ede-8bb6a5b5ecb8", "value": "6144:RDHtVqOcpq2hmEiJTDSlboSK1eh/Dkb6f3LzDLnTBaf0aOMsm3Gu8u:tJWg5SlboSrDGw72xsAX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647371266, "uuid": "7ca7a04e-bcaf-4f37-a55d-a737d9fa857e", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647371266, "uuid": "30c7479f-9ed7-42c0-9416-b1b9f59f4860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371266, "uuid": "a5f77991-0dc1-4ec3-aa37-ceb4709eef62", "value": "1d1f0fff3d63d81dd11df87501896fd6a8df5cb3d9fc0ee8ee566b2c21cf70ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6458e1dc-a40e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647314226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314226, "uuid": "1c62fb7e-a862-4089-82b8-7b29f414536b", "comment": "Malware payload (Mirai)", "value": "29a2a1abe951c79349f21a6f4155d564", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314226, "uuid": "4a6ef713-a457-48a2-b491-7af9c67b564c", "comment": "Malware payload (Mirai)", "value": "1d72052eae88de952bd9b7e0f6512235ca5e35f17c6a8b040c300e61ce1c1215", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314226, "uuid": "a704f265-ccf9-42f3-a505-11a5fc1ac4f1", "comment": "Malware payload (Mirai)", "value": "f181a72c86fffd051aacefa48976d714357751be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314226, "uuid": "e84a733b-43e6-4e38-8c22-39cdb3e4a4b0", "comment": "Malware payload (Mirai)", "value": "d6f8dd887031223ff4047c0a8c8890100d0c05d0670d278562015c6a5bed3df7f93c371c45191b237e71ca523be5a1c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314226, "uuid": "db4f16c2-84e1-42c5-af92-d5ad9d97ffe8", "value": "T1BC52B55BD48184FCC89DC2F41196B979813B743A1AA6B34523D8F6379E9B91B0E28847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314226, "uuid": "ba4f3fb6-1c60-46a4-9086-b62bd9612acb", "value": "384:Pa0Z1F9ulAltg6B1mUkg/vdXRzVL04aHeYTRf:Pa0ZtJlTzVo4aHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647314226, "uuid": "da4ec12d-8af5-41d3-92fe-9fa9c3d0b823", "value": 14216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647314226, "uuid": "8331e132-dff6-401b-bac6-5c7f3ff4335f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314226, "uuid": "2b306c5e-de4a-4c47-9d08-9825793de15e", "value": "Ugliest.x86-20220315-0317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec65ec6-a47c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647361703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361703, "uuid": "24b2d269-3db1-4d1a-ad9e-e68d1e62fe9c", "comment": "Malware payload", "value": "ddca519d2a4ed3d88dcf11a7ea89a41d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361703, "uuid": "7271e86c-16f7-48d4-9fc0-99e68f6e530e", "comment": "Malware payload", "value": "1d7c262646f90e7a687f3fcfa959dc908b6e02b3ed27b11423c4d5eae3e73003", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361703, "uuid": "69a5bd6f-303a-47a3-8c4d-ccdea8c776e9", "comment": "Malware payload", "value": "7ceeefc1b36ea511e3be98197a3379f05a01a5f3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361703, "uuid": "13190fc0-b45e-4641-bb8a-e073322bffe6", "comment": "Malware payload", "value": "09feef355e22f5c5322f7a9fc0dbd649cf936e7596b4c792793eb1c20e3545e10c049349dfdcad86e90a945b0117a047", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361703, "uuid": "9241f72b-c7da-424a-ac76-1a231da889ba", "value": "T1CE719593F423D607C24B9179AD91CF9996317C438E05A406B0E4F38E09F8AA181F115B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361703, "uuid": "6a37479c-0bde-4819-9d7a-507b8182af45", "value": "24:rt/08O4Kclg0GqC+ya3tPtWLwh4/NQmBDals68ai/Amoi2hZt7l9WZx7t4Ng:rt/OyjlWLOYnkKAigZt7+vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647361703, "uuid": "98cec9d8-ef09-4fc3-ac77-8bac39567ab4", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647361703, "uuid": "044b1ccf-2fb4-4adc-9ed5-84587160a6ee", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361703, "uuid": "31b731a5-8302-4b26-bbf9-a02c582d19fb", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.4623.7238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31abe0cb-a458-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647345923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345923, "uuid": "6a4f65a1-c2d8-4991-beeb-3ed5f7f0dba7", "comment": "Malware payload (Heodo)", "value": "f6f7c0235781525e355d3fc202d3b8c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345923, "uuid": "34827212-a401-41a1-a27a-bde535810158", "comment": "Malware payload (Heodo)", "value": "1dc65d99947651f97ef8b6e33c2d6c6831d5af26427d11474e5656a1e8fd7c25", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345923, "uuid": "df693bda-c0fa-4aee-a4c7-8d85bf083e7c", "comment": "Malware payload (Heodo)", "value": "4f971101824afc56c69df113eaa7c6a780f6479c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345923, "uuid": "5340b260-4ef1-4540-ad31-b727384d0d19", "comment": "Malware payload (Heodo)", "value": "1affb443011f5d6eb5c662982dccf04771da2a7360955c79cd33f749b5a44bcd7a991d25cf8527ad6c1b3fa725211421", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345923, "uuid": "ee1ced24-809a-40a7-8b0b-590be973254d", "value": "T1FE742A03F98E427CC85F94BA829B723E29A7C82D0731999B83D56CD47B348D1993EF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345923, "uuid": "b8d513ae-f7dc-46ba-af3d-12143460fbca", "value": "6144:AFFTxx+67O7tB2MEcqCZo+fgGNWsNAhCOG:AFFTO6oyclOdCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345923, "uuid": "e945f79c-829d-4869-90b2-74714e684859", "value": 342625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345923, "uuid": "3cfba1f7-b75c-423b-887a-413aad6321a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345923, "uuid": "5f99f4c9-5454-42f5-b153-9c1d635abc61", "value": "emotet_exe_e4_1dc65d99947651f97ef8b6e33c2d6c6831d5af26427d11474e5656a1e8fd7c25_2022-03-15__120519.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee52c571-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333785, "uuid": "a5cf5be9-072d-483c-b302-4bef2c1a218a", "comment": "Malware payload (Heodo)", "value": "62d5c95879444c3886ba4f1ea572c4f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333785, "uuid": "b61e3450-f485-4c64-b0bc-3d8f73ad4b4c", "comment": "Malware payload (Heodo)", "value": "1ee1aca2e871d01cedacd45a9ada50fa5e0793cfda257d89278cdee241d423be", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333785, "uuid": "991281bd-be61-4c41-a608-2bf15cf0cfe7", "comment": "Malware payload (Heodo)", "value": "c643d095fd932f8ef1ce5878a0b6109fe0f88165", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333785, "uuid": "6c8ea20b-30d4-40da-8664-b68ea21ad9d3", "comment": "Malware payload (Heodo)", "value": "9464ba3e2dd77ce6624e9cd543fde8b9cb514057130c389210351e40fdbac13866bd207c7ea34b3d64e8277a8d5b4060", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333785, "uuid": "474c6ce1-b2fc-4ccc-8650-2e984c7cb33b", "value": "T15B73E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333785, "uuid": "0188dcab-c10a-485b-b300-f345d4d41463", "value": "1536:iuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:ctzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333785, "uuid": "c524c875-7f70-42f3-9d61-daaf9c8dbc70", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333785, "uuid": "fa05246a-332a-4f40-9032-501ced9ef37b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333785, "uuid": "4144f59f-cd63-499b-b2ae-f282bc6e51ae", "value": "imedpub_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f05af2b-a455-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647344765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344765, "uuid": "aad6a4f0-7aa5-4f42-9ded-7b249d4935fe", "comment": "Malware payload (Heodo)", "value": "88b566929678d4956aeb857733dbc8c5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344765, "uuid": "420eef37-3eb9-42f2-95fe-874cf9852f31", "comment": "Malware payload (Heodo)", "value": "1ee9a943619f9b9fa51ce17d877a8482ae565f8bf5a33f59f0892f857fcfc51e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344765, "uuid": "c986e8c9-4569-4887-bf2d-4154930daed0", "comment": "Malware payload (Heodo)", "value": "3e176c2896aa7e0719462ebd653f6dcfa86514e5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344765, "uuid": "90dfa16c-c7f3-4155-b70b-30d3888485d0", "comment": "Malware payload (Heodo)", "value": "b662d8eb9824a13f47db20eb353cba26256776ee9dea59db826216303425afa41078af68ffe3f2fc49de1377b093a610", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344765, "uuid": "35154ccf-d9e7-46f0-8a09-b33ecd523c84", "value": "T12133D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344765, "uuid": "25fa0e21-4de4-42f5-9c59-298057e68d1c", "value": "1536:IAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:xcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344765, "uuid": "2cecbf1c-4638-4724-a90b-872f31e5a599", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344765, "uuid": "88acb43b-fd4c-4995-9cb4-0785af0b633f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344765, "uuid": "015318f9-4616-4a87-93f8-0a0465bc9265", "value": "Rechnung-03-2022-50263.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3851ca49-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333479, "uuid": "da22561e-219d-46ff-a042-9baf93912dc7", "comment": "Malware payload (Heodo)", "value": "6e9770dffb2e765865468274227316f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333479, "uuid": "98e0960d-2bb3-4513-acce-7cd27f21620d", "comment": "Malware payload (Heodo)", "value": "1eea7f63ec297b401c726846eb485dfe897cb550b89fe40c225ddbf13ccf84dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333479, "uuid": "5d48016a-d86a-4d8a-9d32-abd3f5e4f741", "comment": "Malware payload (Heodo)", "value": "bf5fcc57d911a75a4208b36f17f4d15b2261a0c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333479, "uuid": "003cb778-05e1-4475-a118-90c8297762e7", "comment": "Malware payload (Heodo)", "value": "e36f9c84057a04f9e3c05e84f0d51275e8060de2afbb31695d9278597016ec30d81bd88f088b109596484208069a1025", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333479, "uuid": "aa5b5c73-7d3b-4c44-bd7a-9d379ba68840", "value": "T12A257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333479, "uuid": "de34f5cb-7eed-44f2-9c26-9f5a302f1ec1", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333479, "uuid": "249c4b35-6838-4cf5-8c12-039a39797943", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlROlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Zl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333479, "uuid": "b95255f3-be44-4bce-986e-10c1e139351a", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333479, "uuid": "61f4ed88-48c2-4018-abe4-c1bc3b9eae16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333479, "uuid": "a8772489-dc84-4360-a04a-c44cc2012e95", "value": "emotet_exe_e5_1eea7f63ec297b401c726846eb485dfe897cb550b89fe40c225ddbf13ccf84dd_2022-03-15__083754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d92130-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353281, "uuid": "fdd37247-7aa5-4f81-8b55-608ac62e13f5", "comment": "Malware payload (Heodo)", "value": "71572f9b7eeb5c924c2cec9004069f8e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353281, "uuid": "85bae87c-8b95-40f8-a058-2b10a2b87bc4", "comment": "Malware payload (Heodo)", "value": "1f4df7db86c20cff31bff3244652eae3cfd4fe1f0f2c39aec7f8f8c67149e262", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353281, "uuid": "ab6b6133-56e2-45f0-8da1-78543571e376", "comment": "Malware payload (Heodo)", "value": "70b5fa0004386801fe6610880ae89086ce676dec", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353281, "uuid": "d07b7bae-4adf-4a5a-b7e7-b7631eb350d4", "comment": "Malware payload (Heodo)", "value": "44a34bde749cdf0c7996a48148fc13a62283c759645026a0552241b7eeeefaa014cdbaefcb715b1d31de87f78ebf78a4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353281, "uuid": "45c11593-1588-49bc-92e5-b08dcf0d5226", "value": "T1C333D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353281, "uuid": "fbad246d-4072-4b9d-a393-a1e2986a0f8e", "value": "1536:4AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:hcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353281, "uuid": "58f85d48-e5ce-415b-97ed-17126ef6f4da", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353281, "uuid": "e4387f33-ce39-41f4-a052-5bd8842a72e1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353281, "uuid": "ea9b18b6-5c17-4b48-bc74-533963e55c2c", "value": "Insight Medical Publishing_4.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075b98ba-a436-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647331250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331250, "uuid": "76a860d1-154a-459e-a418-9a586cd13832", "comment": "Malware payload (AgentTesla)", "value": "2c4803e51903610d5ec4ee0dfb9cc3c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331250, "uuid": "5937927e-ed3e-4b86-a61d-00995a5b8e91", "comment": "Malware payload (AgentTesla)", "value": "1f6769017676f97c21841ea70a599b065af1bacb0bfeebf6dc8b3b4369d0bacc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331250, "uuid": "c59b3718-9685-4027-b508-5673f9b11654", "comment": "Malware payload (AgentTesla)", "value": "c5e72998eab986956c199c1e6f540513c4c648a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331250, "uuid": "3e74cb27-a315-42a9-8c27-2bdeb2289b0e", "comment": "Malware payload (AgentTesla)", "value": "6e28696560e7f650fe4741979274cc5e81184f2fc70a03dabcbf630c43a7b3629e2a88e5f71763863614d38e1ebe822e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331250, "uuid": "1549b788-e17b-41d8-9b3e-a558c1254961", "value": "T1E4C423A42D96FC607B413BA6A6FAB3824CC0976AC5DC12DF25C635C2059164171CEFFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331250, "uuid": "badb76c8-4fa7-4c92-b5d4-72e72277421e", "value": "12288:KZjtZNnDrlh1xc3DHaHyxC/YJtmMk/IyqHyC/sxwmu5bkiB:OZvnE3jaA+YJtm5QVK2l6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647331250, "uuid": "9e5e6d13-676f-4a5c-96a3-bcbeccc004fc", "value": 565500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647331250, "uuid": "a7286029-1973-402d-8864-76a2269d83e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331250, "uuid": "228e37a7-fbaf-45ae-82bb-49201f467878", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3d6024-a488-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647366560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366560, "uuid": "9a9cdbf0-94ce-482c-a263-634b62c59c9b", "comment": "Malware payload", "value": "ffe1063d4e623a37a7a4941606b96b93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366560, "uuid": "5b048285-05cd-436d-ac7a-0ed9da832f8d", "comment": "Malware payload", "value": "1f865d5e1d85f420b984fac3732e5f36b4ab10edf095bcfb9e1f689f13789e56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366560, "uuid": "b906724c-3931-44d4-a583-c0b231f04980", "comment": "Malware payload", "value": "6efb67ed1f35332289bdfdebd3b0669a6274d9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366560, "uuid": "f4cde71a-94d4-4b55-bcdf-42c0cdf1aa1d", "comment": "Malware payload", "value": "08b93233f5336d2d93676fb43a1285291e2e949e5090d91f59511730b60f3e78c70b350c79ce78bf430264467a7317ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366560, "uuid": "48a1d3e8-ec66-4752-a57a-00f91f9b7ace", "value": "T1A2F42396EB4B1FC0C5E107B4D86AF92FFF62413583554089B788DA223BB72D627213B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366560, "uuid": "a2874359-f548-455d-8ea7-0d27c3b7f1ea", "value": "f11f87642badc84e7fb44e3ac9b293a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366560, "uuid": "9a4b8889-ea58-45e8-a562-fd53827b0a18", "value": "12288:GsE05umZPem7nAW04hrr5p/gNwh4qz4HA7fwErmroBvtjE6pkhdS:hZ5u8PemjFrzYG4ITMECro9tlcdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366560, "uuid": "fdff7a20-08e2-4baa-9ca9-bb44b6f9d979", "value": 783695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366560, "uuid": "47f17938-2ad0-45ad-8a8d-6db12d71631f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366560, "uuid": "66411bc8-9250-4103-b809-df9ab298116f", "value": "1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36beddd8-a473-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647357528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357528, "uuid": "121c140c-06a5-4353-9b84-442bea404dcd", "comment": "Malware payload", "value": "ff0c1bc030125d5ecad06aadba733047", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357528, "uuid": "cbf1df7e-ac9a-4d98-a036-2550a22219b0", "comment": "Malware payload", "value": "1fc050c90aced452c084c287ee54afd79d309b0f6ae39a4cb6afcce4d1997820", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357528, "uuid": "1aa65160-d1ef-4ba5-8667-3cc1600e8d94", "comment": "Malware payload", "value": "72880c6a5e793905a71f7a2e7d3328c311e12311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357528, "uuid": "8754aefc-547e-4653-b0a2-e4b65ceaa249", "comment": "Malware payload", "value": "0baf0a70f985197723500a38e109f41e1925e06fa77355057ff222b82d97ed126403e43925eb5bb328cf8b2dbae06f7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357528, "uuid": "dcccd8f8-c4b8-4cb4-b72e-49fee5b6fb47", "value": "T15F351200F9A0D034F9B719F4097E934C6D3FBAB0572450CBA29166E966786E4ED3272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357528, "uuid": "497d1c86-1cf8-45a7-8b6e-445544b6d912", "value": "0bff565af25c1bc5033321ca0bc710a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357528, "uuid": "e1374de4-f279-4a34-bc99-41bfb97072e0", "value": "24576:rlKBQ/pEK0v72oDggCCq1HQC13vuoPul3GNbpS:4K0v72AHkQKxWl3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647357528, "uuid": "a388a25f-16e7-4b2f-8b04-5613088fb0a1", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647357528, "uuid": "85aabc30-5d17-4e2d-8823-1547a52c9446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357528, "uuid": "992f582a-937e-4ad6-ab82-a81447ae4b31", "value": "ff0c1bc030125d5ecad06aadba733047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2795c83-a451-11ec-9275-42010a9c0029", "comment": "Malware payload (Hive)", "timestamp": 1647343240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343240, "uuid": "55ebced1-be3b-4180-ac63-96d5877ef250", "comment": "Malware payload (Hive)", "value": "4268b9010190ddd7d95cbb96417407ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343240, "uuid": "a9467ab0-c025-41a0-ac40-2fdcb0ffe3ce", "comment": "Malware payload (Hive)", "value": "201215fdd6ba159d22621f2424f75b25fbe6dac1c85126e174e4ae999ef88111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343240, "uuid": "508ca47a-5c3e-42e9-9b57-ca42481f5a5b", "comment": "Malware payload (Hive)", "value": "201787737ca24e42bab344c426926891dd5f30eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343240, "uuid": "a74a74d8-be78-4795-99f0-66693906563e", "comment": "Malware payload (Hive)", "value": "71535732748489e25341fbebf094fcae2ceb0b33b7c7a6e034314c60a40c8e14c7dd1a69ec43a2e5e6292b04e2fe4cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343240, "uuid": "65366316-2d5b-4b2b-a6d6-2b6af443c8e0", "value": "T153855C87BC9190F9D4AAD2308A65C2917B31B4940B3763DB2F5096BA1F72FD41F78368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343240, "uuid": "5a7c830d-9c4f-462c-9a96-9813b40cf899", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343240, "uuid": "8cd99c2c-95ef-4876-9b43-a0225d6083ff", "value": "49152:LHFOa3LEwg7XtCoXRecgdv7V5YMir32D1:LHL3A0hji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647343240, "uuid": "cf4a5bf7-c5b4-4a4a-a647-1cd5e78cb502", "value": 1794560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647343240, "uuid": "d5a67983-2b2b-47d1-973c-f5727f9534c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343240, "uuid": "1083541f-2801-4e3a-8fe0-f35e12f74dff", "value": "201787737ca24e42bab344c426926891dd5f30eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfd910d-a47e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647362505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362505, "uuid": "f828fee0-64e1-4010-b287-09d2c60c0115", "comment": "Malware payload (Heodo)", "value": "3d8e0dda6ad3416ac43118aa2744967f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362505, "uuid": "0d415331-746a-47ed-be34-a1bba8b99a78", "comment": "Malware payload (Heodo)", "value": "20c393acd5f3967c9b8ff637a0d6dda190ea8a0e3ea75b9ef8360a781c1a8680", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362505, "uuid": "d247f8cb-dc6f-4449-a500-0452b2c1421b", "comment": "Malware payload (Heodo)", "value": "d9cdf8b012b2c7c5ae6a0ef5c142d4544051d837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362505, "uuid": "af8f9b1b-e112-415b-930d-27f40e233cac", "comment": "Malware payload (Heodo)", "value": "618ab80e44cd8bd2f5e798f6ef4a428cc7148d429b1c2c30336541468327b80d1ebc8229a70e78b56f8b52d13f772aca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647362505, "uuid": "9f1a1f38-e4f0-46bb-8090-f57b0ddd8518", "value": "T117257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647362505, "uuid": "1a802f06-412b-40ea-b85f-f0bf54f383d6", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647362505, "uuid": "6c4ff8ad-0def-48c2-83ba-30c95a71db4c", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlcOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8ol65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647362505, "uuid": "103ea576-c5b9-44fd-ab50-ce941abfe4de", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647362505, "uuid": "f88e2e5c-3913-4f0c-a411-c51897d8ce6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647362505, "uuid": "26c573ea-4bb3-4523-bf3a-d4f3e50da74e", "value": "3d8e0dda6ad3416ac43118aa2744967f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f861b5c8-a448-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647339385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339385, "uuid": "1fb15f9f-1ce7-4306-ae42-970ba7fc9bd5", "comment": "Malware payload (Quakbot)", "value": "fc9fdd31ade48d8c64898d39ba5b8208", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339385, "uuid": "a1ef7215-b444-47c3-8667-623ccd2a21e6", "comment": "Malware payload (Quakbot)", "value": "2107fac26923df70eec2a6ee4a6d567e6523c5fe9775002f31e721656dbf15b7", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339385, "uuid": "c3e9a211-8435-462c-93ec-d6dade255260", "comment": "Malware payload (Quakbot)", "value": "a0e7bd87ab2d973b938c8847ff8e9a5f0a08ee66", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339385, "uuid": "ed949743-d074-4328-ae29-bcafdc2c6195", "comment": "Malware payload (Quakbot)", "value": "ba0fbbb5ae85bca740aae46ae1a6edf99d54b1de1f1bb5e3507be50cccea228aea7368832f0fb164bfa29a49237311fb", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339385, "uuid": "d10a2ef1-5a77-4931-bd95-08a8d396bdc2", "value": "T101C3AE5BA4195F47D66846B4FF070DA81F01235EA8C276AE11562C8A3F663B32FCC35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339385, "uuid": "0542b58a-e4d6-4e51-b451-fac12939ab89", "value": "1536:SABOrQAfAeiimLbLdbLwdKmjlvpLllllllllgEMTsqym0yKF5fRPPYIXtmHl3MYy:BnAfDixLbLdbLwgmfMBs+KjHQzVdcl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647339385, "uuid": "05cc93cc-4d2f-4ca4-a155-ec8f606f38ec", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647339385, "uuid": "24bdde3f-32e2-47df-80b4-69bc04bb005b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339385, "uuid": "7419848f-6343-4cf5-99e7-4b021de4b9b6", "value": "miss_compens-23761584.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f85d710-a486-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647365838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365838, "uuid": "107035ef-571d-474e-ab96-7ebbed017e62", "comment": "Malware payload (Heodo)", "value": "6a2476a729627004f94bc63cb698bdcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365838, "uuid": "7822abf5-f487-4f12-b3ea-95ab5cbc5444", "comment": "Malware payload (Heodo)", "value": "2185ec66bb5809d8d3b19e3f93bddf64d2fb11205c1d29eb8e5366601deb747e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365838, "uuid": "9cab86a0-cb12-476d-85fa-95bfffd1a487", "comment": "Malware payload (Heodo)", "value": "b68882a6263c062b98b441528d89d075a09228ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365838, "uuid": "571cabd9-1b29-428f-a0e8-c44f1f70948e", "comment": "Malware payload (Heodo)", "value": "c52f634f846975c8d46a65e583fae6193805455e8eec94f3c00274c1ffb56067d750cc0ef50bd7a603c2e41d8fd9e2cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365838, "uuid": "4a30c532-ff10-4069-b7d8-3c3444b6f93b", "value": "T125257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365838, "uuid": "f40e086c-3b3e-4d0c-b0fe-a860a44956bf", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365838, "uuid": "6974fc9d-d463-4d20-902a-9064d674212f", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlEOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Ul65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647365838, "uuid": "f4216e9a-3ef6-4753-8e4f-e9f35b1208d1", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647365838, "uuid": "1972e4e8-56fa-4d19-8170-d66f64d36239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365838, "uuid": "6527a93d-6933-4130-8f5f-b4b507db9bc8", "value": "6a2476a729627004f94bc63cb698bdcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346de810-a46e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647355377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355377, "uuid": "5a4a764e-b252-46cc-a65f-999f6327e302", "comment": "Malware payload", "value": "8c5251e06e41546f15cd24890f88ae61", "object_relation": "md5", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355377, "uuid": "314efb9b-a627-4eb1-81e7-5b9bea853603", "comment": "Malware payload", "value": "21a94488c5f622605c7588cd1879b6afa5d2b62c038ac250ed01533866d2cb6e", "object_relation": "sha256", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355377, "uuid": "7fb3548b-81a9-4b8c-84e2-862e2f62de1a", "comment": "Malware payload", "value": "b48ef1b238271a0bf05c685115e80346f5ebd3a8", "object_relation": "sha1", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355377, "uuid": "59e23751-938c-473a-975e-efafce038941", "comment": "Malware payload", "value": "f5ff25e9084db0a72018f0d88ef39079996576f1da2d83ea395f8dffa3cd67e791cfb1255090daaf9846867668eec52d", "object_relation": "sha3-384", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647355377, "uuid": "fd41d496-ceeb-4857-bcd2-daf414229f0c", "value": "T1A713D6C54989C9B8CB2FB85452199C67CACED32A272DD8C0BBE32F093452DB8757D9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647355377, "uuid": "596009e3-5bff-4a03-a557-963e5d16eed3", "value": "96:WzVwk6VY59tUHuH5SWSaS8euS7euindPrzeirJzxQfFNPt7MdTKFCgG4yKAEFA0K:l059t5c37cdEFWwirLBNuSuE8SgRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647355377, "uuid": "2f9d3373-34bf-44a6-9e07-98d177ff1d42", "value": 41711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647355377, "uuid": "5eeeba9a-20c8-4390-9b8b-b6ec3e76e4d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647355377, "uuid": "ab0fea86-ad92-47ea-8a33-a87cbeae5632", "value": "6R0YnehR.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e61594c-a47d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647361782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361782, "uuid": "81135076-ee05-4bf6-af8f-35c5c5effb5f", "comment": "Malware payload (Heodo)", "value": "81852c9f52a5172312e75b9b23907105", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361782, "uuid": "b4864eac-2117-43db-8b0d-82dd657fde67", "comment": "Malware payload (Heodo)", "value": "21c65c994e5c20c20d4bc1c950df03885e7ffde1521a97c2b8b0fe3804830635", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361782, "uuid": "42fb8a73-88c7-4972-a333-c4fe7a15a76c", "comment": "Malware payload (Heodo)", "value": "07e605b836c0abd156fd63fd41c800430e5bdfe9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361782, "uuid": "48ced63b-5b91-4351-95d9-6355c3d36659", "comment": "Malware payload (Heodo)", "value": "0fffbd48c30ae3447db3a1eee0cf5b1590ed798fb5ea806076adaf73fa777dff04fe6ff2d6d8ebf1e9eae8ed15fc4065", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361782, "uuid": "2f784af9-f388-43d8-91c4-5d36ce5c3efe", "value": "T10233D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361782, "uuid": "0d489f39-f4a6-4656-b7cf-304ca862e42b", "value": "1536:4AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:hcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647361782, "uuid": "65ff0333-2d76-476f-b6c5-39ed31d45fe5", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647361782, "uuid": "113cfad3-a521-4124-b492-9c1b456b8ec8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361782, "uuid": "37adf2f9-ce50-441b-9a30-d484c4bfac0a", "value": "Dokumente.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8006da-a495-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647372361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372361, "uuid": "d892720a-c624-4151-b62a-0e44ec39aab6", "comment": "Malware payload", "value": "f20c4260faec19a3084f2608acdf39e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372361, "uuid": "a0ad3339-d3eb-4068-8458-8f13f0d09852", "comment": "Malware payload", "value": "21cb8bacd3a3cee6ec35f81955999527861eb3283f3cf22b8fc0a2d53a92eddc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372361, "uuid": "1c5ee021-f94b-4651-9ba7-20b29d67380a", "comment": "Malware payload", "value": "21d80f52cecece77a779083915fec978dc0c0b19", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372361, "uuid": "3363de0b-87aa-4cf9-a000-6c32d7d1bd4d", "comment": "Malware payload", "value": "5966be20115f8f4a7242a37e1e2a5fd5cae0fd7f02f8b45c10d86fcbb73f506e711f8b354ed83cdc3b53bb36be9d4259", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372361, "uuid": "80c5975b-495d-4bcd-bbc4-bb4b0c8713b2", "value": "T165E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372361, "uuid": "078de33d-ef3f-4380-8303-8392f2c77034", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372361, "uuid": "36cc7285-ede1-4aa0-b451-6f261a5602b4", "value": "12288:E94YBCR2xP7guDo463OP4eisiSOZjb2woE+MhJT:2kRAguDogP+ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647372361, "uuid": "44e5f3b8-6005-49ce-8790-6ab6cb5ae8b3", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647372361, "uuid": "47aaead5-7f05-49ef-91de-a1fc1ee0640b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372361, "uuid": "9a4083f1-4b23-40c2-880c-71638fd0202e", "value": "emotet_exe_e5_21cb8bacd3a3cee6ec35f81955999527861eb3283f3cf22b8fc0a2d53a92eddc_2022-03-15__192553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76decc08-a491-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647370521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "89ee32d6-496a-4c70-8672-c905c218669c", "comment": "Malware payload", "value": "8a15e99cd567e3f0f60510ab058c6c3d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "a056f72b-2c31-4949-a480-30ba34573195", "comment": "Malware payload", "value": "2298caf1dfeceab6baebcc1e34ead2b948046e502bc9ae27e6ea74acfed80019", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "8a5e6e12-e840-47a8-ad0b-17595fca902f", "comment": "Malware payload", "value": "8ec6df049120777e123fce962226bda4547e932e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "75522ce0-782a-44e3-901e-722a6c3974b8", "comment": "Malware payload", "value": "72ff53fa5206adf73aa06f03bcf579cb894b4aa9ba331072003eb9d095ec4fcaaa735b14e7d02f4254ff6218ea3df669", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "ff1c3a96-741e-4df9-a71f-1f3092507b47", "value": "T131E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "6856dfd9-822e-4ae1-82fd-d086005ceda7", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "ab639713-936f-492e-8fa7-7bbf80a501ea", "value": "12288:KFxGsTPy4BHT4Sj1zfBf7ABqDLkWynCsZ:obPy44Y1Ff7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647370521, "uuid": "0d592fae-29ff-4e28-828d-12fb7f02fd34", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647370521, "uuid": "023a31f9-defd-400d-95dc-a3bac8e3fdcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "606a6082-33db-42f7-ba46-cff45b2db67e", "value": "emotet_exe_e4_2298caf1dfeceab6baebcc1e34ead2b948046e502bc9ae27e6ea74acfed80019_2022-03-15__185514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806be7be-a462-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647350350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350350, "uuid": "46736c3c-9377-49f2-8120-be28ec987141", "comment": "Malware payload (Formbook)", "value": "a2d6167b50df1ed4947c0160d0f21ac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350350, "uuid": "e6bafd9d-00c7-4dba-8ef2-9f6977d99e79", "comment": "Malware payload (Formbook)", "value": "23342760a490bd4a7a778af40060f43de5a7cf42a625183c0b228524fb1d2cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350350, "uuid": "e997e4cc-47bd-40ca-b996-2f532d99ce1f", "comment": "Malware payload (Formbook)", "value": "90e292e0acea29527a55d38325b0cbea675a08be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350350, "uuid": "328e9318-2c47-460e-b513-d49126f562db", "comment": "Malware payload (Formbook)", "value": "75151c33d6b7bf45e15628fc72ac8e75df0d74878009f31865bef73af97def78a71207d5affc7d197886d3203c96d2dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350350, "uuid": "879926cc-0282-449d-b3db-0d4f9ae0ddd8", "value": "T14203E61A6C92961EC5D47BF869B15193663A7CE20124C18FDCFD7F29E972223CCC12AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350350, "uuid": "c5ba970e-e24b-4525-9d86-dbd81df33582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350350, "uuid": "5751d0de-ecd6-4d82-b36c-7406fb2fa3cc", "value": "384:NNKrypb9UNRQXulaiAMwCKFH2S3dd0hUADkaKC:2fxlmMwCK/3deVDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647350350, "uuid": "4fcf65bf-4efe-48c3-b6b1-944ee10fac77", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647350350, "uuid": "8070ab76-9c35-4550-8364-8dcbafc8bcd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350350, "uuid": "60ceaad2-5da1-4b93-96a6-6cfdf0284f49", "value": "Pending Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0fe48f-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647354346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354346, "uuid": "42cda582-3a93-459f-a238-d8c1f38352c2", "comment": "Malware payload (AgentTesla)", "value": "a094fe99f2c194b6922a8370a1bee6d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354346, "uuid": "04509e60-564e-4005-93cf-86f9b0193848", "comment": "Malware payload (AgentTesla)", "value": "242012013ae4e93c4bad8ae2e497ef930d369fd0b6bda98940737950f1046eea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354346, "uuid": "eaf88c50-82c4-4e74-8ab8-6ff3901c8807", "comment": "Malware payload (AgentTesla)", "value": "f6edcbc7a90868c0221ac6913dd71f70d291fad1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354346, "uuid": "9ee985ac-a0f3-4984-8744-cd81cb7cbac3", "comment": "Malware payload (AgentTesla)", "value": "576473dcab1d5842b827feaea090ea9ba78c87016eacf7c6be4ff1421a237fa24ebdba6f2f3fe24f877f87a334f1fa63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354346, "uuid": "7644bdd0-8c3a-4a75-afdf-3a744c20b408", "value": "T11B15124673E4AF83F47AC7FA88254A5843B1B6681509E3494DC270CF18B3F5097A9BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354346, "uuid": "c5870f19-6f67-4e4a-ba33-26ce7a5161ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354346, "uuid": "969b8fc0-57f2-403c-a753-c865541724d4", "value": "12288:K3mZkwOEocEQknS+HaZeVOegQKfueFJbNm/PpGbjBbS/HoMdyY5qXbTdcL:Um6wO2knp6ZebgQvesqjBaHLdTebTdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354346, "uuid": "ab655c36-13b2-4bbc-a718-dd5f62e78359", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354346, "uuid": "a87966ca-cf41-461b-b5c8-0d6e1f21b8dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354346, "uuid": "9ad4c25f-ff6f-40cb-bca4-7a361593ee2f", "value": "a094fe99f2c194b6922a8370a1bee6d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f970da5-a479-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647360281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647360281, "uuid": "ac9e28d2-7f7e-4757-a750-04e6bb791d20", "comment": "Malware payload (RemcosRAT)", "value": "e80b5c8bef8945a87ec3243c973b562e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647360281, "uuid": "56ce36dd-ca8a-4261-8d4c-0762a214e3e3", "comment": "Malware payload (RemcosRAT)", "value": "243153293413189168a254c3f378f0907f95fcef856946deacd5b1d41589afc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647360281, "uuid": "57127867-c2b9-41ac-8c92-afe53f4ebc3c", "comment": "Malware payload (RemcosRAT)", "value": "fc2b7e12e4ff12a6c95d72e44cd5cb12ae2fae38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647360281, "uuid": "fb08e144-1d7b-4f3c-a977-2e3fc3df1ca0", "comment": "Malware payload (RemcosRAT)", "value": "ef065ba9aa7f3eeeb532d26aaaaee2792acab06e972f4724404184cdc4aed4f04c89ec4960f90720037eef50fea293e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647360281, "uuid": "56c7daf2-e3f1-4793-84a0-7d76eb2940ae", "value": "T1783512DD32584B13EE65C3BDE6B5A01A07B4BDB09571C2199C8A39C7A1B6FEC2424F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647360281, "uuid": "81b9c0ae-95d8-4ab6-855f-3cf9a779217e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647360281, "uuid": "6f4d9b5f-fde5-4c11-88ee-10cb18a99352", "value": "24576:euwOmSDSO6l0ezEmC6X99xR14NaKC2Yp:euf12Bl0bI7KC2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647360281, "uuid": "70f31e30-53e0-4b87-b7f5-aa5045316d1c", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647360281, "uuid": "e1ee76cd-46bc-44e8-855a-85fc94f6b036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647360281, "uuid": "29c87d1a-fd28-4d39-a117-6a64b561ea4b", "value": "e80b5c8bef8945a87ec3243c973b562e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4baf95f6-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326210, "uuid": "96984450-776e-4426-97b2-c18ef1fb2ef4", "comment": "Malware payload (Mirai)", "value": "edc3ddf69a85565c052d20ec0594abcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326210, "uuid": "7746638d-8e62-4d9e-a2e0-03911b5c533d", "comment": "Malware payload (Mirai)", "value": "2497591a2a4e71fd29c7ac24c8550b3c96303d51dc16b48721924ab1456ffbb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326210, "uuid": "3f84407d-bae6-4fea-8afe-18f19498ac6d", "comment": "Malware payload (Mirai)", "value": "91893ba2ba8975aefadbc7da0a87e01d195b8495", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326210, "uuid": "13904c55-4fe7-4612-a243-7f6cc185e009", "comment": "Malware payload (Mirai)", "value": "6fdf5bb3c3baf031532ec23c12d730b1bd029666d5dd32d9e86aa079a0a62f7d4e01dc004ff2aec4574c3fc1d812032c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326210, "uuid": "5a052f9e-17cd-4a7f-8569-d91c04df1e5f", "value": "T11FB3C40ABF610FF7E8ABEC3745A92B05249D510B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326210, "uuid": "f822ed55-424d-4df9-bad4-c55b562f68ca", "value": "1536:g9DYWFx+xx+AaEPiDMR2jk2EkZ+BzYojKoOvDBgplbngVZ14hvG:gqWFx+xUA0wR2hEkZ+BlpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326210, "uuid": "a76d5830-2898-4025-85d3-2997d165631c", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326210, "uuid": "4d24c540-8294-42d8-99c8-d605cae41aa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326210, "uuid": "37fbcb4d-cc51-428e-b602-517c58ecedcf", "value": "edc3ddf69a85565c052d20ec0594abcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ae571d-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333799, "uuid": "2fcd97fa-3399-4030-ad68-3cca54605111", "comment": "Malware payload (Heodo)", "value": "3938a212edbb45f7da7c148af65b8a22", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333799, "uuid": "9560b98b-8bfd-4d30-8477-3c82205795a4", "comment": "Malware payload (Heodo)", "value": "24bddbcb501f77a7e8fcd8c4de88bce8e5c0d27db3c9f5d490e97a5ce3d08cc0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333799, "uuid": "31fc8b23-2da7-489a-9561-7b006134ce05", "comment": "Malware payload (Heodo)", "value": "9850b99872e13a067314b8ee8b4be326f3728930", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333799, "uuid": "7649ae9d-7986-4732-a0f2-809ea8daebc0", "comment": "Malware payload (Heodo)", "value": "94f289f57f0e83381d14dc06ca25f1ca4be34f3895df7c2b680962e755712dd9cc17ac2d9991ac69f72d9f41bcce2ba0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333799, "uuid": "a60b357d-ed67-4427-91a1-d83ed77774bc", "value": "T15973E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333799, "uuid": "56256b4d-3dfc-495c-93da-ef6a3b69f6e8", "value": "1536:2uSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:QtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333799, "uuid": "22a6d3cf-5d03-42f5-afd0-cf7e184310f9", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333799, "uuid": "9348a320-db40-45e5-85c7-eb52a82a224b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333799, "uuid": "2489069f-7ee7-41d1-947e-f10ec0d902cf", "value": "iMedPub LTD_6.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3d5c9e-a4a1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647377617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647377617, "uuid": "1e0c09e2-4a5f-4a52-87ab-b438dba2b8f2", "comment": "Malware payload", "value": "01172332beb14fd6ff73a6662e46f54a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647377617, "uuid": "70cd0f30-df8d-4b92-81a1-2a348f1d925f", "comment": "Malware payload", "value": "24c7c14a28abe9361fd7d5970b32b540cb0dcc455aa134ecb62e7681f05c233a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647377617, "uuid": "c16bc088-5418-47cd-bc63-7f124c75198a", "comment": "Malware payload", "value": "1d028381b35ed94d7a555473f82c0de6bfb74087", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647377617, "uuid": "1366c7a2-eb29-48de-b5b2-07aaaac5606d", "comment": "Malware payload", "value": "1bba489814be57f0ad520f8e5534f330005e7b25606c823fd315f560b9e373bb204229867f931b8012f934f627909454", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647377617, "uuid": "23f5c100-d6f0-4b4c-a79a-ec27534dab40", "value": "T1C6E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647377617, "uuid": "2304bb4a-97a7-4ed3-9931-67ed50fc8003", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647377617, "uuid": "1d05fb60-c008-4b1c-a62f-b343a185d947", "value": "12288:E94YBCR2xP7guDo463OP4emsiSOZjb2woE+MhJT:2kRAguDogPqddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647377617, "uuid": "005a6a65-1afa-4c50-92ff-b20a87d4b14e", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647377617, "uuid": "699a081b-7df3-4588-a428-0c509f80b0b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647377617, "uuid": "5ae5f16c-59bf-4122-a590-d88519ca082b", "value": "01172332beb14fd6ff73a6662e46f54a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f74b60-a473-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647357519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357519, "uuid": "729086d9-0448-4ae5-9499-63b1ec94cff9", "comment": "Malware payload (SnakeKeylogger)", "value": "0de298343c303638512a40b47c4a6732", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357519, "uuid": "551de726-7d67-4685-96cd-a0deaa8ef018", "comment": "Malware payload (SnakeKeylogger)", "value": "24e66fd5334d1c2ca8c50d05a87ca56957e09fd595ff60142f9e86a2b43c07d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357519, "uuid": "fee282a3-bcf7-451d-a901-994798f9072d", "comment": "Malware payload (SnakeKeylogger)", "value": "8f83eac2a1632c1380f1f56eb7d3b05dd20cece4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357519, "uuid": "fdb98675-cc6f-4424-be87-441fe562c554", "comment": "Malware payload (SnakeKeylogger)", "value": "8613496c7fd4d15a04d96ca175b03563ad741c73cf3dd6f5a41530c8b754527ee585754bea994210520ede1078593dcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357519, "uuid": "bef0e11c-f27c-4db0-a3a5-bfe5dda794d4", "value": "T15D6533345EEEE731CA68CEF3485937AB67E88591A233E8701F5531CA17EBBC051C8652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357519, "uuid": "dcdc70c9-3e5f-4811-99f6-196ff52cc898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357519, "uuid": "e5db6e9c-4bd0-4d7c-8faa-1480340e05c3", "value": "24576:eYnlGSZxK+fZIeXAXTikgdBmsMb/c6ZECRcujwpIaT8BGyf+R0MwW14zUjXqv81e:JlvxxfZIpXTikgdKcgECRgp7T8Bh2R0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647357519, "uuid": "923365c9-de28-4d0e-ba48-2cc5a9a89f33", "value": 1545728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647357519, "uuid": "3963ec3c-2ea8-4759-a025-ff2ccd3a0f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357519, "uuid": "d2b14047-e316-4383-94f3-0dd1c3a8d3d3", "value": "0de298343c303638512a40b47c4a6732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e461be50-a4ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647381871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381871, "uuid": "4b05e916-d593-48f1-9733-d34899266f12", "comment": "Malware payload", "value": "1c840fe704ac22137edc8c5ae86d9009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381871, "uuid": "58e1ceea-ce7a-4d44-b333-568d80c59f9c", "comment": "Malware payload", "value": "24f2809ba025b92e745d0fb070cc6dbec72896c21e32eaf036f741937bbb693f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381871, "uuid": "c5457004-74a0-402b-a8de-92b928746ab7", "comment": "Malware payload", "value": "725162077e42811fe674a8252735f2e13ace5a80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381871, "uuid": "c7331557-bd03-4863-8748-d05eb67cf958", "comment": "Malware payload", "value": "8de2d7f233b7dae583ee1aec3549faec81bc22e0d6a9539d1f81af361c4a8758d77dd399ea4331bd6222be953545275e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381871, "uuid": "1ff52b9c-55ad-41b4-9215-1970dbec7ccb", "value": "T1DE740247D2C449F2F4634478899C0AA83D3FBDBAAD25812F21618E6F49757D90C3A7CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381871, "uuid": "9bcc4689-b62b-4c37-81cc-d558f4d1fead", "value": "6144:4vbx8/v3oDPoUfFqyvGZKoCRJME4fRY9mbZmD:4MgEBWRuVY9mbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647381871, "uuid": "a13688e7-1723-4ea6-b01a-a92348fc458e", "value": 365488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647381871, "uuid": "afad2bc8-3cde-4c33-9577-52d0504c37b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381871, "uuid": "dc0bf21a-cdff-40d5-9d4c-5fda9b1853f6", "value": "24r2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda14876-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333783, "uuid": "2d453416-0e2a-49e3-aa34-d2bfb17a5102", "comment": "Malware payload (Heodo)", "value": "5ed04df3b93e1a8a048973a025461c62", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333783, "uuid": "61b6b4fb-cbea-4b0a-80d5-ea447a1254a0", "comment": "Malware payload (Heodo)", "value": "2503308123d5e77afb29053d14179b7be98d275a844f1cc1a0865322dea02772", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333783, "uuid": "7404aa11-b0a1-446d-a5d2-e5f654643b01", "comment": "Malware payload (Heodo)", "value": "e59df11784bbf6046695ae616e549994280a3048", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333783, "uuid": "3d6b07e3-9f90-4e00-9186-9314a0f23499", "comment": "Malware payload (Heodo)", "value": "baa7995bdb9848c9ed989a178b2e209f43c69a74f786f0a6840aa45bc713bd061061bfaec8f35c52d0216c0fc6760ade", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333783, "uuid": "384f4b33-13f1-4f68-bedc-4afe428a5570", "value": "T12B73E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333783, "uuid": "6c345532-b242-42f3-8d1c-a8bade25849a", "value": "1536:2uSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:QtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333783, "uuid": "d8f53e1a-fdcf-4816-83d0-8defe0797723", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333783, "uuid": "1c79d77d-2ec6-49e8-a6f8-b3acfb86bff6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333783, "uuid": "cc199930-2a08-4a79-bf2e-3dca9925eed0", "value": "imedpub_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc00012-a4ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647383199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383199, "uuid": "0c9c6bc9-5d3b-4b3f-a775-5cf20242a60f", "comment": "Malware payload", "value": "0b829ea5ba8e191daba943f4902e3d5c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383199, "uuid": "31026a88-18e9-4f85-bb8e-2e604f7af256", "comment": "Malware payload", "value": "256fa92e6dc0c99b60fd78e7b7edb02fdc5878815414c3889339eb72b9054d50", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383199, "uuid": "6a9fd5d1-ebdc-4cd7-b55a-c43bdb2c1b74", "comment": "Malware payload", "value": "d734c28e436e514adf85f6d6e7278acdbc8c8e03", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383199, "uuid": "db7820e2-4982-4f11-86e8-ccc59203bf87", "comment": "Malware payload", "value": "7da49821999398b8a6eab7ff552e973eea6c1afe93590be3c7db6762df72de89492ed1508da831aaf25a9fe4c640b453", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383199, "uuid": "1898ca53-f1dc-41e1-8d1a-969a807d29cd", "value": "T158726206FB958E37CC6FEE3349E90B4631DD914B12A42B1A2234D938F61B5474AF3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383199, "uuid": "2ebbad05-fe50-4297-95f4-5d5a101a9531", "value": "384:cwcDJJAU4mxDOuAggfmj6mYXiwYeNO5TykezzNOG969:cwcDJJAU4mxjVWPXiwYeNO5TykezzR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647383199, "uuid": "40bdffeb-6910-4c8b-9f02-66b90fceda29", "value": 16580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647383199, "uuid": "0e73e216-4b4e-47fc-9bd5-4a7774c26551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383199, "uuid": "c2177a75-cb0e-4780-9c1f-9aefd25f6805", "value": "Ugliest.mpsl-20220315-2226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d941fd74-a460-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647349641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349641, "uuid": "0736fec6-5f64-40f8-95f7-ba0539fcc8bc", "comment": "Malware payload (Quakbot)", "value": "906e7e7182eef7c85a0d3ebe8283ae36", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349641, "uuid": "e6da029c-674d-4529-81c2-df0871d90c7f", "comment": "Malware payload (Quakbot)", "value": "2608b4e01cfd647dcc1b2690f63be9c4d22db47a9da3305ae8be563e2098b71e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349641, "uuid": "85360719-3099-4d1b-8e8a-f558185ecd8a", "comment": "Malware payload (Quakbot)", "value": "a69ae9079c8328c4216c6c2b158325724acfee96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349641, "uuid": "58e39558-83ed-40d5-b8d5-cdc028ebb675", "comment": "Malware payload (Quakbot)", "value": "3094fb8523f94ba6eb283ebe3052c0fad735da43097334da14d3e9c94367a9c738e3c3a4d9bc12782b6926a50c7fed4c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349641, "uuid": "463e3abc-f84f-4b6c-948e-b65559bc7213", "value": "T14B15BF71E3A014BFD1323ABC5D7F33599D263D012928C48967D96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349641, "uuid": "ac547e70-77fc-4c42-aedf-c3ea2dfab65b", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349641, "uuid": "d8b4bb1c-a550-4ca0-8cee-aff0e4e44a52", "value": "24576:86BseOd1eQcn+Xz4oA9bDajPNI5zvpiGaT8:86toeQm+rAdDa7alpiGM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349641, "uuid": "295ef7ca-eb93-44b6-96d0-a876857f8286", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349641, "uuid": "3c14522e-c3bf-465e-ba60-df6360ca58ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349641, "uuid": "08b8976d-6cf5-4331-b1cf-d5025148e5ee", "value": "9403565.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c2bef5-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353289, "uuid": "9dabaae3-70ff-49d9-85b2-9598d1e492d7", "comment": "Malware payload (Heodo)", "value": "40f42cbff30d0ce6393164daa7843644", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353289, "uuid": "2072989f-841f-4d3c-8aa5-4c06692bb41e", "comment": "Malware payload (Heodo)", "value": "260f3c83c5aa6d04c66fe9c79f0664a71239153e355f9db7a1caa8025dd44992", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353289, "uuid": "ce819302-0088-4e94-b851-394070c6202b", "comment": "Malware payload (Heodo)", "value": "99a6537cdb812016eb833734673eb8e7f3a724e8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353289, "uuid": "e19729f6-351d-434d-acad-43c096aadf07", "comment": "Malware payload (Heodo)", "value": "0d9905349ff7245a0363c115746c89e2991276ad2d1500bc93d4280a3fd9771cd2fe2482c7721292bf5d112a99f1dbd2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353289, "uuid": "d3d3e399-e191-4974-854f-2f160f8c2555", "value": "T17833D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353289, "uuid": "9e5ac4e1-f228-426b-96ae-da99356d2cb2", "value": "1536:IAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:xcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353289, "uuid": "de48f4a2-b6a5-44ab-b963-625252b4600a", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353289, "uuid": "30fd80db-bbf9-4e46-8472-7548c9b9b11c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353289, "uuid": "fa8f3b8c-da6c-4aa1-92c2-41cd1dc42eb4", "value": "Omics Journal_3.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51ce0de-a4a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647380182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380182, "uuid": "15e4fceb-4f37-4da2-9fec-d2e57c893d3b", "comment": "Malware payload", "value": "fbc15730f416ec185ff88e29dfcf968b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380182, "uuid": "7e2a07af-f4bd-489c-bf94-0c05f5f301e6", "comment": "Malware payload", "value": "26785c70d96572276ca228390caf22a542dc4ae56bdf888dc0e8e34926d4ee5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380182, "uuid": "7fef38e0-11a7-4b5f-9b53-7fd4c2471dd6", "comment": "Malware payload", "value": "598cac0354f99bb5aa536cedb6d10ca8ef6575a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380182, "uuid": "8b548bd7-22f8-4cb4-bfb0-ea0ab87cda24", "comment": "Malware payload", "value": "1678be26c8727b1e5f0989853c7f9db8b0e619a206f7d7dad454bf8e511b04c99f2fa1976c4a2ee1d29d477a646c1bb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380182, "uuid": "42997be8-6534-4e9d-9261-ae0d14cb4488", "value": "T1ECE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380182, "uuid": "c2fbe948-4f67-4c3c-88ef-71588f94ac13", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380182, "uuid": "4a213eeb-d0c6-4638-ac18-35a625fa6f9b", "value": "12288:E94YBCR2xP7guDo463OP4e8siSOZjb2woE+MhJT:2kRAguDogPwddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647380182, "uuid": "0c5e2732-865a-442c-9a2e-f359dec934d4", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647380182, "uuid": "ef116e86-a653-4a4c-8a40-fc17e2dbd0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380182, "uuid": "89fea8b1-7779-4297-837c-43794c0f2864", "value": "fbc15730f416ec185ff88e29dfcf968b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c156dd71-a495-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647372364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372364, "uuid": "1159c3d4-7202-4a2b-90d5-26b182a5b874", "comment": "Malware payload", "value": "c9f807adefc34c810082e6548275290c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372364, "uuid": "968b0d45-c42f-481e-96b9-1f0b5ad4dfbb", "comment": "Malware payload", "value": "26bad54d421b686ba8146c8bb5019505854fc1fb9354d63d91acd006bf6707ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372364, "uuid": "08ff7e3c-aa5b-45f5-b621-82751542c569", "comment": "Malware payload", "value": "0e74743ca162c9927f75e2b5bdab0f1ea73e3a02", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372364, "uuid": "30928367-b16b-48c9-96bf-c2130e119a6c", "comment": "Malware payload", "value": "4105269f64dbd86b5da2db726fd10d2285f70938af7e5216a6a082fb526d4afb8cff615dd87e4349ed9d2be5ad82d301", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372364, "uuid": "e42f92df-47d9-4e82-9733-6253e8700aaa", "value": "T13EE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372364, "uuid": "2350cc2f-2cf1-4730-a5fe-113d0a59abad", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372364, "uuid": "06f1a1c5-1132-48ac-ba6b-4828292efff7", "value": "12288:E94YBCR2xP7guDo463OP4eTsiSOZjb2woE+MhJT:2kRAguDogPnddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647372364, "uuid": "d1a9e684-d2b5-44d1-b701-8fed151b6b1b", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647372364, "uuid": "b98891a3-9832-4027-a3e0-037aae2a51d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372364, "uuid": "bc2c0a47-83fb-454c-8b33-148018d02a36", "value": "emotet_exe_e5_26bad54d421b686ba8146c8bb5019505854fc1fb9354d63d91acd006bf6707ee_2022-03-15__192559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857af7c4-a451-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647343058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343058, "uuid": "d16ab269-6dca-4b55-8457-cbb5499f9797", "comment": "Malware payload (Heodo)", "value": "770d9d7a27354c271e2143f87f81717b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343058, "uuid": "545e6a53-e96c-4976-96b0-393fa7c215a6", "comment": "Malware payload (Heodo)", "value": "271664c099cb28f919025abf790025878a12d122a84e315b582a7acc4b033f19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343058, "uuid": "19edec85-6fb2-455b-b8e6-8d1f048a2727", "comment": "Malware payload (Heodo)", "value": "2e88f17e50eb6a6b8f86127f67b039ea20a80a7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343058, "uuid": "25320b5c-8aaf-478c-b3f8-3dec046f344c", "comment": "Malware payload (Heodo)", "value": "0cc455a6cbca1f28f2d358cb2efb71bffc91d9829a3c81795268aeca42e7fba518da2697bf7697714c2157b942273be1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343058, "uuid": "6e3afff9-0acc-4303-8835-8c19d8f04243", "value": "T17A257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343058, "uuid": "0c0bc981-9a12-41d4-a6d5-4b6d81b3653c", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343058, "uuid": "2c500956-9c38-4f04-8c18-93ee5633084b", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYPVP6FuR6shQLj88F+Krf6:v6oycln8cACiKP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647343058, "uuid": "05c7ad67-f6e0-4b00-b7fa-c9057a30ce1f", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647343058, "uuid": "1846ad29-99d1-46fe-99e6-f0ba1eb3a0c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343058, "uuid": "7b1fc551-a7bf-4cb1-bbb4-446ebc4a5a4b", "value": "770d9d7a27354c271e2143f87f81717b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febfc8d9-a4ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647383204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383204, "uuid": "7d565c39-0ab0-4ca7-9479-e83685d5de93", "comment": "Malware payload", "value": "d6ed9309825e2e38cdc78814962872a8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383204, "uuid": "1a4f96dd-9af3-4d44-b7bd-9d502c906460", "comment": "Malware payload", "value": "27876319541ba6c73f3d47dc2296ed8ea91833df2872a6b8182a9476aceb438d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383204, "uuid": "0db95172-1522-46d1-95f2-a4a7356b76fa", "comment": "Malware payload", "value": "b93b35079d441b4b3e880b9229fcf5877b0ca795", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383204, "uuid": "4140a022-649a-4ace-8736-fd9cac814c95", "comment": "Malware payload", "value": "d7036bdee279df0263bbfe606a8975563b88e9ad1e0aa9ddde52a45d8c2bab4210155d42a2825c1df34c5c6d2277ed79", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383204, "uuid": "90c4b232-224c-4f5d-a316-c27e9da89837", "value": "T145B2E69BF9809F01D5D15179FE0E224D77135B2CE3EEA3266E247A3067875770B3A80A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383204, "uuid": "b52c4ebc-849d-4f43-8c02-cb6bbf64628f", "value": "384:vitnn98E0UxyJFWmIrs3mT0mji7Ed7VY5dpfAIVw/rQIUHgXx4eA:vitnnUUUDWmIuHUiwd7VY5dpfPVOrQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647383204, "uuid": "e5e899c5-5097-4a93-a7ec-090a1b35f22a", "value": 25712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647383204, "uuid": "654bec76-d181-4792-ae74-cf3827a726e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383204, "uuid": "c79ddff4-7358-4279-a58d-dd808a860612", "value": "Ugliest.arm6-20220315-2226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962c2848-a466-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352105, "uuid": "c9be32e3-662f-4154-abd0-c82f99a30c94", "comment": "Malware payload", "value": "efd86c72d1b20dc8b4d30f58cb83e1a1", "object_relation": "md5", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352105, "uuid": "da9784e3-e10d-43da-8748-ed930dad5eb3", "comment": "Malware payload", "value": "27f5930e8bdb4e45477428f719a8dfecbba21825ffdd6e4e4c97c888f19da683", "object_relation": "sha256", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352105, "uuid": "73f0cecd-5be3-498c-b4ba-3be2b556e073", "comment": "Malware payload", "value": "782e3251050395dfe852f1c6612a58f4e31ae066", "object_relation": "sha1", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352105, "uuid": "f12f21ef-d943-416f-bb89-1f97dc9e1c09", "comment": "Malware payload", "value": "4150eb14220f99e7d145922cb7bdde34ebc693f3ac0e87bbf1711b710577d1790d9f3febd4edd96e36dfdd12f70a0662", "object_relation": "sha3-384", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352105, "uuid": "9ef09511-8428-416c-a2f3-e0f6e9115412", "value": "T1D5429D69C99BA823D67332B855797CC0F08C0EC35540EBCD340D7BC666863E4AB52E36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352105, "uuid": "36a2a91a-721b-4bac-b658-76c637242f0d", "value": "192:Q86oNmhOJ2wc3rMKkTPukcx118H111M05AgPekKiD2h0vvt4aasbU:Q86thIhTuHgH111/eVuhvvt4DsbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352105, "uuid": "dec8ecf3-1b90-496b-ae58-11440890b484", "value": 12301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352105, "uuid": "8efaadc1-8c1d-45e1-ae34-2e0e876b50c8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352105, "uuid": "c5cbb6ee-6f06-4ea4-8c2b-0bbd211f2219", "value": "Ukraine Report_FINAL.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a403b8-a469-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647353471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353471, "uuid": "2a958545-e1c8-41ce-a2de-d53a9df71b8f", "comment": "Malware payload", "value": "b57a8c81e38229d65f45768fe82fa4bc", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353471, "uuid": "5ad79945-5888-4a88-a232-056968fc843e", "comment": "Malware payload", "value": "27f83c4735e85aab3cf217c447186ff327ffcdaaf74e38e7b5197c373c53133e", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353471, "uuid": "a47dbc08-8920-4d6e-bdbb-42f912863e23", "comment": "Malware payload", "value": "9d8a1c9540d558b92e4d3162339eb72b0c63f48b", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353471, "uuid": "144ed0da-5b5d-4868-9b66-3632728d4f4f", "comment": "Malware payload", "value": "6fd4db6ac9b5f09e290800ee4b56b238fc24cdd1a88246ecd7b247ed2f9d054f2743281d4684106e835753f4d7fe608e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353471, "uuid": "23d41472-7b8c-4b43-bfa9-3b29f5dafd8b", "value": "T14714125BBE7FE1ADE6CF7BB02B15544E2CD49D995B08C1787A89732E00B66F2430049E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353471, "uuid": "ced76fd1-a288-4639-800d-b13ae65df145", "value": "3072:6zvGlcnHSVTHIpx4PO45xQbOLiUF2u1EpQBTW1Pw4jzeB34p3c/b53PtlxWn6+:rlc+Hq2DSO2UQu1E2YHX1psBFTWn6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353471, "uuid": "36df8155-e21f-4e8e-9464-0ee074a42a04", "value": 191208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353471, "uuid": "32d892dc-daa8-46d6-9174-52a3f51eb78e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353471, "uuid": "3eda5bef-7fce-4d82-a7e9-0e62d9adf277", "value": "RFQ#2761516.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2978543d-a47d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647361801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361801, "uuid": "7edf47dc-4dba-4d83-b85f-b4ea108a6dd2", "comment": "Malware payload (Heodo)", "value": "c5474a6b111126fe377316b98fbc512a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361801, "uuid": "00c73c06-3e68-491e-bc61-1909a55a1463", "comment": "Malware payload (Heodo)", "value": "281157b53cb175c2bfcafa231cda435fab4c73301110bb17c46e23f3ce39ec02", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361801, "uuid": "aae62c3e-ddeb-490e-962f-da8503799b80", "comment": "Malware payload (Heodo)", "value": "ff038ca8d8bdac0240ea87f2837aa1838ed8b87b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361801, "uuid": "2c759136-4b8a-48f4-8a28-cfd5ffed0792", "comment": "Malware payload (Heodo)", "value": "92350b7decc48fd5d649197656b29c613ee3b01622e856b4648bee1154ddb0e6644724eec068e735972d59d40cf9c51a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361801, "uuid": "4fde50e6-fd47-4dd7-8736-cf60e304f99c", "value": "T11C33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361801, "uuid": "56f3e298-f9c5-4055-954e-d44414fe27ad", "value": "1536:4AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:hcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647361801, "uuid": "dc9d9ffe-b2fc-4057-a848-ea088c613593", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647361801, "uuid": "5e39d660-90b3-4807-8fa2-610d29b8721d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361801, "uuid": "6fc09975-8bec-4301-b499-03d82235ebd2", "value": "Rechnung.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41055657-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326192, "uuid": "6e7967cc-4f3f-46b8-953d-bccb9c561e06", "comment": "Malware payload (Mirai)", "value": "6fea9083d9cc201fbff784a69c977f91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326192, "uuid": "7d25cbc7-5388-4746-bd6d-9d3ba21ab0bb", "comment": "Malware payload (Mirai)", "value": "291c7a416f2d5381607d4fa9df25b786a8ee857d2e46ddaf6d8da28157ab7fe2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326192, "uuid": "69a59529-8290-43d0-9be5-6f0755ecd0f7", "comment": "Malware payload (Mirai)", "value": "c0ad11e2cf69b8ffe36fad42fde6eb3252d17f64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326192, "uuid": "6e29067e-74c1-4241-ad76-dd9b46472205", "comment": "Malware payload (Mirai)", "value": "620404f3e5ea36325fa06979230c6c1e19ac10d97162c8499c5267c42d205b21005593d2e08a631644b54724a2e52f96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326192, "uuid": "0ab68750-3fb7-4422-96ff-8a3c4a8e6627", "value": "T1A6932986BC419A11C6C61677FE1F108E331257ECE2EDB3138D245B707B8B91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326192, "uuid": "2bc8fef0-c76f-4677-b305-492b6bf8818f", "value": "1536:XhnhKl3qmtX6pBcURHyjB2es5zVMzWiMcKafmxbJMAeiVxpD8nFAu5HYG:6laWKBc0yyhMqdZa61xpD8nFAu51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326192, "uuid": "9ee6623c-fc4d-48dc-b4d5-92a578bd3c45", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326192, "uuid": "b570a10b-2a5b-4ddf-b5fd-199cb2ca8f2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326192, "uuid": "830f0c20-0a92-4c26-904a-58c762fafc3d", "value": "6fea9083d9cc201fbff784a69c977f91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9174d3cc-a494-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647371854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371854, "uuid": "5a2b6bd5-6f41-4204-900b-28184c9175e4", "comment": "Malware payload", "value": "e1c23718c65eebf3a8113d4ba822aef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371854, "uuid": "2be97165-d796-4593-a3ba-730bb1a585d9", "comment": "Malware payload", "value": "297a14a5feb6e0a8de7d93cf3f6e93dc2d9bb8369739eef69c40d2f1ff6a9b6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371854, "uuid": "57ca20bf-fbd0-400a-84fc-9997ac66dda2", "comment": "Malware payload", "value": "b3203f6cf5b3caebe6230e99a5c0b2ab4d8b77df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371854, "uuid": "92d48a78-f1c6-4f3a-98df-4c1d14e751a4", "comment": "Malware payload", "value": "b3c06c8cff4c89ae9a0ffe8c54c385edb992ecb12e1419dc3726983a9072f674e983e901ca07ed1f09aa629d15238f8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371854, "uuid": "e8e7a8ec-efac-4e56-a346-09982138662c", "value": "T113E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371854, "uuid": "8ef005d1-119c-4c88-8ee7-6d5cfdc57e17", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371854, "uuid": "34ebdf4c-bcb5-486f-af98-4b1c040ff3bb", "value": "12288:KFxGsTPy4BHT4Sj1zftf7ABqDLkWynCsZ:obPy44Y1Jf7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647371854, "uuid": "13faba4d-791b-4d35-86de-d0cca4edc09b", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647371854, "uuid": "508e187d-2be3-48f7-ad33-decfe7e4ad25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371854, "uuid": "701e88f4-0c69-459b-9724-f6b9e98d7f5b", "value": "e1c23718c65eebf3a8113d4ba822aef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccc83ac-a43e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647334802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334802, "uuid": "a7854fb6-a1c0-4fec-8991-e542358088c5", "comment": "Malware payload (Heodo)", "value": "d277e673a7736d73e1047b578b7f26cb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334802, "uuid": "594178cb-f8a7-457c-850a-b416b0baa3a2", "comment": "Malware payload (Heodo)", "value": "29cb4468b1158301d95ba3b3f1e65762f5441d3dfced699aca63c583217d41e6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334802, "uuid": "412dadcf-537d-4276-9224-f5806881ee2b", "comment": "Malware payload (Heodo)", "value": "4cbdb5cfd5057f9ecab33b1d7fdb8264dbf07ac6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334802, "uuid": "8181d07b-58bd-4740-834c-e2643a270600", "comment": "Malware payload (Heodo)", "value": "d5bd55774a8974bf640565408beadc01cce8363f9d80a77c01d5fa6c188c24f0c97259433eff7f169c6ff641aa4cf716", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334802, "uuid": "cba472b8-f727-43d2-9e0a-f049e8b595ee", "value": "T17F33E01F9522F5ACC3136C7DCA4C59F5650D5893E089F62B08857B8CBB1B2E7178F286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334802, "uuid": "f3cc67b9-7be1-4406-bd6b-a3eb863b178d", "value": "1536:bFmPpcEglt24xZdRBzH9hJBrdEwwNXekVIc07:J4cEk2Kd3zdtdEwoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647334802, "uuid": "7a80c09f-5366-47b5-ac27-94fbc4d2437d", "value": 50551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647334802, "uuid": "7a8435dd-2e51-42da-bc18-6a911d6d28b7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334802, "uuid": "f68cd2d6-c32b-403f-b146-650919efd991", "value": "IhreRechnung 2022.15.03_0951.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b14657-a434-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647330488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330488, "uuid": "c33b8b26-6ec1-4d14-a32c-3f372e063821", "comment": "Malware payload", "value": "2a3de0e2ff32c229f9a316ed1aadf0b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330488, "uuid": "a97aed21-c9f1-4d77-849e-56bd797342a1", "comment": "Malware payload", "value": "29d5119f820b68d9e231a4812290395628313ff03a4c04b72190a7fb39b260c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330488, "uuid": "bbdb1572-1f84-412c-90be-0aaf8170cf52", "comment": "Malware payload", "value": "298cc85ef5b884ef467e8464ffc09dd76068c2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330488, "uuid": "416c55ed-bb10-4a21-bea1-8ce62f2ee2ff", "comment": "Malware payload", "value": "16890bbe9d3760e115d23f5d1c632476aa299eaf2389a6915d77e83d7ad56fb8643682565771fca67664a5b91b737337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330488, "uuid": "6a813dc9-2126-4671-bb6a-889b3606bf72", "value": "T1C706AE31B79BC12BD56609712A2CDBDF51287EA21F7250C7A3D81EAE04B48D25732E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330488, "uuid": "edaa8a6e-de72-4385-9e03-935db4a410e3", "value": "4c91a0549bba5bb8620f5e47049de659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330488, "uuid": "9992c5cd-fcb5-4f4a-9b5a-22b37d07faba", "value": "98304:eeYkDjxHkKZ02fI+CDIiT3LtiDH3x+eg8T6e2KZYcNWNbIY:pDjxHkKaiVQ8hJZYcQNcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647330488, "uuid": "f2fd70f9-51b0-4cca-85a5-f918b219d94f", "value": 3739089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647330488, "uuid": "e1e7a044-c303-4f02-9e2d-cc6436ff7d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330488, "uuid": "52885001-73d8-41e7-937d-632804583d2d", "value": "eufive_20220315-000130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b49f29-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333478, "uuid": "575048aa-e2cd-462c-8593-dbfb18bd46c5", "comment": "Malware payload (Heodo)", "value": "dea221c7add426663d4f049445c355c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333478, "uuid": "b9e891a6-4dc6-40ec-9112-8b858bc2eb2f", "comment": "Malware payload (Heodo)", "value": "29dfa27f0d2d1a83bfffed5a23e167aff785ace5e50ab607d474e8f165172288", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333478, "uuid": "35c71ec0-f024-4b6f-a910-f20eb808992a", "comment": "Malware payload (Heodo)", "value": "2fce83c2ade634df8e4df8c621454a7a51a52d29", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333478, "uuid": "4a58d4ac-af2c-4c17-9da3-848354ed8a3b", "comment": "Malware payload (Heodo)", "value": "6625e4027f6f33c66dc7d5519d2472893c86b43cb664ea9e90dd2b541d7e9b87d35e4586bf430ae2c2cde0b8c171d997", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333478, "uuid": "f09b14e2-eb51-4901-855a-60a6b2806835", "value": "T1C2257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333478, "uuid": "41c3556e-a86d-4c20-8917-4200d854d4e2", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333478, "uuid": "92b066e9-2286-4a3a-a934-6ce77c5dc501", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlZOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8dl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333478, "uuid": "d1a687fc-fda1-413c-8072-29b4d5fbea46", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333478, "uuid": "0589d232-4a26-4628-9c97-ee587b4cf936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333478, "uuid": "4cab61a2-e5f3-49f0-8876-62fd6206e017", "value": "emotet_exe_e5_29dfa27f0d2d1a83bfffed5a23e167aff785ace5e50ab607d474e8f165172288_2022-03-15__083753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca8bf58-a456-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647345351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345351, "uuid": "216f3913-8b51-4a8e-a804-caf9b272ad3f", "comment": "Malware payload (SnakeKeylogger)", "value": "8a9963cf9a09ebfcc8eb1ac036b1f725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345351, "uuid": "79379fac-06e9-45bc-ba44-c21bd06be42f", "comment": "Malware payload (SnakeKeylogger)", "value": "2a5530ab57193bdd66809775e99678ec6be6053af364e731aeae2fb9baabbf32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345351, "uuid": "8b8c0187-7a44-4d34-8217-e9360b60095b", "comment": "Malware payload (SnakeKeylogger)", "value": "b1cf05952487abb3b8e108cf5b46239fd59447b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345351, "uuid": "ff7cf19f-a31d-406b-b548-d5e4a2637ae7", "comment": "Malware payload (SnakeKeylogger)", "value": "90f73049bc10c074dc485911664944047994efaa4c672a678651ec2f427518a4f7db233de4b18a8aa7844d04405f4479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345351, "uuid": "98c0f262-0dea-455c-a158-5ba78f3a1522", "value": "T15D050206B2ED9F83E47BC7FA8866594843B2B419191EE38A5CC630C315F7F4057A1B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345351, "uuid": "b1213a7c-d3f8-4823-8536-d913d09fc21c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345351, "uuid": "ffdcc250-197c-4b5e-b8db-1ac1ed63a8f0", "value": "12288:T9PmakwOEocE7JR70yrIxWyAWtXy+cYZM4Q25ybeVfTwHZ8p/:5PmBwORJ2WyAuc/2fTuZ8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345351, "uuid": "30ff5025-900c-4bb7-bba2-b69b1b3f86ec", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345351, "uuid": "a3dc6ace-5e97-4425-a569-8d15e1b7cdaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345351, "uuid": "1889abda-f568-4885-b716-2d1efb99f9e2", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03638227-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333820, "uuid": "d0de3818-5253-4026-8e63-dd3d31f89d74", "comment": "Malware payload (Heodo)", "value": "6ee4271ddd2e3a333560ef7eb5f6b686", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333820, "uuid": "d7962dac-32e4-4e42-800e-dbd5b672a7c4", "comment": "Malware payload (Heodo)", "value": "2a7206be8751df654565459950ceee16a9fd5e3e9457a8d8d3c18d5b35823f1c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333820, "uuid": "e27577a9-5aef-4d67-a379-4e13b14bf813", "comment": "Malware payload (Heodo)", "value": "c817819cc04e71e3b7e1cfb4af0ab5de9e77b6cc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333820, "uuid": "8e1da72f-4a8c-4876-8f86-6d50d7e37184", "comment": "Malware payload (Heodo)", "value": "931140f15866f07eef27137d08296a316fdda8ee61f679d7145092d32d817274926843be4f85554a1d0fd1f38eba1f7f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333820, "uuid": "b75378a4-6687-47c6-9036-f9b33dba8f0a", "value": "T12B73E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333820, "uuid": "efa3fb58-9246-46ab-aa1c-f445b1b3618e", "value": "1536:2uSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:QtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333820, "uuid": "49455419-2ba7-4290-b5e2-7ee28d12eaa3", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333820, "uuid": "74c62fbe-f0fc-4110-bbc8-65f98cc5f243", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333820, "uuid": "8d40bdf1-a574-4632-9493-9e540b40ed79", "value": "OMICS Publishing Group.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95dac916-a464-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647351245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351245, "uuid": "21b2779b-bc59-4b68-be79-3e9249185718", "comment": "Malware payload (SnakeKeylogger)", "value": "d6a3f13de568d7f404898e0611b93563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351245, "uuid": "3df72a4f-38ba-42a8-860a-ae5d6c1eda6b", "comment": "Malware payload (SnakeKeylogger)", "value": "2a8b34b6f89fec6d72c2f636564321625a6d193aaa3121e305dba41de6bd40a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351245, "uuid": "b161daac-f125-4e3e-998f-5cbca3398a19", "comment": "Malware payload (SnakeKeylogger)", "value": "6fc3287a4a271b6bf6176afc225af00c3828c002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351245, "uuid": "2f33073b-27f4-4bfd-9f18-f8fd977efc58", "comment": "Malware payload (SnakeKeylogger)", "value": "85a002102926ec6b1c6ea8d7ebfad7b7ce5bf7b474a093eeb7beba4102cdd27c540802778c15e4b9cf1b5163b3bb3705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351245, "uuid": "fc1d6c94-2a4c-4af5-b01f-2627f4d0e769", "value": "T1C125DFAC32C47ADFD563CE36CA641C24AA31707A6707D203A153159DAA5DBDBEE103E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351245, "uuid": "d883f90c-ec12-49a6-b9ef-4c2fcf080764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351245, "uuid": "60d01f0c-8b32-4774-b8b8-c4ee799260b1", "value": "12288:YbaQtl6fkwOEocEcUwlhftPU76yqolJKwTXMCUtn6G0kqRDyxrnigYzV0T4hiEjD:YrbwOuHVKq1wTdkfjYzS4U+t1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647351245, "uuid": "6453f33e-b8ee-4c74-bb71-78cea0a98606", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647351245, "uuid": "6b261359-390d-4c67-9844-e0e5d5a75837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351245, "uuid": "d7795759-7a9e-4986-b79a-d84202672d96", "value": "INV-FLEECE-COM_2022-15_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbf3229-a478-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1647359983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647359983, "uuid": "8feeeb72-914f-45b5-9a7f-13bb49fe883c", "comment": "Malware payload (BitRAT)", "value": "e14cf90346273c633b31bbf0f05ea8c7", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647359983, "uuid": "71905df2-4e4f-4d93-8c7b-cecbeaacfdaf", "comment": "Malware payload (BitRAT)", "value": "2b17c906fd9d86cf3f5f915e6a5c4b57144688ff83acb69664d41012496fc179", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647359983, "uuid": "3e1e7bd5-6e97-402d-98c4-4a9c2c20f0b6", "comment": "Malware payload (BitRAT)", "value": "78271409803480a9010f8d861bee7a4052806f4d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647359983, "uuid": "e13f83db-cb6e-434a-bf39-6719e97b9f2f", "comment": "Malware payload (BitRAT)", "value": "a6e193818e0ccf4600e6d5a4cb506f9b29e6da5451b2ed0050a24c054444317243959b1452fca9e653f44cd0f5ce3690", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647359983, "uuid": "ff6f63d8-c69e-4aa2-85fc-f50dcc863487", "value": "T1A3953320D6B48E77F851867A0A204E7BE9A9C178704D98C5937CFBBA6127450FFD3278", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647359983, "uuid": "619b7552-fefc-4018-bb3d-dcd44cfb93c0", "value": "24576:DA9ZJfK01gXYgQmdabYQ4iQTfgSPqPShkBufzyKI4yJpOO/g7caq7GTsAm5v+W3:UrJfK0WQsab9VVIqP5ESg7Lq7iVmh+W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647359983, "uuid": "8e140f50-aefc-41a1-8658-45ea2a2c6722", "value": 1913670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647359983, "uuid": "abba9bcc-ccaf-47d7-9179-a283ae4468d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647359983, "uuid": "afbca7d2-7ecc-442b-966b-858edce4b6d8", "value": "e8xmdj7h46d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd306dd-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647326184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326184, "uuid": "1adca5be-e868-42ed-9608-fb4ac1cbc38c", "comment": "Malware payload (NanoCore)", "value": "7715426d4c16415a6d7670af2ea74be5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326184, "uuid": "06dc061a-9165-483b-85c8-5b8eb5a5df55", "comment": "Malware payload (NanoCore)", "value": "2bb206e55c18ac896b02a8ec624d80541011174d7d1dc0257ad5a578dd871179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326184, "uuid": "29eec7fa-639a-4976-af91-0d1bcaa5e522", "comment": "Malware payload (NanoCore)", "value": "a07adaa7423c7dd22fac625b4d523ce33c216740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326184, "uuid": "ad417623-de0f-4630-a2f9-409e2d77da4e", "comment": "Malware payload (NanoCore)", "value": "ca7efb20863ae54517e081b34b3e65f2e12d9833644bb0ff9bf51acbd4d7a8eafc8bfa98ff7c49269ea1529ab15c688b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326184, "uuid": "43428d4c-610b-48ae-92d4-a78e87258183", "value": "T1C5051216F2F89F92F4BAD7FB482A294893B6B559250ED30D0DC630C718F2F014795A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326184, "uuid": "119dd4e3-21e7-4805-930c-b1c55fab6c01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326184, "uuid": "741533f3-b3b3-4954-b9b8-b12517c99c59", "value": "24576:PmDwONXVpv4NmsYokNLe2Bb92oIr58tiDK9P:Paf/ODfyegh2oIr58AG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326184, "uuid": "38a04f53-d321-4e0b-890b-d1fd81b8c80c", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326184, "uuid": "e9d8faeb-2dee-4419-b144-fdafc6d9ace2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326184, "uuid": "628dcc5f-bd34-46a5-974d-839f1df6c472", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a15f3b-a451-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647343080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343080, "uuid": "6eabe419-de77-408e-b390-3e2c3cdd06cf", "comment": "Malware payload (Heodo)", "value": "863a00b6aa145a0ab4ca47577cdc5af7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343080, "uuid": "01ea95ea-f6bc-4bbf-ac7a-4929e9bfa903", "comment": "Malware payload (Heodo)", "value": "2bd1d5a4d225ea078d02c5404a6d7a8ab48878c08be1b0de6ccc62c693f34f70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343080, "uuid": "f38937bc-20bc-42d5-b0bd-6f21bafa751b", "comment": "Malware payload (Heodo)", "value": "318641c1529f1600302f6944a80e54e603f4e3cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343080, "uuid": "cf3f9dd7-7d6a-4904-992f-ddc76ba0528c", "comment": "Malware payload (Heodo)", "value": "66abb9cd479e44845bf3d6578da6969c326973d66b48b261d8ffd6193e236ef5b171f55cf4486b82f2ea908283e8225f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343080, "uuid": "41699d89-2353-45fa-8ae0-c1401634b503", "value": "T1DD257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343080, "uuid": "27dfad8c-2f92-4b02-bbe3-fdfd68e7e333", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343080, "uuid": "bf022d00-f51b-42ce-b4e3-f471690fbb95", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYrVP6FuR6shQLj88F+Krf6:v6oycln8cACiCP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647343080, "uuid": "e1dfa055-5e4c-4d27-bd3f-0d34b6da61be", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647343080, "uuid": "dcd3318d-824b-41e4-84c8-d891c54c8586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343080, "uuid": "8c48d9cf-71e6-49c5-a3b4-6b63f7640914", "value": "863a00b6aa145a0ab4ca47577cdc5af7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9dfa8c-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "af949c92-40fb-4eb8-8c27-c13cdf4c4d28", "comment": "Malware payload (Heodo)", "value": "11ed768e09ff8661e836348b024c38db", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "d6b19053-627f-4796-8df5-b6fd378a754c", "comment": "Malware payload (Heodo)", "value": "2bd68594a272ed2f336d7d54272a8e7b91848dee583170424ecd59c790306d90", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "03105964-281a-467e-a74d-ee3b1d796ab1", "comment": "Malware payload (Heodo)", "value": "98e951c883174b0341a3900767648ddc41a79df6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "42acee53-b3e7-4345-8670-6d6a8eeed995", "comment": "Malware payload (Heodo)", "value": "b17e7889247c40dc4a9dc1d5138a855d539922474a8281e9e6eee885d257ded4dd69c759c1ab431672646f6e39f7bdf3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "a9d4b215-5a00-4bc9-8c8c-eb0e0c968d22", "value": "T153256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "dd0d026e-5a30-44af-97d5-45ceb2398dab", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "54477251-5fcd-48a3-999e-e0fafbd14bc3", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKk4wLBeUNKsuG31Pt8H:3dlV0EnITKwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302695, "uuid": "997957c2-2815-4306-8a04-cf1158ff246a", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302695, "uuid": "e7d23d28-4972-4216-9e0b-a9d1c5c58acd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "81f7a8e4-be59-420a-bc7f-1b5d0d3a2f96", "value": "emotet_exe_e4_2bd68594a272ed2f336d7d54272a8e7b91848dee583170424ecd59c790306d90_2022-03-15__000448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d81cd42-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647333837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333837, "uuid": "8294cf0f-aca8-4113-bbd5-f0821870fd6b", "comment": "Malware payload (Formbook)", "value": "141d9c1ff226fedde53d68b36ad4d57d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333837, "uuid": "8eb17423-0c2b-4f52-a621-5109f322cf4b", "comment": "Malware payload (Formbook)", "value": "2c3d0dfe94f6ee36822a79a0d6bc22efbd964781a984dec679acbb5029ce1493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333837, "uuid": "4639b8a2-846b-44e2-bf29-b2d26d4612ab", "comment": "Malware payload (Formbook)", "value": "752f82f39496cf70d5d5cb4f028301c7a1648b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333837, "uuid": "7780e385-acf1-424d-925b-b6dcc0e98dd4", "comment": "Malware payload (Formbook)", "value": "3382471ee07af7b3398d2d8608074bc39604ce5f996f61885e43334e2e5c142888ae80d25e056631f6bb307a56491adf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333837, "uuid": "343bb6af-c208-4bb6-97e6-47cdb9743ecd", "value": "T1BC35AE23B3804B36CB2626B74D1BA2946729FE555D28E9462FE43E085FB45F3F835213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333837, "uuid": "14f951ce-16e1-4dfe-950a-fb4d0016567e", "value": "777e841787613958f7e29d118d28ecbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333837, "uuid": "2d3699c4-e478-4dc4-96e2-aa127886f1bb", "value": "24576:74Qea4ilR2Ck0H49Q49OWvpL+hT7fjCURX:7eeRzyAn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333837, "uuid": "9a8bc236-1f72-4604-a97f-e3321a5dbf96", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333837, "uuid": "5715167b-912f-45d4-9e97-80e64f9eb529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333837, "uuid": "fc9c4648-161a-4f21-8ce4-3c568b33b8cf", "value": "Xjnnpfmtmgzsjdtbismbqwngwvhuqbxdfh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397729e9-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326180, "uuid": "39e5fccb-d35d-4fdb-b4b9-3dd9ee8c1b66", "comment": "Malware payload (Mirai)", "value": "c88a566a0e3a818828118bded8b2d475", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326180, "uuid": "2232870f-20af-4c48-bc2e-4b119408def4", "comment": "Malware payload (Mirai)", "value": "2c73b3956dec066a8a5e3a18bfa97ebd72f12777a0e192c3e619220795c9e2dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326180, "uuid": "9f3c6254-5836-4b13-965f-68c5150ae3a8", "comment": "Malware payload (Mirai)", "value": "c399ea2c300b32122967f6ff741538699f802035", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326180, "uuid": "b885005f-47e5-4f43-8128-78ea3df0b9df", "comment": "Malware payload (Mirai)", "value": "7158e445015af0173430d1c510a21142418fd44d94b1d323982a4ddc97cf2d13915fd8cd0832b1eddd8a963631ca5121", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326180, "uuid": "e2b7171e-0bc6-477c-b79c-840288b56d24", "value": "T12F833A24BC391E27C0E4A17A21F7C722F2F5228D21B4866D3D710F4EBF556407A47AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326180, "uuid": "4d8d3655-49e6-4d59-ae00-66292ca8b41c", "value": "1536:FrWZnHJSkunDANOJpkEJ1+fUH4ZtNMMCcz75ZXbtAR:xWZQJ0GCft2zczVIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326180, "uuid": "80c9abab-c7d6-4208-a4d8-6278dfbc4315", "value": 87844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326180, "uuid": "5a19071a-24fb-45ff-911e-b95d7c46dc0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326180, "uuid": "0eea38b4-f79c-4ae7-9f21-8a74e42973c9", "value": "c88a566a0e3a818828118bded8b2d475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318a8de3-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326166, "uuid": "a06f2b5f-44b4-470b-9a6a-e7b2c8543fe5", "comment": "Malware payload (Mirai)", "value": "5340f83c411f951382ad633fa5b0bb37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326166, "uuid": "9a7f65a9-9e53-4c89-9e54-be573682583c", "comment": "Malware payload (Mirai)", "value": "2ca089725f3d08f11babd9f18434f92155fe9f1d84fe344ecf7ffb3ec1ea7c86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326166, "uuid": "48c9e9de-ae93-4673-8f06-2abdd025de2a", "comment": "Malware payload (Mirai)", "value": "54ca47800ff0a7102508a72230e52bb7251aa134", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326166, "uuid": "bfc2eb5d-dd00-4e48-b755-0ab024454885", "comment": "Malware payload (Mirai)", "value": "1a44eb83df0e9eea9010fdc40851c8e0ad6958e119168ea7fcac385357cd53b97ccfe06a0b3ad7ec3b272a8421cf6327", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326166, "uuid": "c7654b2e-a8d0-4f4d-ba6f-390c8a0ff052", "value": "T14273AD33D1686DA8D0668B75B9988E309B23A28416933EF6D794CB784013EECF505FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326166, "uuid": "99cb428e-c0ac-4cc5-a3d2-1f8258aa4a15", "value": "1536:9aD/MEGvbwt+i7EhHIJn8C/0rrnmFllrKkNGIkFgCJl2c:9OkdzeEhoJ0rjElOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326166, "uuid": "b80c55f2-f250-4189-843d-8396efbb5210", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326166, "uuid": "099126b8-a0b1-4fb9-b3b5-67320b89f984", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326166, "uuid": "fa719c84-dc8a-48b6-9ca4-bb1d7b916feb", "value": "5340f83c411f951382ad633fa5b0bb37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5665adf-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647363297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363297, "uuid": "2ea27b7e-9c70-40bb-a7a0-e7b0b444881f", "comment": "Malware payload (Heodo)", "value": "9dc87ca3f4031bd4b0f704a5da0a0dd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363297, "uuid": "87f9408a-0b67-49fd-b365-c9c26953befe", "comment": "Malware payload (Heodo)", "value": "2d5b50680c0aab63639d046c897ed8e80cf23751658650ff49e73201b668c252", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363297, "uuid": "8155925a-0970-4589-8689-727edbed71e1", "comment": "Malware payload (Heodo)", "value": "50628390b75b77c42c7931f645c8cb1f6aa60377", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363297, "uuid": "21f6b788-af99-4932-bf25-4ee3a954e117", "comment": "Malware payload (Heodo)", "value": "049cc32430e65534c051c67136dc6fa11a25327abb2a34e76a891674d5c0e6499f42bd69d9d13c14defddbeae4db9c85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363297, "uuid": "2e8a10ce-cdfe-4ddd-a2ec-a679cd7b6111", "value": "T16D257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363297, "uuid": "4cee0b11-f374-4c51-9d6b-047d3fdb785f", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363297, "uuid": "c85809b8-4440-4c09-8849-71bae2150731", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKl+OlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Kl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363297, "uuid": "cfd997b2-fafe-4b71-b994-d9ea91244d9c", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363297, "uuid": "8eb62b52-2133-433c-9ff7-1cdfd07c6033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363297, "uuid": "42cdf10a-9f25-4357-88c8-78f7cbbd016d", "value": "9dc87ca3f4031bd4b0f704a5da0a0dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4741e478-a456-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1647345101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345101, "uuid": "9f0ded2e-343b-4757-a343-efa5aebb164a", "comment": "Malware payload (BitRAT)", "value": "4f793bf00f3d3d2386de71b7f4d909f9", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345101, "uuid": "66daa427-42dc-4c12-b830-51a33f50f2c1", "comment": "Malware payload (BitRAT)", "value": "2d94d61829d259d8e5d224ca67e580aa056e7bdc13a841c6a1188b657a7c008a", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345101, "uuid": "4faa3e7b-b3e4-41b4-b319-c72606fe35d4", "comment": "Malware payload (BitRAT)", "value": "a8a2536e6052505553405d507202614aeffa8e42", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345101, "uuid": "e60defda-17fa-4137-a2ed-810f8085aea1", "comment": "Malware payload (BitRAT)", "value": "188c61dc454bd9499da429849d7843de180ac53d32e259e246e0400fde4e1b5d7f38ccec2035dea9ea4a62eb734120bf", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345101, "uuid": "bf5e8add-b87d-4a17-ac9b-86bdcaf1cd30", "value": "T13BA52314AB50E436E4F702F899B9A29D653FBDA05B20A0CF72D239E94734AE4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345101, "uuid": "4391e29c-03eb-48e4-9e3b-9e78ba3ee5da", "value": "7cff2e062748d0c7179f1e085cf45fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345101, "uuid": "e1588718-acf6-49a6-8986-61ae8c3c2606", "value": "49152:Z81b7T20l0pNpy7esyyOFoiuQ/YwDrFKisK4jT1F:e1Nio7QynWZDdPaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345101, "uuid": "5ac39acb-6fd4-4069-ad1c-aebd24f58b83", "value": 2224640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345101, "uuid": "04780314-44ab-4c4e-9b72-9990e249d1b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345101, "uuid": "1940b7c9-af17-482d-a17e-2543832c49af", "value": "4f793bf00f3d3d2386de71b7f4d909f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe8e36a-a4ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647383206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383206, "uuid": "76961bab-7646-4cce-8492-555f366f193b", "comment": "Malware payload", "value": "22bc995013ffb9eab19d407dc601a14b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383206, "uuid": "2f3e229a-0231-4964-853b-7ea0afcd3dea", "comment": "Malware payload", "value": "2dbdf7ca3f969e01ec00b713fc613dd75cea3eecd6a87dd2e9e0a80d24dd464c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383206, "uuid": "dc4fea0a-80c2-419b-b079-1563f659349b", "comment": "Malware payload", "value": "2cdb09e3f24fef201f6f96cc777aa5f3385290b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383206, "uuid": "551558b4-eed5-4953-b3d8-19ddf66e237a", "comment": "Malware payload", "value": "25c5752b92c2f1eeaa6100fcc2b02c01707f2e4b21450331fc9d28da81c7846a9b0ce33c304fae6b5f7647f8263a3c42", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383206, "uuid": "27d1d57c-ab47-4c7a-bd31-006ae8c7fbfc", "value": "T17A03F95AFD40AF01D4E525BAFF4E124973535B2CE3FE71129E216B2523CA96B0F36806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383206, "uuid": "533c7fb1-8e27-4895-b31f-01a1ca091bd8", "value": "384:pCnCn5cm32cSd5QDp7KI1UE2IPXWjiBo41sZHZdxwq8uJ8lVY2gXx4eHDH5fQIe4:pCnClDeOd7K0kiBXuZNtHJ8ldc9e0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647383206, "uuid": "7cb0e162-bec5-455a-9bd5-678912e5d4ed", "value": 38168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647383206, "uuid": "991c2bb5-0592-48c1-b270-05f58706b5cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383206, "uuid": "55f650b0-e88c-464b-b54e-36d91f8c6dd8", "value": "Ugliest.arm7-20220315-2226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c684b1-a469-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647353332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353332, "uuid": "0dd54728-4c05-4f8b-bcdd-182b15783fd6", "comment": "Malware payload", "value": "f672d4d734aef0eac45fbcf951094a14", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353332, "uuid": "7a8f3db5-0aac-45c4-a44a-96922f7f82b7", "comment": "Malware payload", "value": "2dd41b55bdfd562b47288845f6ea8b0d1b962f93389b5ba0c80096f48c2d0707", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353332, "uuid": "e5f52040-bdd5-4bd9-9825-b70cc8489256", "comment": "Malware payload", "value": "8fe450113b0a5072e891b5772b97a7459833267c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353332, "uuid": "a683a7af-f8f2-4e3c-8175-ead9b7f900fe", "comment": "Malware payload", "value": "4cf891978dcc5d2d69e5ab4b687ec3cb0507e742f7bc397205b2e230d691d2b7b04bc267f54b90ffc546bcf64ef7bef8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353332, "uuid": "56689dc3-a216-44ce-9ccc-9b048397fc7d", "value": "T1F1B26EE0276499E3EE8A8B93D179FE8D125671B799CA1184204DFAD51F373528A0DCC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353332, "uuid": "1dac94a8-d25b-4238-85ae-606604418cd5", "value": "384:R2bxaRgvo29RmhfTR3oIGmh/NoCja6IJJFIOk2tYzk4UxRdqfjWKTUnQDEqUAfmW:KxaYoP3DGEgJJe4YXUYi8Q7ifmSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353332, "uuid": "4ddf9b3d-5300-465d-a2aa-8a6a455a5a85", "value": 25632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353332, "uuid": "5dadfd47-9ba2-4863-88d8-4f1d227b7983", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353332, "uuid": "a7e21b2f-dfcf-43e0-be13-29a83036d79d", "value": "0021746882661.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773fe089-a466-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352053, "uuid": "982f1661-57ff-4e11-9286-ebae7d6f8438", "comment": "Malware payload", "value": "80f670f46b3f1a6fb613e6a6de092bbb", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352053, "uuid": "bb87aef4-3377-42a1-b801-26f26ddfe3f2", "comment": "Malware payload", "value": "2dff4dc304706a295989d88bb8047644eda4b8c253b1e3ae6e6b9f09cf4ed72a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352053, "uuid": "48359157-b5d3-4ed8-814f-ab491e3a6a59", "comment": "Malware payload", "value": "a9fdf8a2b36e233bd83d12f721a86fa5e1bd13ea", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352053, "uuid": "d1605b1d-7e75-4364-af8e-b5a118b10f5a", "comment": "Malware payload", "value": "1783360e3211c9720ed601c7868f78d14c2ff1b99489be04055928ddb991fa1602b921a342580b0c536198030ad6f986", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352053, "uuid": "fcfcc417-6586-45ab-97b6-a8e267fddb49", "value": "T1EBB1A2758D589EC202DD7B42A6F734F61A10360343BCCDAEA3348CC13E959257F669EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352053, "uuid": "4a2b835e-cb79-4860-ae3a-3f5bc99d313f", "value": "96:lDloDX1N/yZCUcJV+ZskfOPuMV5v65YqS:NYHUVZr0IYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352053, "uuid": "cd308aab-2f8c-44b9-a0e8-65085d986a01", "value": 5453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352053, "uuid": "32be1898-232f-47b3-bd2d-bdf444777474", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352053, "uuid": "24082c9d-9899-41d0-a9b9-0e5fce2c369a", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fc262f-a41e-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1647320991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320991, "uuid": "41c43188-d65c-4daa-8d47-97d51506a2ae", "comment": "Malware payload (STRRAT)", "value": "f89ef990de4358827c3bc373c762f758", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320991, "uuid": "16598bc6-8555-467c-a52c-d4740914ea13", "comment": "Malware payload (STRRAT)", "value": "2e092681923943b0b690e43a8e6cf2b2de44ba13072878960601efeb2e7ec380", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320991, "uuid": "3c17ee14-765b-432f-8508-b00342ce5757", "comment": "Malware payload (STRRAT)", "value": "ee398f176e6b70f5b7331cb9a135fb359b39f1c7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320991, "uuid": "76ac5d87-318d-43e5-8e44-aed643800eed", "comment": "Malware payload (STRRAT)", "value": "62c8992859929d2962c6826d78ab42c7bc81ad60b5a53d2c9816bb541d88ec5b6e22c104e199d64e01a838de4345699e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320991, "uuid": "ed3c5a1c-442c-4100-9e64-0381bd57ac4e", "value": "T16A05C84535A12A1BE774F63CD712C12DFF207933299326CBAA910759BFF49202D9B62C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320991, "uuid": "fb205ac7-97bc-4530-85df-e05b62f29a1b", "value": "768:IIn2Jt/JsW4snqSQwjJx01O1HVg0xcTqpSDk5zvFBa8PoUUqPovG4+YGv/HVcWaf:JwtvZP6fk9MhhuU/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320991, "uuid": "c482923d-a5af-4560-bbdf-fe0685a8cdeb", "value": 818880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320991, "uuid": "c8eae25d-0c12-40d7-8253-466c2ad57b8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320991, "uuid": "7c0b4526-afd5-4622-8633-17c89426af91", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c410c1-a452-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647343387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343387, "uuid": "69381100-6237-4f10-aecc-a3e94a6dc331", "comment": "Malware payload (AgentTesla)", "value": "799dd812303a0b48824ebabab68959f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343387, "uuid": "53deb66e-e401-4727-8d55-eb896ef9a09e", "comment": "Malware payload (AgentTesla)", "value": "2e24a2c7db956a1f99781fc5e5ccd4251a1e78a67ed55c77b6b35b8cea707d6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343387, "uuid": "97d8b07c-e6ab-4e48-bd11-881a4bbcd63a", "comment": "Malware payload (AgentTesla)", "value": "a4aae98bb1d0652cfeb6eff4e80215784b5e751c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343387, "uuid": "c9f44a57-c2b1-48a8-9a08-800febecba6b", "comment": "Malware payload (AgentTesla)", "value": "0ae611ea67b87bd8312a8c559b66c383b0ea9053f06a1f41961e452dadf31616ce1a26d3053c9f9492eb9f5ac18f7208", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343387, "uuid": "2d0507a4-b7e0-4841-9cf2-75abdea2770a", "value": "T1BC25DFAC32947EDFC513CE76CA642C24AA71747BA707C203A147119C5A5DBEBEE112E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343387, "uuid": "0a623c1c-d1f2-42db-a36a-0a7400638a03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343387, "uuid": "fe5e7ea6-fe2a-4c63-b53b-3ca88d88f09d", "value": "12288:OG59RaWieKIWkwOEocEcQRVGfvNar/vPy5ERJGCDzU4hPuILmIgGilooZqL7/ixq:HRaHIVwOKkSkH2Y3LmBLrZqPrYU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647343387, "uuid": "ba65fd85-e443-4fc5-9867-a01a9ced440c", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647343387, "uuid": "c1e1d475-3617-42a8-9220-152e5634758a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343387, "uuid": "538b092b-8cfa-4620-838c-b755d57884af", "value": "esnJDbyfB0h890s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30af45e9-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647353653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353653, "uuid": "9f1ec432-5b00-4cfd-b112-3c3bcf8b00c1", "comment": "Malware payload (Loki)", "value": "2a2d10ce461f1679a6bb25b8aecb1bb9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353653, "uuid": "fa255a9d-2a12-4260-b9c2-5f9dba47338f", "comment": "Malware payload (Loki)", "value": "2f5b3d01fc68cd1db1b856addb758ce5749b36812eda9d172f6a5f97d102b421", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353653, "uuid": "d3bc9501-4f51-493d-979a-5035fcd03ac7", "comment": "Malware payload (Loki)", "value": "8cb5d4921ec99621d9694ff461832615b15d4c5a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353653, "uuid": "acef5456-f29a-4ab0-acb9-8197358dc534", "comment": "Malware payload (Loki)", "value": "73f98278004775df19bcfde9a26e42d738113374c5b6fc441052d936b5120d455f67845c25fee2190afadd21d99dab64", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353653, "uuid": "8516be83-694f-47c5-92f7-ccdbb8c530f7", "value": "T16F1402D038F6773ED5EB96B90DBBCE662610FC92047AC3A0603FBE5A5D7340586E6640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353653, "uuid": "3ecbf6e1-12b9-466a-931b-29e012d3ef04", "value": "3072:wGW3zlIM/RX+ykvvCSPR0meKxk+ACnYzLCtkJgkrTIF/GsQm9PXciFFio:a3zl7ROykHCS50Uxk+Hn2CtkJfrTi/GI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353653, "uuid": "f3ccd913-0421-46cd-8820-1e72676bc546", "value": 190680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353653, "uuid": "bec6d852-a190-4d5d-b323-9d3f91cc0a96", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353653, "uuid": "ea52b08b-28e8-430b-886f-bc3431f94373", "value": "Payment advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4f126d-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "8c16019d-0f6f-4a9d-97e7-e4ffb704f4b0", "comment": "Malware payload (Heodo)", "value": "a62f1268de7d8d603fcf7eeb6838b831", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "4959f5af-ac04-45b1-a701-09a91269792b", "comment": "Malware payload (Heodo)", "value": "2f908080e27987e2a50ec057b9254201ebf37f9efbb22709f168b66156dcb0a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "867f77b5-eb3f-4a3d-a690-d32182a74655", "comment": "Malware payload (Heodo)", "value": "74f184cb3739c518bd640bd1cffe4a67e853260b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "fd8a227f-2706-42ed-89f8-b51432adb96e", "comment": "Malware payload (Heodo)", "value": "3a3f4ef5878d8f245fb07f78462d80177882288bc2dea22fd6d3dee3ae75b0030d7f8172608072471ef58f3fe5715596", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "3f565604-e68e-467b-8ec4-6f1ef36f1171", "value": "T19F256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "3da1c4e5-828f-4d03-b908-15f177c781cc", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "e2976476-76be-4f04-9b47-ccf54be44312", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKktwLBeUNKsuG31Pt8H:3dlV0EnITTwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302695, "uuid": "96205841-5f6c-45cf-818f-bb6341061e46", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302695, "uuid": "50161d1d-647a-4477-9de0-3353459545e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "ec81a61b-b0ea-429f-9772-3a44941ceae3", "value": "emotet_exe_e4_2f908080e27987e2a50ec057b9254201ebf37f9efbb22709f168b66156dcb0a9_2022-03-15__000447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb22411-a459-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647346428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346428, "uuid": "2b79f8ed-de98-4a9f-b876-d9a5474209db", "comment": "Malware payload (Heodo)", "value": "dff98e191767a78288e7d678843b5d2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346428, "uuid": "c97c2f85-07c0-4b80-8cba-95725f0dc6c5", "comment": "Malware payload (Heodo)", "value": "2f9387a796ba12a3b30282a4f64792db2bb8890eae5853b2afd9af61382f4edb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346428, "uuid": "5c59995d-8af0-4762-8b32-88a7193f7761", "comment": "Malware payload (Heodo)", "value": "66aefa20bdfd361ff69ba3c2f8a67640adaf362d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346428, "uuid": "42710a26-3f7b-4ebb-b9cd-4f5cd5678254", "comment": "Malware payload (Heodo)", "value": "429774dfb658f4cb4c80cd01193a2510ff3a1a7c84365ce2dea1e3590dd0c7d529c157fd47913824ca3a93dc91c12681", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346428, "uuid": "1c15db83-30c6-4cdd-beaa-9348a5da83a3", "value": "T145257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346428, "uuid": "425c7f00-b73e-463c-bbc2-9d627d428208", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346428, "uuid": "b52f95b5-0c7e-46e8-879a-d60069a69f93", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYJVP6FuR6shQLj88F+Krf6:v6oycln8cACikP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647346428, "uuid": "b434b6a9-8792-4bfd-8938-0c06a704c28b", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647346428, "uuid": "f5654cc6-0d4a-44be-865f-fb5d21c8246c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346428, "uuid": "66e05f51-adc6-4d52-bf4c-896321826802", "value": "dff98e191767a78288e7d678843b5d2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3874b1-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647354689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354689, "uuid": "9af5f6fb-1e6b-468b-b104-a9827ded2b8e", "comment": "Malware payload (RaccoonStealer)", "value": "74aaa9706f7da9e897abb71c42d903dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354689, "uuid": "6078bb36-40b2-43b4-ae8a-56007f0a04d4", "comment": "Malware payload (RaccoonStealer)", "value": "2ff1b440f954bf8779f8c0ddfc88bb6fc0e095bd176ad4606f81d006a8634d3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354689, "uuid": "277c9504-9838-445d-9f8d-65324b19a4ad", "comment": "Malware payload (RaccoonStealer)", "value": "3136a881c6c294b3d83a890dbecc07acf0b03447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354689, "uuid": "659ae7df-b3d1-4906-822e-c2f177ec75b2", "comment": "Malware payload (RaccoonStealer)", "value": "04eb4a7622cbdd831fccc92064968be2b48bb346a87d71801d6b70a8f55403a9111f5f5da9960c96d7e2c302385b1976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354689, "uuid": "73e9ee69-face-4730-b288-2704f638635a", "value": "T109B4E100BAD0C035E1B725F849B993A9693F79A15B3456CB23D43BEE5675AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354689, "uuid": "d8687b75-f22d-47ab-aef0-9164a1a33d88", "value": "0bff565af25c1bc5033321ca0bc710a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354689, "uuid": "68bfce86-1bb5-4a1b-84f5-772db7792522", "value": "12288:74wI966LebbFFg9Ix3vOrRveeAnITX6peikojcoIbvyEtyIZA:E9TebpFd2RWFnITKsmotvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354689, "uuid": "1ff2cea6-2d04-4c1f-87f3-54491ee11221", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354689, "uuid": "fa8463f8-90e8-478f-9dcd-07603f754e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354689, "uuid": "32795825-8981-4899-b406-5474193eee73", "value": "74aaa9706f7da9e897abb71c42d903dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3deee79d-a464-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647351098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351098, "uuid": "195b91fc-d7c2-4a3b-97f7-2806571860a4", "comment": "Malware payload", "value": "470bb6769b0c0c6ce8a1863a83970d32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351098, "uuid": "cfb458a3-8769-44d4-8135-405afce5aaaf", "comment": "Malware payload", "value": "3007c755c63258ebf4ef656f50c4a27b9e180caf06b39ec202857c79ea5b7de1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351098, "uuid": "826eee35-a855-43d6-9067-342615c9b65c", "comment": "Malware payload", "value": "f3583f6df145cb2d23d8c19ebbd1aee74d4bca7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351098, "uuid": "9e3ace90-ce76-4ee9-9df9-ef2bb62b09a0", "comment": "Malware payload", "value": "91100a172ad4a9f74d95494668f5bb97bd87987ae2730e867228caea60e9988eb2c94646ab863cfabded1a0b8616aa25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351098, "uuid": "44139f0b-bf59-4ba8-8a67-4eac1b19f38d", "value": "T106231A05B78C1A51C75A9D7A41E25540037BAEA76932F60EBD8C322E1F73BF26606B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351098, "uuid": "c5a238d1-87fa-4f43-8af0-ab69f7713b25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351098, "uuid": "651bb6d5-ec06-4807-bc75-399d4a0d0e7f", "value": "768:p5WCh0ZpOW8awgb98Khyk1O8qRfg1i/9JD7EqhymSSbp77p2zXi:DWDZQoliRI1i/9EfGqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647351098, "uuid": "3eb4506a-8017-4248-aba5-49ffb50d20b4", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647351098, "uuid": "436f71ab-a6e5-4670-a920-f1faa6b7a6cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351098, "uuid": "613fdb48-9e92-4b7a-83d4-08d5fcece28a", "value": "Awbfdx n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8847aa9b-a45b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647347357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347357, "uuid": "5726f321-0ac7-4d2d-9f00-fe0734926cf8", "comment": "Malware payload (Heodo)", "value": "f2e152fc632275db05700699e35f178b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347357, "uuid": "9174022e-c670-4ebc-b0e3-82d92f946908", "comment": "Malware payload (Heodo)", "value": "31dbe2208e024f9aac97a98c9e5459c965046b646a2f36b918044aecbecd3646", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347357, "uuid": "cfe2e1da-e5ff-4197-b4c8-85dd137a6bdf", "comment": "Malware payload (Heodo)", "value": "84b174ffca948272a97cd4c7c6cfc0f743336ca2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347357, "uuid": "664f52ce-c560-488b-937f-b52cc24754c7", "comment": "Malware payload (Heodo)", "value": "3e26788334876473e59bc75a71a54e8ff8ecb15b87f3fd66dc443e82ab79a6948e276253efc1c9fe3ffd94ef136e1b88", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647347357, "uuid": "aef79ea2-3fc5-4ef8-a9ab-f7c986d2bbd9", "value": "T1C744F803E98E537CC85F94BE82AB723A1867C83D0771D99BC2D56CD877248E1993EE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647347357, "uuid": "833219e8-e8ff-420d-a2f9-3dc45b5f0bf1", "value": "3072:/oFqSxNTXh/5DaNaKUQA799Q6i7gLifbvYI2MEeF6:AFFTxx+67O7tB2MEc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647347357, "uuid": "148da37c-1907-4f9c-9430-acb6863de5a5", "value": 267355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647347357, "uuid": "ea8e3598-cace-4c3b-9e64-029123498920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647347357, "uuid": "9f487113-f9a6-4b12-a9d8-9821b6fc79d0", "value": "emotet_exe_e4_31dbe2208e024f9aac97a98c9e5459c965046b646a2f36b918044aecbecd3646_2022-03-15__122911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b84d5d-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "5f18538e-b800-40cf-ad0d-52751c2502de", "comment": "Malware payload (Heodo)", "value": "06b4ad6ad9717e16cc73b4e833d23d32", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "db0705a9-bc64-4ea8-9248-6ef1d88cd39b", "comment": "Malware payload (Heodo)", "value": "31f7e5398c41d7eb8d033dbc7d3b90a2daf54995e20b5ab4a72956b41c8e1455", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "020ca3e6-8e02-4847-9aa7-79f50269e344", "comment": "Malware payload (Heodo)", "value": "bf056d9e6e83cf8f67905c5e8caf0f7e7f81cd08", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "9e0ffc69-8596-4239-ba6c-ca6cff27e775", "comment": "Malware payload (Heodo)", "value": "38e8dd893886930f57439df5c29ee68b1c22720aaed6772c351045472733d047fea769ab9bf801d770c3de772f76fa8a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "3e691f75-8073-4b91-b70b-5768e533aa64", "value": "T154256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "f763667b-a604-444b-a65b-a1f4b0e95737", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "46814d6e-72be-4077-b208-eb914648bce0", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1sWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg66WeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302838, "uuid": "a354a2df-70f0-42a2-a2ec-0996cc981ab6", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302838, "uuid": "7b2565c2-b4d2-4d2e-b8bd-e5e30c43111d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "c163f867-112d-4d5a-9604-2d7b32f0f481", "value": "emotet_exe_e5_31f7e5398c41d7eb8d033dbc7d3b90a2daf54995e20b5ab4a72956b41c8e1455_2022-03-15__000706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3672ae4f-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353662, "uuid": "b14ccb76-9cb2-482b-a4d8-6467749a132b", "comment": "Malware payload (Formbook)", "value": "1aa214c716355cf2521f17f0090a2cec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353662, "uuid": "8a4bb09a-d05b-4f2d-a567-414612cd140d", "comment": "Malware payload (Formbook)", "value": "329b258df8c88a0f3fe504af18f2f32cb33da73cc50363049a8aebee8f9c610c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353662, "uuid": "64de1e89-079b-4f67-b5da-6bf314434fd7", "comment": "Malware payload (Formbook)", "value": "c291491247730e4b86836c318de9f72141163635", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353662, "uuid": "e98b771e-d263-45cb-96ea-6d03ed5440db", "comment": "Malware payload (Formbook)", "value": "79f0beebec6c68ed3f50b39930c8cb88f7e342c73edbe09c5b29a25ee03fce799fc43f80f7639d46b81c041fd8cfdaa5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353662, "uuid": "8ab790de-8eb7-405f-be5e-5d63699baa33", "value": "T1A714120931C8684BF1BC54FE8E36AC07C3C9DE2A81C16696B56A374981FDD02D9B1D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353662, "uuid": "0a9b623d-8a2d-41bb-87ff-8b9c6c360a55", "value": "3072:ALTadrsPrbPSo3VLvtZO/oRDmFBb4K8UFFqg9SreTgxqDrowd27QGF8:AatsPiMVLreWD0oMFL9Srbx2oS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353662, "uuid": "fedc029e-71b6-4d85-bde3-6a7991b75765", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353662, "uuid": "2d101f82-ff14-401e-bbef-eb0c76583ce8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353662, "uuid": "81b55ddb-166f-4c4a-801a-9f42d5fadf3f", "value": "RFQ_29293.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328cc8f9-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647353656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353656, "uuid": "a73d3be5-9797-4c78-91f5-b6bd21e3c824", "comment": "Malware payload (Loki)", "value": "30e3d7ed08457aca8b3639fde0ebd765", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353656, "uuid": "a747fc75-337d-429a-99a8-364dfd761a44", "comment": "Malware payload (Loki)", "value": "338bc8c28bcda325360b994587080251493c9ffef542118995cca59e1b649f52", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353656, "uuid": "4d419970-af16-4185-b799-a9103fd17003", "comment": "Malware payload (Loki)", "value": "2ab5569c7692efabe2d5cb056e832845e1b97cf8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353656, "uuid": "6696b237-6628-4578-b1ad-2d9187ab6e0a", "comment": "Malware payload (Loki)", "value": "2cf2b8d5d2707b562e71d50c9db24f126417d391e0c25256397d9c2503bced149dca5f04e9d684f6b016e756f200ed58", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353656, "uuid": "e557c504-daa2-428a-8dd5-b5695852e797", "value": "T10D1402DB3980504ADEA417342D0C966FD7ADCD5A463DE04BE9473311FCF0FAAA4C9A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353656, "uuid": "4ad94670-190b-4992-a651-e974ad418288", "value": "3072:5w/aN+bBRD4Tlj9OZeZQQX5Tf0oo7NzOStLAKVXqnMtLZ5r5swE9JqUMhOh:qasb3ClmeZjeoo7NzO6LAKWMtLpIJqFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353656, "uuid": "ec197aea-ed5b-4733-82d4-af8f235a52f5", "value": 191048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353656, "uuid": "7652264d-fc8f-4b71-8d30-7f07e1d41c57", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353656, "uuid": "25c1767c-14e5-4046-9658-bbba5933e62f", "value": "DY2048 PI Revised 3.14.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc33e456-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333808, "uuid": "b5056984-1955-4509-9e2f-759c57643854", "comment": "Malware payload (Heodo)", "value": "a1eac2c86b740de40305fb4685fce449", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333808, "uuid": "74246e89-4ff9-44a8-b79f-6a5f41997421", "comment": "Malware payload (Heodo)", "value": "33c6380063fc1c6c31fb9221af75d4c70c8e112f1e06a219b48b43092703d2cd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333808, "uuid": "1dd68c16-7149-49e2-9a45-897f6b61a531", "comment": "Malware payload (Heodo)", "value": "e4bfdf6b14b35b6d9c800776f8db0320559ad550", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333808, "uuid": "090b3913-4a5d-46ed-a712-c9c84a89818a", "comment": "Malware payload (Heodo)", "value": "0b89ebce0a2fb38900f94d829718fee32024b750e9cee0545578abd60bc548a7a9fda4d0a6abe67bce329f8e0c1725ef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333808, "uuid": "ebdf20a0-475b-42e7-b651-076eb5eefecf", "value": "T1E673F10EC232E15ECB2714BDD58B4FE7A40F79152AC4E57687C0FA4D27449AA638E31E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333808, "uuid": "c8672ce6-8356-4432-923d-de5e0ab5b50b", "value": "1536:y1RPiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMdVIit:y1RiCtzSmICpH7OZuvZGsMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333808, "uuid": "6c565da1-5447-42c6-b17c-a67a6a70b6b2", "value": 75911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333808, "uuid": "ea8ab48e-55be-474b-8697-78a510c2a78a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333808, "uuid": "2f087501-9ce2-43d7-bc95-f71d1807b6e8", "value": "List 1503.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a075ab29-a447-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1647338808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647338808, "uuid": "362775cb-3b8d-4bb6-8958-99c6473927e3", "comment": "Malware payload (GuLoader)", "value": "57cfb65a5de4c30565d49bc03e883868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647338808, "uuid": "9ac3a853-ab95-4f21-9247-20e6e9aebad8", "comment": "Malware payload (GuLoader)", "value": "33fb00e1f63b4bc37e62f3afb8ac5c769b6725fd3353e086729bf5f71f8695d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647338808, "uuid": "9a84b586-8783-4245-b0fa-435e49266f1e", "comment": "Malware payload (GuLoader)", "value": "79b4708a51ddc72b1a7c641a648f9cda6b3e1bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647338808, "uuid": "0cab6043-7e20-499b-a370-808ba97dfad2", "comment": "Malware payload (GuLoader)", "value": "15460b1cffb44026eee6a77b3c7ce664be009db6b364155899930c23c6ec57611f0804be09c2da4ff65fe4bbd2bb46b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647338808, "uuid": "2f68e827-2adf-4c13-810a-2f0f726b5b05", "value": "T10ED4E03C77F0A383D03196711BE2E2785AF19E30DED2C707E2F5252AA651EE42A5641F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647338808, "uuid": "9d88ee5f-51c1-4783-9485-0f50ec230600", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647338808, "uuid": "ecfb03d4-10d2-429e-ba03-40973ec8c682", "value": "12288:eb/4CC8efGh7+F+YhCVjQJVAwb03l+/8Z8QoIFUNDIk:ebQJUh7+lhCRQww6l+KGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647338808, "uuid": "6ceef23f-f2b1-41fb-b154-6f3cd8a7b7df", "value": 617672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647338808, "uuid": "2ec4379b-8f9c-4db5-b37f-9588e2ea6832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647338808, "uuid": "bce53b5f-ef56-4d4b-85ad-8e496c0933f7", "value": "F03526641.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370f7e38-a456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647345073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345073, "uuid": "685ebbbc-c58b-4c33-8afb-d71e50183957", "comment": "Malware payload", "value": "0685dbc9fa8ff6a63b43a44140dc7719", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345073, "uuid": "d2341169-87dd-4bd4-91f2-0106ee8624fe", "comment": "Malware payload", "value": "3468e627572b3c9c3dfaf41f3baa386618a4c8bb9e3c235592439eafc7b478f1", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345073, "uuid": "8756967c-3bc7-4eab-b440-37929534e740", "comment": "Malware payload", "value": "af1c9fb5a1980dff86edfc81c0636141e444c633", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345073, "uuid": "4de3361a-ce25-4e70-ac09-f4c0111e8142", "comment": "Malware payload", "value": "0add666d523c14eabe484f5ce9d4e26835f429609e9961b832578fd46ccbad7c27a8afb0f12e2e40c01791ace3aa0b18", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345073, "uuid": "29fd7863-0851-41f8-8ac7-64298c4eda60", "value": "T1A49114AD034FC9FCA627ACC894D55A83EFA58225463CE6D4DF20BEFA340057CE4E0848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345073, "uuid": "fd01179c-06c5-425c-b1e9-ec6da2875b4b", "value": "96:mG8H3B3xkM0E4wo1oVAPs+hJ3l3QEPPyFD5ng1rD:d8H3B3xkM0Fwo1I+VLlVnyFdwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345073, "uuid": "5c3e8e20-82bb-4d10-b1bf-65a79fd0a87a", "value": 4275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345073, "uuid": "9c9f9e46-9c97-4833-a94b-f3cba364c1d5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345073, "uuid": "c139a406-49bc-43b9-a662-f74f16430a7d", "value": "impresa_184.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa1e1d8-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "c853a45c-d7db-4de9-a31e-a6ff34571dda", "comment": "Malware payload (Heodo)", "value": "0e6204e9d94f57bb1300eb65b9799052", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "6c82cccf-0b8c-40bc-acee-4463225b8588", "comment": "Malware payload (Heodo)", "value": "3506931a50b4767615196c5adabe7e33fbbb49a01f6b477e96e296fada830714", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "11b64ae5-3e93-4569-bee5-53661ffa2724", "comment": "Malware payload (Heodo)", "value": "704362ce0224f40ed1d815d9232afef3c05f4745", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "8c5d71a2-2022-477e-b0b7-c79b930ad5a1", "comment": "Malware payload (Heodo)", "value": "86eb08afa55fb02a6ad9f42f91eaccc73fee602febec25024ace7fc6c32ea55435e5a001d38fe032dd2e2e3dd80dcaba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "220b7637-26de-4a2b-ad7d-4d75aea28af9", "value": "T15C256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "be6d9c9a-cf2f-443f-bcb2-a2087abd02fb", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "9885677b-d2a1-4866-8c5b-9449688a729d", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1hWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6TWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302836, "uuid": "66dc4d97-6e5b-4aa6-9d79-ba495aa60689", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302836, "uuid": "bfcc860d-e5fd-4bc1-8906-f4efb7770254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "c8bd9a03-b7bc-49d9-9f12-a5891b7f7291", "value": "emotet_exe_e5_3506931a50b4767615196c5adabe7e33fbbb49a01f6b477e96e296fada830714_2022-03-15__000706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b544b68b-a457-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647345715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345715, "uuid": "545e6271-1123-4167-8a6a-cc57a8e0f8a1", "comment": "Malware payload (RedLineStealer)", "value": "3812657e272bc8ee912f5e917e4ba26e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345715, "uuid": "ed8e4a95-37f9-40d9-9288-3a1c518391e4", "comment": "Malware payload (RedLineStealer)", "value": "3507442790a6d27bf658e39d8be816c615bafdb98bcf623a2a4a36440a29cc57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345715, "uuid": "a7e552bf-aa34-4991-99d8-2895abe16eca", "comment": "Malware payload (RedLineStealer)", "value": "0fd500ef50134f89b769c994d4423e60bea35f77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345715, "uuid": "26aa8871-30e9-472e-a823-6d59457546f3", "comment": "Malware payload (RedLineStealer)", "value": "3a16812aea6c8ae141da87cc87ae90de57cfb38ee8a2354151362a1fb97ac2bc57544b14f09d0adcc6e5c9e5ea1e3c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345715, "uuid": "9d62f871-a0fa-4f1a-9387-879b52c1bb38", "value": "T1F16533BA6A7E66D1C5CF2CF3263AC7B6F824FED8E3405485611C683AC6EA1C74354970", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345715, "uuid": "dd9e006b-a381-451f-8353-838344411600", "value": "9841b26ace9b2500e342c1cd0b9e4fe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345715, "uuid": "98a18b0d-3d2f-4954-b0a2-5ddfa3680385", "value": "24576:WicgjyebUCs5mjAyhUZn+n2hNSfDYrODi7tvgfkRtT5NSQvsHXEWh6/h1vmm:n1mC7Ays+2MDAP7t2kDT5NhaXEq6T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345715, "uuid": "488f87b6-3203-461c-a35d-ce00b003c776", "value": 1476096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345715, "uuid": "6dac463d-8002-495b-8b0d-3a6150b13438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345715, "uuid": "1683647e-6175-4d89-9574-e6be42abe933", "value": "3507442790a6d27bf658e39d8be816c615bafdb98bcf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8c82b7-a430-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647328758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328758, "uuid": "6ff49919-88db-4fb3-88c8-8bd7014e2185", "comment": "Malware payload", "value": "a7d5d8691c18c606a6c79e523492ec7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328758, "uuid": "b57b1f72-48cd-4474-8304-a2faf2eadd1e", "comment": "Malware payload", "value": "35a7cd2756a3d20b1087f557c9cca11290cd8133ca201ea5200acaf73072d87d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328758, "uuid": "ca027c87-04b5-499d-98ba-1eccbaac9772", "comment": "Malware payload", "value": "58176f0bf4ab35c8d306484ffd689fced9707ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328758, "uuid": "7d3d395c-9ef7-44a9-b7dc-dd8cd450b6bd", "comment": "Malware payload", "value": "6c176244ba35f331aa354c91649560c91c56cd734aef797f30b882c5bf1d836d3c48fcd88716bcf49409eed430440821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328758, "uuid": "4ff89719-a015-434d-ae3d-1d380784f5da", "value": "T1AEA47E43A9CCB576CB9B02372A94DA3811E82190D7484B02FBFD397ABFC6AD1354E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328758, "uuid": "8fd654e0-f261-4276-9f66-533429e5b9bd", "value": "4753904c40d638a1bc745c65b88291d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328758, "uuid": "35263c02-a951-4a21-b309-d460f815344b", "value": "6144:28VTVBVtVtVTVnVtVtVTVBVtVtVTVcVTVBVtVtVTVnVtVtVTVBVtVtVTVwVTVBV6:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647328758, "uuid": "8d24c42a-6f2b-4c63-b187-6a33a2f541a4", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647328758, "uuid": "5d6af3c0-fba9-4bac-a0a1-665d1e8bf49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328758, "uuid": "15952120-b64b-44b6-aa99-524351bf0596", "value": "35a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf31d12-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "40fb9668-a0f6-4d9b-b29d-26007545ba88", "comment": "Malware payload (Heodo)", "value": "faf7849fd0bbfbbaf04d536b8eeb779e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "74aa0e84-24b2-40a0-943f-9c51b0f9c292", "comment": "Malware payload (Heodo)", "value": "35da2a22d574443cb79433b5e7606126c5bdb34ac2300483618f3e54e952e3dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "d437fc66-fda8-4bfb-977e-042097048326", "comment": "Malware payload (Heodo)", "value": "fbfd3675d644ec56d29016df0427e3437334cb49", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "4dcc77ec-1ab8-46ff-9057-3229de2048cb", "comment": "Malware payload (Heodo)", "value": "53a7b6d13c5ca303ba889f2f14990a02a31162f5e0b3c7e42910b7589860d3b634b6577163885f87a123e48619627e3c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "0aa4220e-b1da-4cc2-8dd5-006225a0ada6", "value": "T170256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "2d37d2ee-64b8-47b2-8c46-de6c0297ac49", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "0cebc274-688c-499b-8313-27a90b92ece1", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKk0wLBeUNKsuG31Pt8H:3dlV0EnITuwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302696, "uuid": "95c42e54-2878-4a19-a9c5-c30dc862dda8", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302696, "uuid": "b936c157-2f26-4248-9cf3-9fe75a1e91a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "a60ad6e6-14b6-4340-a89e-a42d4fbc7009", "value": "emotet_exe_e4_35da2a22d574443cb79433b5e7606126c5bdb34ac2300483618f3e54e952e3dc_2022-03-15__000448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804e3529-a466-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352068, "uuid": "2dc64bad-18e4-4728-a6f1-58a4758762f4", "comment": "Malware payload", "value": "2d3f7155533c36095911caf68868604c", "object_relation": "md5", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352068, "uuid": "d7d963eb-b783-455c-b20e-3ec87f5f0068", "comment": "Malware payload", "value": "36295061f572ac504f8a5e9785640ae4117c761e880a88d34b8a0df464507cd3", "object_relation": "sha256", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352068, "uuid": "239e2d10-edef-4282-9ecb-ac08a214f34c", "comment": "Malware payload", "value": "d4213a48f67a7111d9a0cdea70b7a7a7794cec89", "object_relation": "sha1", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352068, "uuid": "a90cdb43-2880-451f-9a2b-6022fdc1bef2", "comment": "Malware payload", "value": "24adebaa11284b3f0ccbc6f6a34c93d5203f2615ef371fbd07f18b710a2e7386fbd56bd864aa0fd44d408534c5c3af65", "object_relation": "sha3-384", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352068, "uuid": "0e4f181c-819b-4a9a-a761-872040ca995d", "value": "T1ED429D69C99BA823D67372B9557578C1F08C0EC39140E7CD340DBBCA66463E4AB53E36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352068, "uuid": "df853385-b421-41f9-9025-0e8d53a3e68d", "value": "192:Q86oNm9aOJ2wc3rMKkTPukcx118H111M05AgPekKiD2h0vamaaMAmU:Q86tUIhTuHgH111/eVuhvamDHmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352068, "uuid": "d904ee2e-f0f0-4ba4-b087-4921bb35ee5c", "value": 12301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352068, "uuid": "91cc16a3-1b77-4add-a5c2-8cc359cd7d5a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352068, "uuid": "097bc766-e124-4d79-b480-a7f9bda20da8", "value": "1409GrandStrategy.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4cd405-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333786, "uuid": "a4a20c93-8f1b-4145-b30a-bc21fe6388bb", "comment": "Malware payload (Heodo)", "value": "e3cfcdf1275a6628fc5af8bf888a81df", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333786, "uuid": "47f20acc-38c4-4b06-a5d4-1a02c98aacd0", "comment": "Malware payload (Heodo)", "value": "3636fa96e464bb4cc8453e454b3141143e767cbfbe3957637b1e40c548a0508f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333786, "uuid": "4d3449bd-ae0f-4e3d-b331-c2cd729a3e25", "comment": "Malware payload (Heodo)", "value": "cece3020136ef64e1e2a0061c8a3f7eba499e57d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333786, "uuid": "d9534a1f-581e-42a4-bb80-804ccbb64d30", "comment": "Malware payload (Heodo)", "value": "c5547f7a1254b02b7eba1492f703f2cef849f26a2847be373b7a62b0c7bead2623fca9f88f7636474e103aebd1785c8d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333786, "uuid": "3915cc8d-31af-47b2-b9ad-97383bc63f16", "value": "T10A33D00F9A22B5ACC3136C3CCA8C55F9650E5592A0C9F72B08857B9C7B1B1E7179F282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333786, "uuid": "4f59c9d8-d1ab-47ec-988b-ba096b994282", "value": "1536:gkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:RcEe2Kd3zdtdEwo/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333786, "uuid": "101cc270-9df1-479a-98d8-d58139320a8a", "value": 50643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333786, "uuid": "a7f59e90-4472-481a-b0c0-96a7083b1935", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333786, "uuid": "c42e4922-d506-494c-9765-a4bd26327f43", "value": "imedpub.com_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8007b7-a474-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647358268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358268, "uuid": "e50db866-c381-484b-9ef5-2e44c7ae3b74", "comment": "Malware payload (Formbook)", "value": "e0956b064218d9bd7720072b4527f4d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358268, "uuid": "49a2e8a7-8ec5-4142-b1fc-506445c7512d", "comment": "Malware payload (Formbook)", "value": "3651902b70a4e17aefaf3fb710c2c1fe9317d5a5b073578d8849a18862b0ff78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358268, "uuid": "9d9087c5-5f7c-45fa-b3a8-06c0b9b14644", "comment": "Malware payload (Formbook)", "value": "9164f9f767ccdd2f7084f340575cf68110329bfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358268, "uuid": "688c426e-699f-43c8-a7e2-97edb9fea039", "comment": "Malware payload (Formbook)", "value": "57e6c1b21e8b9fa2de141a90cead75e01486b6747f763f38c30ad33cf3d8ee96bae6a5ad19996c7146322cd6438e8b60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358268, "uuid": "cdd93417-0869-433a-9719-436c8886a1bb", "value": "T1E005124573E98F12D07FCBF494312A0853B676AA5820D64C5DDA38DB3AF6F108A60B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358268, "uuid": "5c1635a2-1617-4885-84ea-ee92bc21dabe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358268, "uuid": "09ddf6c6-aefb-459b-b65a-45a775cfae60", "value": "24576:AIkwOE1S5TVLSOtb4Twy4RzEwRd9VSvELRr2DC:6fE1S3luTwvRzf9VSQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647358268, "uuid": "e91787c8-752b-4517-8d22-8171238b978f", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647358268, "uuid": "77392ed7-8c81-4a9b-86bd-b7ce3c1a3378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358268, "uuid": "8bfb207c-4fde-4f3c-99e7-5c93ed609b1e", "value": "e0956b064218d9bd7720072b4527f4d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02066cb4-a4a8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647380203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380203, "uuid": "1f7c4940-a99a-43a4-890e-bf0fed15a52e", "comment": "Malware payload", "value": "5d8db2a91bffcb0226475ce04939a3eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380203, "uuid": "e22d3004-2997-49f0-b256-f8084a947f11", "comment": "Malware payload", "value": "3667296d7701c0970459bb7b81e9baf22e0e8137f6a18d27e3b2cb3f897b61bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380203, "uuid": "87f76999-68a2-4d6d-9c30-a998cec064ba", "comment": "Malware payload", "value": "6480043915fa0ffd782b76b4fc38e1dbbbd9e9c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380203, "uuid": "a1e697c5-9c87-43ef-b9f4-4680813ce091", "comment": "Malware payload", "value": "b87f517ff518b33c9562b66b1ab5124c7e9a92af31742d769a1de5b71a29af75ee210a5bc411216c35b2b6810d2cb888", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380203, "uuid": "06f4c696-0838-453d-92f8-cea9b3982b81", "value": "T130E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380203, "uuid": "45c6ea94-f957-4318-a4d7-80bd3c880e42", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380203, "uuid": "d280124c-bf5a-47a2-810f-17cfa9de7f8d", "value": "12288:E94YBCR2xP7guDo463OP4e3siSOZjb2woE+MhJT:2kRAguDogPTddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647380203, "uuid": "0f48bb6e-d40f-4ad3-9165-7284aed3e2b3", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647380203, "uuid": "4bffa5b8-449d-4896-8e57-c21b3d370c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380203, "uuid": "761538c1-8f2e-4cf7-95e8-fdd455447d49", "value": "5d8db2a91bffcb0226475ce04939a3eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c627abef-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1647354762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354762, "uuid": "ee0d069b-2c5c-4b63-97fb-6b64ccb221a6", "comment": "Malware payload (CryptBot)", "value": "2d98807ecf44a8e2135e5f5af32cdf01", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354762, "uuid": "78a30363-bdde-4cb9-9a26-3ce36f5e6846", "comment": "Malware payload (CryptBot)", "value": "366ce101fd20bf43ad38bd45eddc210349c25672a8921ae56a2dd629dd2540ab", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354762, "uuid": "ff97e973-96ff-46f3-b31a-3e833e919749", "comment": "Malware payload (CryptBot)", "value": "3af6d5acab1692e8ec5c8f14810a356cfa0da6e0", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354762, "uuid": "becddd5f-ff43-4b26-834b-67b76702c8bc", "comment": "Malware payload (CryptBot)", "value": "9630f9d1934d338675d1483172edd2a01337d97491667284d6541e6abf74b4493575ad76be30e601fdd89acf7de8413c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354762, "uuid": "e9b4bac4-4c9c-40ff-b9e4-e0d92731d1f2", "value": "T1DDD53337F75134DCE8EB53FCE62920E76B1726983090A3967C0B6A199DC09E40E4BDD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354762, "uuid": "03000580-d950-4809-9ee5-a68905b2afd9", "value": "6985c05c81106254b2fb2149ec38edcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354762, "uuid": "b3b44e84-0d29-4aa2-ad7f-d901833bcb37", "value": "49152:TvJlEyyhA4NHiCaMwJgp5AMEyH/QvgRzdTGbxQ0qju/IAxmJQTx08ZMBH9ogJxn7:TJlEpb8rMwJPMpQvOYbGfju/IAxmJSxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354762, "uuid": "c1ef18bc-7657-4399-9d30-84e9a2470726", "value": 3005440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354762, "uuid": "9d6407bf-3165-4129-be62-2e60e132955a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354762, "uuid": "4dbf8bcf-d9b8-40be-8d5c-29eae7e2a41b", "value": "2d98807ecf44a8e2135e5f5af32cdf01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c806ae0-a46d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647354961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354961, "uuid": "1e9bab0d-11c0-4d70-901c-2ba95c15c012", "comment": "Malware payload (Heodo)", "value": "bebe375736c60be9ec3c19c5f499f77c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354961, "uuid": "d37405f9-ae38-4517-bdd2-0b07e3a89a48", "comment": "Malware payload (Heodo)", "value": "36cd9bf3583502fa7dc2e6349f20557dc8fab8c2cc5e6de2b87459f4d0173d22", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354961, "uuid": "84a469e5-edbb-4c61-b448-c6edd3dd9eee", "comment": "Malware payload (Heodo)", "value": "e23c6616f269cf0eeb647db5367136e61234f15e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354961, "uuid": "c9557468-43b7-478f-84cf-d6873e5d9173", "comment": "Malware payload (Heodo)", "value": "2be9f57eb7cc9814bc30fc2cfbae39b277a1f2bb6ceb44ee1ece9226ff0fe101a3aeaabef97bfb6415d72a491edabe42", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354961, "uuid": "df60a54c-7bed-4a84-a3f0-dea7f76ae6a6", "value": "T1E2257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354961, "uuid": "9ed11227-8ea3-4b50-a6d4-0fadb2495d73", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354961, "uuid": "b42ca11a-ef5e-40bc-a0af-4310e73c2e5e", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYyVP6FuR6shQLj88F+Krf6:v6oycln8cACihP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354961, "uuid": "b5ee08bd-458e-4049-b6b1-4a3cf46548f7", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354961, "uuid": "7aa74c37-1371-4c1a-9453-7469f5e6f757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354961, "uuid": "541d6175-0729-42a2-a9b5-c2afd26eaa1d", "value": "2uSqol6OQEEkFpndb6uF6Mdue.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0f9fd2-a487-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647366396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366396, "uuid": "b1ed7ec3-33ff-42fe-83db-602c28b49a4c", "comment": "Malware payload (RedLineStealer)", "value": "b407b1ff9e762d197a9912fe8b732ca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366396, "uuid": "5d6ac302-446e-41e7-b905-78662474459f", "comment": "Malware payload (RedLineStealer)", "value": "36ece34f2cfe7d906a9b1f6cf1900abc9f1a10b0b5d22ad1c3c232d5d03d540d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366396, "uuid": "e0416e3e-c7db-4997-b3b6-aa87c41c9139", "comment": "Malware payload (RedLineStealer)", "value": "c2edefb9f8948828a11e0b1870aaf1648652f6ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366396, "uuid": "ef27636a-28c8-48d8-beb7-21adbeb0c39f", "comment": "Malware payload (RedLineStealer)", "value": "39c79db5e13fa78822071bda23ed81772221d3e2dfa32161cb6895e32040efbb778ef6c2401d397d90f2f3f8371087b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366396, "uuid": "43dad6a7-72c0-4fc3-9811-92918fe5e0e1", "value": "T18E763373897E6C32C2E64474EA355D2487C5D57AE334B352B0428889EED2E8DF63F249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366396, "uuid": "935b9ee0-13a4-4d8f-bab8-1145f4892d12", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366396, "uuid": "79b55512-5d4d-4886-acf9-c55ff8916634", "value": "196608:Ji7kC1poDKxgtoOcQnGBaQKyzygo5jQ9+5Z9HxAALI4lqr+FEYZ:JiAC1poOxgmOB2a7FjM+b9tLnqr+FLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366396, "uuid": "4a85296e-c5c1-44cc-a3b0-88559d5296b9", "value": 7647890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366396, "uuid": "dbd30c97-1446-44cf-b251-9f041429599b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366396, "uuid": "ba5b5073-8908-4068-8e23-0d57b9cba074", "value": "b407b1ff9e762d197a9912fe8b732ca9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ce6bfb-a460-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349291, "uuid": "8ac6549e-68d0-4a8c-8e50-f854653a1556", "comment": "Malware payload (Heodo)", "value": "6c89e7033961816048db7e80d272cf13", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349291, "uuid": "b07172bb-edff-436f-b864-a16eaf8edff9", "comment": "Malware payload (Heodo)", "value": "3728ddc825f2e5d80ae474467b41306677094f1f16d93d5732ade4c2c87c014b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349291, "uuid": "8f34951f-5060-46e2-b3a3-cb81df77f942", "comment": "Malware payload (Heodo)", "value": "230eb89903f701808ba2f636b12693a6bcc65314", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349291, "uuid": "43e812b3-af04-4ea4-ad7d-82d0ac3bc3bb", "comment": "Malware payload (Heodo)", "value": "9faa1eb8db054cedc062bd9778116dc92109682de23de2d5206d889ecd7fc79246a002c51bf8bee1c562c180eece1186", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349291, "uuid": "5422d775-54c5-40f9-aaf4-222aa9e1fe3f", "value": "T16933D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349291, "uuid": "7dc15131-dec7-48ff-a205-566b9d0899f6", "value": "1536:kAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:NcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349291, "uuid": "647ec66b-0a32-4673-9357-e0b11ace8623", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349291, "uuid": "3ba01104-8a2a-4666-a207-a7e8e0871b08", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349291, "uuid": "96cfe1aa-c435-404c-94d4-e9c4e9de8605", "value": "Fakturierung 2022.15.03_1325.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01762ace-a456-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647344984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344984, "uuid": "efb6af8c-7e28-4995-ab3e-51861e92e181", "comment": "Malware payload (Gozi)", "value": "8a3d8b5dd1f2022eaf5a9b7232aaab1e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344984, "uuid": "b241d5fc-09d3-4ef4-b6ee-3dac204557b9", "comment": "Malware payload (Gozi)", "value": "388022f82cf14f03e13aac05209d02e26685ae97c45077b64bdbab3e7fa44f17", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344984, "uuid": "2b3b6def-754a-49a4-a4c2-1acceed36c52", "comment": "Malware payload (Gozi)", "value": "9107b239f7365d6e30416f28bcd8edbd5d7ce632", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344984, "uuid": "e0547b6c-af07-4e42-8fdb-5bdc5159a91a", "comment": "Malware payload (Gozi)", "value": "e9602e5c0daaf7d628830e19f3571a5744fae8a4a43fe69d2b796a3d36136cba2632d906219d93151dc76628a9d77cf6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344984, "uuid": "3cc68acc-e478-4928-83c9-348a0c2d7d73", "value": "T1C1459465ADA4FF84F43E0C38C62173EAD22E1E6D0615912AD386784079B53D47CFAF4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344984, "uuid": "58cd6169-126b-43a1-9b45-13b31fda9974", "value": "4c22b18d5c8a30144996b95335a2df1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344984, "uuid": "da469b0c-4474-49ed-ad8b-850a549d6ecd", "value": "24576:8IsLKFY0naHqkmm2GBT2XU6QAztP8zUX+:8IsLD0aHq82M2XUba2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344984, "uuid": "212cf9d4-125a-436b-b9e2-9e3e613e195e", "value": 1270272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344984, "uuid": "fd6c05c8-fc3e-4fb2-bb3d-f0b519677b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344984, "uuid": "b88fc96c-c64c-4152-8e7b-9100f7d3dd01", "value": "status.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39a424d-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1647353094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353094, "uuid": "eb7c7179-d237-4303-ba52-da951ce6a8aa", "comment": "Malware payload (DanaBot)", "value": "4b32ee1a4f7cb594ea648841fb133356", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353094, "uuid": "f5ca314b-fe0e-4d72-bf1c-4f5cf0993995", "comment": "Malware payload (DanaBot)", "value": "38f155dd21b022cf76e2442ebe16f4086369204f6c1b486faea0f1feaffd5806", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353094, "uuid": "56ea2c7a-f440-4af7-ad77-773674293891", "comment": "Malware payload (DanaBot)", "value": "c82fa76e76da10a7efbc11628ceebf506ee0a871", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353094, "uuid": "c1c78753-70ba-49ec-ad30-597bfa97c596", "comment": "Malware payload (DanaBot)", "value": "745c9344a36d780881961024360427cfdbab90d0edd00fe8ea24e195e1734fadf39a032b0b8a00f5be711171cb789ea8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353094, "uuid": "e7d8162f-4198-48d5-ba4b-1da6c370aa1e", "value": "T177352351B991E133D88B36305B14C0B02F77F8B262B59B473795136E0E30796B9AA39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353094, "uuid": "eb3448e9-1fd2-45c6-b4ed-689c18ae6c25", "value": "c4715cf6be93a0d532bbd0073142431e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353094, "uuid": "bff875d3-058f-4adc-96dc-9f51a7c08a44", "value": "24576:kQqL3qdmYsQAb7FOIisU7bbdIHEqa3YgTqa8+Vn2+s:ZqL3ksQq7AIT6yk/ogTdV2+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353094, "uuid": "c4181da0-f4e4-4285-9e4b-bd5f17273e58", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353094, "uuid": "538aa903-1292-4471-96b9-98ae959cdd3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353094, "uuid": "65e70d02-b3ac-4e3d-94a7-10c96d112b2a", "value": "4b32ee1a4f7cb594ea648841fb133356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779a4874-a488-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackShades)", "timestamp": 1647366657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366657, "uuid": "de10b31d-a1b1-449a-9289-5513635fd751", "comment": "Malware payload (BlackShades)", "value": "2ace87034adcea65a2f266aaad73f734", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366657, "uuid": "9033d1cf-d6db-453b-ab64-d3feca8fe314", "comment": "Malware payload (BlackShades)", "value": "39586d1d2708b26ebcb188599b9564f8657b879f32c27c1a156288c0399fa83e", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366657, "uuid": "68785f01-ac5a-4823-91d1-3d0d29eeb5bc", "comment": "Malware payload (BlackShades)", "value": "6b58441ecb9b5ed42a03f9e16399ffc0600a7352", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366657, "uuid": "21052842-12e7-4258-884b-ede98d91aea2", "comment": "Malware payload (BlackShades)", "value": "451144ee4a6050b77b765990a230113515db6ac8436b13f7405a7ebb71040accda9c5a422b9883e020e4f20e3ec2fafd", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366657, "uuid": "0df88e0e-13ea-4e3b-81ee-ea64f851dedb", "value": "T1B324AE33B3D40A85E9EEDB753BA9C6F9622375087F23618A2108677D7C15E204C19B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366657, "uuid": "ff9ef0d7-f0d6-485a-9c06-0deb9da56a00", "value": "3e8ae3bc85823ef9afa9731fe8e9fda0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366657, "uuid": "969e053f-0c59-47f7-8206-d2a3ea1dd31c", "value": "3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1:Xo/BHng5HaVG4G/1z+QVMbg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366657, "uuid": "cb9e053f-3fe1-49a0-81ae-cb69326a8065", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366657, "uuid": "838f088b-c89b-451e-be50-ab47fe56a28a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366657, "uuid": "e1858c1a-f6c1-40a8-93e0-6d5d64dc17af", "value": "3958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce936a06-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647349193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349193, "uuid": "5dd64f4c-bdb5-44c0-9d3d-03c334f8d849", "comment": "Malware payload (Formbook)", "value": "04ae989498b84c026d4f3d4e45d00cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349193, "uuid": "9608bb8a-afc5-4ff9-95bb-c4c297f03ab5", "comment": "Malware payload (Formbook)", "value": "39ce700e582c22bf87f67241aa5537b74991a30d016878bdd6c2dfd6dc114f9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349193, "uuid": "e39750ae-e0a5-4389-8974-19f8e0700b44", "comment": "Malware payload (Formbook)", "value": "45c6792e4c34c5adc08967077bb29c76ca44e601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349193, "uuid": "71d6d35e-eef4-4ea7-bb21-1c219a14d9e4", "comment": "Malware payload (Formbook)", "value": "e64028abd92b5db12ca7ad6113d2371bca272fe5c3865897d765483a91be6fc6b4ae9385853d5cc3bf530c3731871b70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349193, "uuid": "c771071a-ad60-4628-a5b2-b37eb44cb10d", "value": "T1C9E4B031E791857BC1235A754D1BD398A41DFD20BD18AC8B3FD8AE0C7F7A691382A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349193, "uuid": "bf221505-10f6-4acb-884b-94795c039172", "value": "f411b7c64ae0f16bd14a751e9077781d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349193, "uuid": "9ec5b65c-6a9a-4445-9851-9445c9bbb1d4", "value": "12288:/5VHItCEqofo3cOS0aYcdexwGN94Y9/rIPR4KeBIQCN1+ZAzl/YRIlRfkK:zopqofo3cOSpYcdexwGN39TIPR4KeByf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349193, "uuid": "f3c69cac-0e61-4850-9600-8d5783f7351e", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349193, "uuid": "6a062b4a-306b-4af2-8682-13dbf9910964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349193, "uuid": "77c388f6-5324-494b-9570-31566737de9a", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5202fa15-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647348984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348984, "uuid": "d93219cf-e293-4837-9889-1dd3e706747f", "comment": "Malware payload (Heodo)", "value": "86bdfd3a79303945d97a204f38031b4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348984, "uuid": "af2b454e-bc3d-4b7e-97dc-6367734cc823", "comment": "Malware payload (Heodo)", "value": "39f74f595fbe255ae94054f7cb62ffbdb49dcd0d38c3ecdfbde4f067fc91057f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348984, "uuid": "f6f1b3c6-9e21-44cf-8d97-2445f13da4ac", "comment": "Malware payload (Heodo)", "value": "b8435336d70bd9e08e84656312781236795529a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348984, "uuid": "c450a65b-ad99-4095-aefe-af3d8915bac9", "comment": "Malware payload (Heodo)", "value": "6e29c2e65b67b4c37eabeb21e7d47638393a93d25da2621bedd0c7ee7ca1396ede90cbb0a7e9a5ecfb5dcd596bd99aae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348984, "uuid": "50b683d5-e3bf-4e65-b417-2cbd3594f952", "value": "T1A2257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348984, "uuid": "dd6caf5a-6daf-4026-9f73-77ef7dfc8891", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348984, "uuid": "662b23e6-5792-4a35-9d8e-123d10939023", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlaOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Cl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647348984, "uuid": "48dc0f5d-8b2a-4164-beb9-10f9f9b8069d", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647348984, "uuid": "41f64c44-0ca8-4cff-bfa9-00684780c10a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348984, "uuid": "ee84c512-9ab3-4da4-83b4-b576d2e7c013", "value": "86bdfd3a79303945d97a204f38031b4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dd7697-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647349128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349128, "uuid": "d13c1f9c-a1aa-46c1-a08e-0f0a1c2d64db", "comment": "Malware payload (Loki)", "value": "e947031b74dec5aad4b365afbce62b9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349128, "uuid": "3bdc8d39-6670-4130-9204-06ae6deb33ad", "comment": "Malware payload (Loki)", "value": "3a220388058c33f169fdb506d0d78ef6ab97858c34f43c86f861763211066446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349128, "uuid": "6f81837d-5870-4eb4-bffb-7f1b0e7c5dd6", "comment": "Malware payload (Loki)", "value": "dba1985ea2854f30a2bdf75e54fee0fd8d99d231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349128, "uuid": "619627eb-364b-40fa-b9b7-2dadcf7bb9f2", "comment": "Malware payload (Loki)", "value": "d33e9e7efa1ed83db3e79e58231f7c0f2b21eac2f6b5ee05687dcc1724b6ecac36529bb4f9fa9cdbbb09eaa96b9413b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349128, "uuid": "08fc26aa-9c9a-4637-9f9a-044a88880b30", "value": "T187642349C9C13427EB2A1632227F71B5EBBF90D425B2AB3357909ED78C725178C0E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349128, "uuid": "761ecfa0-b421-4c6a-ba84-99e96911e827", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349128, "uuid": "9fa52bde-0843-4110-b216-23da9de2b6f1", "value": "6144:rGiiyxPWWcRH6Y9Cz7ls+0/q5IFjKsXV9qNSiPaxtXJyqtwjFWJwqYf+rAF:2mPWWc947H05j1VXtwjFKwqYf+rAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349128, "uuid": "da3900e3-440c-4591-af69-41b691f4b623", "value": 337191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349128, "uuid": "89665917-ba99-471d-aea1-61cdf4ebeb17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349128, "uuid": "b631e190-f188-465e-b5de-1ae251426b17", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f942378-a466-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647352040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352040, "uuid": "641cd851-f787-457a-99b1-8075ae67b4f5", "comment": "Malware payload (Heodo)", "value": "e8a88a9800812cf8e75370ae2c01dd99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352040, "uuid": "9c9d4fd0-3e07-44cc-9eb6-1efe8c97ffaa", "comment": "Malware payload (Heodo)", "value": "3a2fe7dc02ab1d1602303cef33dd8cb0894b4bc250fad1e63e32c7072ae115c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352040, "uuid": "7663e14f-e247-4702-ad55-48cab25c6fe5", "comment": "Malware payload (Heodo)", "value": "12b37b4485e70071f6957090a0b64da330565cee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352040, "uuid": "178e9543-c7f6-4718-9f84-fb7f1b5afe25", "comment": "Malware payload (Heodo)", "value": "b98791528fba29455f4363ad1f53d1fbfed029116e06f60fdb22d5649401468f9c7928e8bdadb3fa67a71e8c25732870", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352040, "uuid": "4797bc08-7c89-4936-a66a-15152117cdfc", "value": "T118257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352040, "uuid": "02350818-8d1f-4066-840d-511310732755", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352040, "uuid": "ab7c309a-d3a9-4880-a31e-4ad6052a0f2d", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYAVP6FuR6shQLj88F+Krf6:v6oycln8cACiHP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352040, "uuid": "fef09e60-9d3b-4b7b-8e06-4a686720c3c9", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352040, "uuid": "00e55e38-a5dc-4136-bef4-d4060597ffcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352040, "uuid": "73d6c5ce-1a6e-482d-96ce-c46277a1907e", "value": "e8a88a9800812cf8e75370ae2c01dd99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c668ebca-a41d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647320833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320833, "uuid": "a62ce55b-9d10-448a-a1ad-96af31cbc287", "comment": "Malware payload", "value": "334f52b4ce4bdb774cb0e0c06c73bcb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320833, "uuid": "d1ff7065-00f8-4bbe-88f6-27b913f68773", "comment": "Malware payload", "value": "3a9c24a764a95e749a2cfb69fbd46d16faff9532e67dc4f25361f7a918bb82a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320833, "uuid": "27b87313-6d30-40b8-b3ce-2d9f579cbd81", "comment": "Malware payload", "value": "657f7713236707806f2db58f03250a7151eebfb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320833, "uuid": "462e7b33-618c-4f74-9988-7a3c971b450d", "comment": "Malware payload", "value": "e74883e241e405787dd46d08637d24364ea43480583eb02786d01ebf7feab9aede569d03e1313e4be17467530cd9bc4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320833, "uuid": "436af621-738a-4e73-bb4e-4ebf21217ae5", "value": "T12DA4E1317A86C032E1D202354EF5CBA2193BBE666B63A4C7BB94375D6E702D2D935307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320833, "uuid": "7e0530d3-6a20-40f1-960a-2b56279246f5", "value": "2b2e5872569655576ccc5e3606c23ed0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320833, "uuid": "d519948b-5c61-4406-8ff1-14d75d4bad92", "value": "6144:kzH4T+SdR053O50SbbUS1eOfhHcMPdPFDtNsHo4PzcGvi3qlt9sHZ:YO50Sbe+h8aFFsHo47cGvi6PS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320833, "uuid": "c88d51f1-0e15-4c89-846e-5ca05886ff36", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320833, "uuid": "0cce9378-5d29-4d2c-be51-ad33d81505e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320833, "uuid": "7a586306-fc07-49ec-a263-6ebb3f24d2cf", "value": "3a9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5860267b-a4a0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647376912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376912, "uuid": "a78e974f-24c1-446c-9408-aeeaae1a0cf5", "comment": "Malware payload", "value": "27954654a0a8f754f7096e4bed2d7751", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376912, "uuid": "cac5ef68-9d01-4866-8241-5e86b1d28867", "comment": "Malware payload", "value": "3ae76e5cdbef9a547653af5aaeae37fddf208499974957d3057ef32c301e8fdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376912, "uuid": "6d23e6a6-5618-426a-bbd3-053fa0b775ac", "comment": "Malware payload", "value": "8110987cf0a0842e43c3a2aaa99eefd4c0cab5bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376912, "uuid": "8bcaf3da-a45c-4671-9ff3-5ec54d004268", "comment": "Malware payload", "value": "ee94feded44e3f54d180a9f07c328f49a770c114cbe11441b9cce0050aa55308c064a8ea912ae907d9e4ac284c492d2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376912, "uuid": "4db3b748-30bc-4b06-91d4-c6b054e48dfe", "value": "T10BE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376912, "uuid": "cab289eb-dc8e-4728-83f2-af623cf2e7cf", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376912, "uuid": "dc616b7a-900a-4376-9bb3-60140bf30b25", "value": "12288:E94YBCR2xP7guDo463OP4ersiSOZjb2woE+MhJT:2kRAguDogP/ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647376912, "uuid": "51a526a8-57cc-4809-b950-cf5ae32af060", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647376912, "uuid": "31751cad-f6f0-4b95-acbd-5a75d4be73b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376912, "uuid": "c54af459-71ed-471e-992c-0ea37a0587f6", "value": "27954654a0a8f754f7096e4bed2d7751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ba1283-a4b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647387244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387244, "uuid": "68ff7bf6-3b62-4a30-b475-ff71ed5fcf92", "comment": "Malware payload", "value": "518c9037d68b01a4015567bb2369f7b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387244, "uuid": "34d0ede3-33ea-44eb-b6d1-21c38db4a8ae", "comment": "Malware payload", "value": "3b2d618e3b0e1c567e74ae298adeec4b589de973f4f85fbb2d787a3b4bdf2169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387244, "uuid": "bdd2361d-da76-433e-a966-351578c25551", "comment": "Malware payload", "value": "8365b012d5446cc570491d0ba9929f45ae344f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387244, "uuid": "9eaeb2c0-b550-4709-9e6e-bcf6ec1d337c", "comment": "Malware payload", "value": "1dc4bc2a155f038579f496beba0d58151ae46dda670213ee283c89ac640c778ecbe6f94d65930a999949dbf85f8bc4f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387244, "uuid": "64e4f171-b7a5-4f3d-800c-e4a8ac402f81", "value": "T11D85CF02FB8289B3F59325399067A77F4D3AAA104334DAD3CBD01D668D712D1663F3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387244, "uuid": "ad550f65-ce87-4217-b1fd-f5ae0d811f03", "value": "9837e50abe66567da47a183b5e961377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387244, "uuid": "28bee548-439e-46ec-8d1e-374000a5831b", "value": "24576:E+KpP7IzkQhB69WTjeYeJ601wCFE8Ls/XkyugOF4+FEhnsr0xT7pL4JhGtPm5B6t:MiXUtK8Qp2S4a7p8qtPaB6UF0Z+zXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647387244, "uuid": "d9c90a98-be73-4041-9fbc-848d817a9c08", "value": 1870848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647387244, "uuid": "43f40824-58e9-4657-9b65-0212e4577f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387244, "uuid": "a7837681-b600-42dd-a421-1259d4f7707c", "value": "decipher_unit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fcf099-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647352933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352933, "uuid": "95bf4814-c305-4d66-b9a2-e0fe16dfdc13", "comment": "Malware payload (Formbook)", "value": "15f474100d4bc92fdfc943cfd3586c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352933, "uuid": "8b6963de-b5f2-4889-a89f-d7e948d5f5c2", "comment": "Malware payload (Formbook)", "value": "3c1b8983e58217bb7dee68a2d5ed361231c16192c4ad81ccbee94f7e11dc0b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352933, "uuid": "4e9d4e5d-185c-4a58-9819-0c4a066589e4", "comment": "Malware payload (Formbook)", "value": "624ec9516c77950f28e4438267ff7f0ef5ccd712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352933, "uuid": "b710c1dd-946b-4ee0-b34a-75748951c27d", "comment": "Malware payload (Formbook)", "value": "ea8f2d141e27ee9278415c11eddcc7c031d52947502a8fdf9765fa7573ebe9ec61a65ea797436572eef784797809f7ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352933, "uuid": "af9aefda-9d6b-43b9-9c5f-b30d93875ac6", "value": "T1AEF39F32D642D031E2A242F5F26D1B7B893E0D353359A1A6E3E119E16EA05E6F43D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352933, "uuid": "8d37bc63-5fc7-432e-9db4-c46c5aac7a81", "value": "3072:5IBpEd29AV07wJNMVI6m3IwMfTQubC8fPMphzmrvew:5IwTVzMVFQ/MfTQ8vfPMpUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352933, "uuid": "699cb3b3-80f8-4136-a8a3-33e261a6b7a5", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352933, "uuid": "dfee5840-45e9-4698-b4dc-a79dbac4ef92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352933, "uuid": "9ced29b0-704a-4742-b397-73b841633c03", "value": "15f474100d4bc92fdfc943cfd3586c9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0b1614-a432-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647329539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329539, "uuid": "4e4da506-1780-4192-a245-f3c3dd7e3420", "comment": "Malware payload (Heodo)", "value": "1f69f05285d69aef8c6966f35887943f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329539, "uuid": "d8ea8409-0ba9-4671-b3b5-080c1f0c4f43", "comment": "Malware payload (Heodo)", "value": "3ca81432e350f27f94e637557b6bdd445ef970dbd7133b6906913e48193de8e0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329539, "uuid": "57de5f72-bd04-4f5a-8756-1d7f876f4de1", "comment": "Malware payload (Heodo)", "value": "ba750a0b550a8713eed2fbc16d8c39cbab8d390d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329539, "uuid": "f76afbd8-944a-4dc1-9279-10be7c939a5a", "comment": "Malware payload (Heodo)", "value": "a850c20b7eefbc177b35af25147ff59591911e4f5d97babbdd2921e351277b0a506ab002408481bdbc2b3b0db13aaf95", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329539, "uuid": "f7c23147-1f23-409e-bccf-541789a3f722", "value": "T1B073F11EC532E19ECA2714BDD1CF4FE7A04F79142AC1E4BA9380ED4D2B49E4A674E21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329539, "uuid": "9d780a3a-2b07-49b6-b0b2-1a1ef9b5b9fc", "value": "1536:gheXF/Sto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMbV6Jr:ghUItzSmICpH7OZuvZGsMwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329539, "uuid": "23628f4f-6d61-40ff-b618-7be0f36d1024", "value": 75275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329539, "uuid": "53dd0adc-b526-4b76-a67a-bba2cf047863", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329539, "uuid": "3430f1f2-dd98-42b2-826e-b6e636be988a", "value": "Daten_14032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e9a56a-a493-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647371484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371484, "uuid": "9f97b3e7-ced5-4f4b-9d3d-a069e1dc786c", "comment": "Malware payload (Smoke Loader)", "value": "8479a3f87dacf55ab2f504166a5cc18f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371484, "uuid": "fe2d7667-76cd-4459-a528-641196852183", "comment": "Malware payload (Smoke Loader)", "value": "3ca88b477845eb0288168247e832b9c840222454e8c40bf42f194caa337cde4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371484, "uuid": "439e4599-4763-48ea-a1b3-a19c2280ba06", "comment": "Malware payload (Smoke Loader)", "value": "3edfd917c661eaf0b21da85a0133de9a215c9dbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371484, "uuid": "4fb3a761-3adf-445a-8737-a52e071d63d7", "comment": "Malware payload (Smoke Loader)", "value": "20dc47e984aec0795be60340f4cd9984a854775c01e6217d5946ae1a8f696e941d5769af408555fe298dacef33c63b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371484, "uuid": "d0837795-5d1c-42cf-9a14-d7cdbddf978b", "value": "T1A534C0217760C873C0A254316825D2B6AB3F7A3257B7C8477B98173D1F713E2AA7631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371484, "uuid": "5119a56c-965c-4ea1-8356-e2f84c6efe39", "value": "1c4d1309fbe1ab2e3ba471bcd2b90944", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371484, "uuid": "7c639035-adc4-47db-a19b-1f2d99b90541", "value": "1536:ZQHpg2y/i5RRugYGqJSbr1kAGmSSZjR2R0myKUsqf8rsCrAHZd9B50QlDrh662B:C6yWg4rQZd2R0NKzS8rK50gh662B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647371484, "uuid": "c818c359-3e90-4e5e-a833-26149d189517", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647371484, "uuid": "da08ad9d-1662-431b-b868-b26981b010fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371484, "uuid": "b6d8c265-9a6c-4d2b-bfe7-98c343934a4c", "value": "8479a3f87dacf55ab2f504166a5cc18f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304e5831-a456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647345062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345062, "uuid": "a7154b7f-c343-4d26-a67a-162f4528765c", "comment": "Malware payload", "value": "fe0bcc4ff67afc3b9f9851d10191cb91", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345062, "uuid": "358d6231-17d3-4285-be3f-06e59508a283", "comment": "Malware payload", "value": "3cd2555ba8ae12d5462af8139b65c04a964f4bdbe9909fcb92e158fd526d9d75", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345062, "uuid": "9dac80ea-fd14-4075-b36e-cc2b980f4416", "comment": "Malware payload", "value": "56e49c7d7b425e23286960f0d13d05c035191f5b", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345062, "uuid": "9d4edf03-27e4-4482-90f4-43f3245ffbd9", "comment": "Malware payload", "value": "63879fe79f76174db5ddebe04da680b18c1fead544c51120fc575a2e354664e74bb810280cfcd01ff6a0358f20318665", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345062, "uuid": "84c77810-3408-45b7-bde5-bc2a7c7a9d06", "value": "T15041084280824C02F45DE6FAE460A2D161A034386CEC73B5FA37ECA145E5FC1664770E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345062, "uuid": "924b748f-11ae-4e7a-80dc-c6d12f7c659c", "value": "48:9wlIJV94g7NEGD91aLWtKMaJIth6cPWlZY8aFZufbp:sIbTzauuIzzWlZY8aFYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345062, "uuid": "790e563a-7912-484b-97fa-b9e005c108bd", "value": 2006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345062, "uuid": "c955992f-49e9-4c35-bfbe-83136aec7edb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345062, "uuid": "b014a52e-2d54-429e-9709-538be4bfa060", "value": "comitato_115.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553a07f6-a461-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349849, "uuid": "81aa4b0c-aa47-4b32-ae16-ae9383219f46", "comment": "Malware payload (Heodo)", "value": "7ecb310923994e99720fef5d42df723d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349849, "uuid": "85c565f1-1b14-4a9c-96b8-d2a9287e7ffa", "comment": "Malware payload (Heodo)", "value": "3d30fdc9033cf2455486ad2f3b24fbbd520359b9956dcdc378d7707053cf3d3f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349849, "uuid": "d33a06a6-86e5-411e-a9c9-7b2fa16f1f92", "comment": "Malware payload (Heodo)", "value": "6afa06424f0eaff1e75deb1d88394740a8dc8843", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349849, "uuid": "083cbfbf-381f-4480-998d-fcc582883ac2", "comment": "Malware payload (Heodo)", "value": "8cd53165e2cbeb1132df4c220d1945a160f026aeaf8ed3a74c270b81726540c5eace078f63c955da09bc007618813610", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349849, "uuid": "301af339-8caa-47f5-bd2f-b95a35b57181", "value": "T17533D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349849, "uuid": "18cafadc-8f8b-488c-b1a6-314462819b61", "value": "1536:YAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:BcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349849, "uuid": "a93258e5-cfbb-43cc-8f88-5d7f6aeae263", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349849, "uuid": "35a7d6df-95de-4365-b60b-5be9ea8e1aac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349849, "uuid": "9a2d4a3b-02b5-42fc-ac0a-d7cf26c04835", "value": "Scan.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb4c078-a471-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647356869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356869, "uuid": "072bd405-bd52-41c2-ad98-0500a5a596b9", "comment": "Malware payload (Heodo)", "value": "1e7a9c5e56dfa37865242d7495ab029e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356869, "uuid": "b5351138-6c2e-4ddc-9cdb-a3abbb1d3877", "comment": "Malware payload (Heodo)", "value": "3d9b9470220aeee5bbd4816def8e5462f007ae685e454381970819248ecda8f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356869, "uuid": "8856c6f5-7920-4a41-b339-600724c4ee64", "comment": "Malware payload (Heodo)", "value": "fc5292e4c58eab461f07fe2a051e2d16e5a36e13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356869, "uuid": "85bcf74a-170c-4f90-896f-2b4aaefed6ee", "comment": "Malware payload (Heodo)", "value": "a457e57c88371b7c19dd26a2734c237e7800fe11a009bd0ae523e6ceef17f6acfd36c0f9ac31e341db94b4d20576d937", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356869, "uuid": "089adb83-8f15-4f6b-a0bd-86e914b14ba4", "value": "T1E3257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356869, "uuid": "060c9e90-a0a1-4148-ac70-39add64ac0f7", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356869, "uuid": "b0b3f553-6338-49ef-99e9-1c87e40ec984", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlYOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8cl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647356869, "uuid": "9b435fca-1aa5-491c-bec5-ba39b24bab1f", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647356869, "uuid": "5a8b4659-3ca3-4845-a596-886b4d2c548b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356869, "uuid": "68c0952d-604a-4826-a1fb-4350625696e0", "value": "1e7a9c5e56dfa37865242d7495ab029e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b79676-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647354539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354539, "uuid": "c4c88014-432a-4416-bbc7-dbf241d80a55", "comment": "Malware payload (AgentTesla)", "value": "5d0009446c4c1c2f2c784534a20e8a59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354539, "uuid": "f86c0cf2-87ab-4995-ab38-0c91886e26ba", "comment": "Malware payload (AgentTesla)", "value": "3daeefda391c1221b1e23b333d55c71235b8f8741181cea0339056cec18ee244", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354539, "uuid": "583e45c6-22b6-478c-a96f-d08cee918c00", "comment": "Malware payload (AgentTesla)", "value": "1c87a11754a6cd76204aa462d9052fb6c2c49668", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354539, "uuid": "220f8c19-d04c-47b3-bb81-c23adb6b02c0", "comment": "Malware payload (AgentTesla)", "value": "0d95fc6cf3ba6c740df585460b4c2cd075043ac1fe70af13b4e5012821ee2c464ba00a11997578a2d47b4f354dd898f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354539, "uuid": "d14fc9a0-4d0b-4ddc-a9e1-7325671733df", "value": "T1AF05AE1AE39C6F66D13E23369632655083FAFCE75232D32F4DD970E82732A910A52753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354539, "uuid": "ce486c6c-3658-4561-b877-42089c4c0479", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354539, "uuid": "89996676-45e4-46fb-b03c-defe215a26c3", "value": "12288:OMU9ueWSQMadwNpm/eKq6olQ8vgEUhN7+hd+lVPiia:bQueWSQ8NcWR6xU2c4VPiia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354539, "uuid": "f23aa50c-3a82-4283-8031-1d2b9fdbac15", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354539, "uuid": "85e3e67f-c49c-4aaf-b119-f35bbc14c3cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354539, "uuid": "4a2b3633-aba0-4162-9eb2-6060d808b04c", "value": "5d0009446c4c1c2f2c784534a20e8a59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72641a9e-a449-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647339590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339590, "uuid": "35410fa2-18ed-4bf8-b03f-182549b90bfb", "comment": "Malware payload (Formbook)", "value": "e5f9bcc6f9413ce862699b7a52f5249d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339590, "uuid": "58d7ec73-44d4-4b1c-9cbb-67e0dd42223a", "comment": "Malware payload (Formbook)", "value": "3de6c37251e8b0145976bd956a5550ccb058e189d52298603e4542c080d5b9f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339590, "uuid": "765bebad-07c2-4bf9-8fe2-41f83745c3b1", "comment": "Malware payload (Formbook)", "value": "ced2b1929c58cfb05e9f0f96d1b37eca6aed1498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339590, "uuid": "87f92d4a-8a5b-4331-98a6-1a8b2ff871cb", "comment": "Malware payload (Formbook)", "value": "ba3f3099ec8cd2acb0b61db778cd931131346471c0134d976697f1db4fceae42a7027e93fedae59e04c01703bfe472b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339590, "uuid": "486870a3-c396-4dfa-816a-eb9f26342629", "value": "T10363290A6A896619C6E87AFC85F1514257767CF22510C24FECF83F295E327A3DDC260E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339590, "uuid": "71894e9e-3d1d-4d65-8b58-6017f7da4abd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339590, "uuid": "6eff16c8-8bce-4401-b078-ee92a7adbab5", "value": "768:htlTglco5sx5wNZeQuoJqDrQiLnBlVyIlFIUxoZEpeSxp+ml7MwCKt3deVDh6:xTgyoCx+IDj7Bl1toLm0+30VDh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647339590, "uuid": "815765f7-dce8-4563-924e-a724415decf8", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647339590, "uuid": "cb35508e-2e30-4058-9fcf-faffe64e3919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339590, "uuid": "9eececa9-f227-4930-8bcd-119a6ab6ef70", "value": "Quoten 7902134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc201b7-a4ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647381807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381807, "uuid": "93724250-d050-4015-bc6d-ca0e5bd56853", "comment": "Malware payload", "value": "2055703b3ce587336a93a70a65285bde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381807, "uuid": "196f998b-3265-41a3-b3de-d6171c51d285", "comment": "Malware payload", "value": "3eaddef3154445fd4a4f2f999e64ae83d5eceda993e592d9b6d1e22de4cd7132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381807, "uuid": "efeb17b4-9aeb-4ae9-a815-23c79bcd01a9", "comment": "Malware payload", "value": "f3460242af92d82316d377cf8801fd3216700f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381807, "uuid": "98a7e451-d6e8-41ac-be01-0f525d215050", "comment": "Malware payload", "value": "30966fbabce2ac356102e9646fa41e922a025217cbc8adc484a8d4eb50302ed7e89af80e948818090b10702e5d1b5c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381807, "uuid": "2e5ae132-9111-466f-91b2-6644847ce7f7", "value": "T1A415AE0373DDC3A1C3725273BA65BB01AEBB7C2506A1F59B2FD5093DE920162921E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381807, "uuid": "486e80a2-49f6-4cf0-a0c8-eff4cc713d4e", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381807, "uuid": "cfe7cab8-869b-4030-9457-3d45d523f84c", "value": "12288:24lsXvtCcmVVXzzn4PJAahPl/QEdIMiVbHydEIJnJWUga/7D9vq9MmCS:24lavt0LkLL9IMixoEgeazD9vq9MmCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647381807, "uuid": "fd71f214-9f6f-477e-b961-b7a0adaef304", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647381807, "uuid": "5e9bddfa-302b-4b15-aab4-026703e2b9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381807, "uuid": "3ae0690b-dd7f-4e8e-a039-9345d5ed8b28", "value": "3zcv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49563ec9-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647333508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333508, "uuid": "1f1cb2b8-0c56-453b-9ebe-b652e12d8eac", "comment": "Malware payload (RemcosRAT)", "value": "76d7147771fb4fcf69838261875d65e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333508, "uuid": "8663e87a-f1e8-4c7e-81df-0f8e2ca628e9", "comment": "Malware payload (RemcosRAT)", "value": "3eda013dd1e1d67954f12f703672f40fe6a9f2be940947dc9091ccca1f82d124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333508, "uuid": "e59706c2-9b13-435b-842d-6fb90e0afae6", "comment": "Malware payload (RemcosRAT)", "value": "ee0313852c1035ea1f622ebd4212aa6d7ae7f95a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333508, "uuid": "0fc1da1e-9ea7-40f1-bd09-5d6cdeb95762", "comment": "Malware payload (RemcosRAT)", "value": "4c010f0badbe932b5a0d76df913965609e6e9258051142c2d34c902681ee4ed36da0678af6681797fd04b126f6638ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333508, "uuid": "0b750a50-4884-4fac-9cb3-b6030a58e726", "value": "T18345BF3A32C10B94D07D4734927884D427F1764BAB15CBAE7DA202DCDFA1E4A67336A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333508, "uuid": "7b30ba2e-7965-4f2d-8b9a-58425333871f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333508, "uuid": "6022fe57-bffd-4ae8-8e2d-d975c5b5468b", "value": "12288:gl1oeyWwQ0Z570ZE5Uyn0kKcUj9t1PZQSlIGeUf6pI7Z1lVfQvbZPiQ1gBMiZYKS:kYWwQo6UAcajBr1eNMZ1DkbZPi14HBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333508, "uuid": "706f0e57-8295-492c-b92f-007377bb0c45", "value": 1221120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333508, "uuid": "8a5fb8eb-40d4-40f9-98c0-a777ea70d64f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333508, "uuid": "eb045d61-faa4-4c50-b20b-067827e95f8f", "value": "Required order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd1f13d-a488-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647366583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366583, "uuid": "173aed0c-b7d6-4f32-b658-26f5847bb001", "comment": "Malware payload", "value": "2462691c3095c486d36e7b345c76976c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366583, "uuid": "7fbc6cb1-b6e4-480e-9e2e-a73574f3a29a", "comment": "Malware payload", "value": "3ef373143fa2b9996448f597ed172e144551ae53a2d9d7ef130ec6a98e3d6a79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366583, "uuid": "45795700-69d2-4853-94dd-bcfe2de8080e", "comment": "Malware payload", "value": "ec8ca0381a56aec8e0d6a03f696f465765ef301d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366583, "uuid": "f4c88493-e5a0-41a7-88b7-d9ae9d7e367f", "comment": "Malware payload", "value": "054a98ecc514041cc3a794139b8b761dc0f23d2fe99d33086a9471b17a38284d2eb16cceedecec90b65bdade83329fc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366583, "uuid": "abeced31-427f-4dff-815a-3219f87b8de3", "value": "T11593B423FA5C0071F6C686B1596687A63816FC3119609D0B674EFF9C2E31643BAF532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366583, "uuid": "1a203a80-d944-432c-a534-0d899414d52d", "value": "7d35b01162fe2f420c7998d649c65cdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366583, "uuid": "1ae4050f-a7b9-4594-9fb6-4be81d78bbfb", "value": "384:oLLSWwue/4youZfWkXiWgEiSZexdiHxZWE0ishIrjpWKV:oLLS+6dWailEl0iR4KqIrkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366583, "uuid": "3cc6d64b-9087-4a92-85dc-79253af6ddd8", "value": 90158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366583, "uuid": "9564d5ac-49cc-4449-a9a7-3a9432178a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366583, "uuid": "3b4f3524-bdde-446e-808c-e26fdcd7d6ce", "value": "3ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fa182f-a44e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647341798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647341798, "uuid": "c577f3df-5300-4e8e-9c7c-12a48f9e73fa", "comment": "Malware payload (RedLineStealer)", "value": "0781a9b07108b92d9f666d65387264ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647341798, "uuid": "3e8e7489-dd1f-4565-a094-ea013a5a3bf5", "comment": "Malware payload (RedLineStealer)", "value": "3f0a1f2272af4823d1eff849b7578b90bf04ed5ae37567a2f42d3f19be750b9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647341798, "uuid": "ac96c286-326c-4b82-9b01-567d9dc02b3b", "comment": "Malware payload (RedLineStealer)", "value": "ea3e9083e7f40a5295b73f24190fcda39074b704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647341798, "uuid": "02f2611a-7571-4bdd-9dcd-9b6c407c9d9c", "comment": "Malware payload (RedLineStealer)", "value": "68652cfbce3f8b0d8ab2a0aa847340ba3899254249af336715ff62c9e96747c888deb93213a7460565ce0e2fe90e79e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647341798, "uuid": "70de2ffd-8c3a-485d-9aa4-217091c4e731", "value": "T15C352367B7E05876E1E11C314E11FAA95769EF1A19284AC7226A33D1CBB4342DF2F307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647341798, "uuid": "e14a6734-e567-4f12-be33-bac18d3a66d8", "value": "4a49ea780e61c2aefc39e2c2b2fb2a16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647341798, "uuid": "32cdad2b-b92a-4b7a-ab06-56b65056dc2d", "value": "24576:R00KNAEvtsi7B/bu9/4MqFvgyWTuxxzpFYwBmZib8D7w:6YEvtsd4/FvhWYhmIY7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647341798, "uuid": "a5e0562d-ef2d-49f5-be40-fd2fd48bddf5", "value": 1075003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647341798, "uuid": "fdc5adec-de80-4f39-bc38-83f72d900344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647341798, "uuid": "560ef6e8-6d88-421f-af6a-656906a64bbf", "value": "0781a9b07108b92d9f666d65387264ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b86e7d-a461-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349707, "uuid": "efd30534-4f6a-44e9-be78-94abc3542beb", "comment": "Malware payload (Heodo)", "value": "93c2a2dd7a4df50efef0a30142c8ac92", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349707, "uuid": "4caf568f-f534-48ea-8365-65393e576f43", "comment": "Malware payload (Heodo)", "value": "3f3f8179fe100f71455effd7f854c841190b11ca2a45ffa3f50231888710066e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349707, "uuid": "446fb972-3055-486e-aa8e-2ad3fba60fec", "comment": "Malware payload (Heodo)", "value": "5ac0eb9b77abc3425f8e6b03df35ebe6b2a9f933", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349707, "uuid": "56967d01-6ef9-44cd-ae76-4a603ad933e8", "comment": "Malware payload (Heodo)", "value": "59bbf30d62a2aba7afd175450488619ffc391a21215189a289a0014ad4c4ceadfb9fa03a5b05c45101e15b13c38e478f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349707, "uuid": "562c284c-808f-4acc-b293-84659b08e0dc", "value": "T1AD33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349707, "uuid": "50ea7778-8e18-40eb-86f8-3f1805be7641", "value": "1536:UAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:9cEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349707, "uuid": "681511c9-471c-43fd-9db8-78c8a91935a8", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349707, "uuid": "989c5dac-cfa7-4536-8cff-fef7c00b9136", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349707, "uuid": "1c940693-be8f-4df5-909a-034dbe667506", "value": "Dokumente 2022.15.03_1252.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c6e221-a482-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647364045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364045, "uuid": "17596625-aa7e-4b9b-b37b-ba2dd405dd50", "comment": "Malware payload (Heodo)", "value": "2d7793f1e8ae343f6d134222fcb4010d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364045, "uuid": "31e3d381-73eb-4e0c-8bf2-bce8d1e176e4", "comment": "Malware payload (Heodo)", "value": "3fa77f51134fdfc5887cd608a68cb3b2426a1461600d4bb0c24628ab9abe9be4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364045, "uuid": "bfed3221-1c86-4ffe-81e0-794b8d8f5bb7", "comment": "Malware payload (Heodo)", "value": "821c59058ca49486284b69bc73d065b9786eb044", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364045, "uuid": "f6091312-bdeb-4583-8da8-3abf29667980", "comment": "Malware payload (Heodo)", "value": "26b445c4ef7adf4fe549cc32e0f8e2951dae3bef7ff07ddb10a3fc0c961eb550a2d3eb5fd232ca0a779987c03dc831e0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647364045, "uuid": "696aeff3-6f05-4257-a858-2887e3985247", "value": "T1FE33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647364045, "uuid": "0a30f649-42eb-4493-91e5-682b81649313", "value": "1536:UAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:9cEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647364045, "uuid": "c08c34ed-b149-4457-a654-9e6705b4807a", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647364045, "uuid": "8a1789dc-e244-4318-b61c-14e325e4de18", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647364045, "uuid": "45422b92-ab4d-4042-8798-33825af9f241", "value": "detalles-1503.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d95514-a3f6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647304100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304100, "uuid": "6f953eaa-5b20-40e2-ab49-280e90987686", "comment": "Malware payload", "value": "fe03b4e1d2076afa408c55ef1100767f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304100, "uuid": "e7e20363-e47c-4143-9221-4e991c5f9cd7", "comment": "Malware payload", "value": "3fcaa734330e260e66c61678b23948e734dc303f02d0faeda09954804dc323a5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304100, "uuid": "2cb763be-365e-410a-b89d-07e4a86ccd02", "comment": "Malware payload", "value": "1c27c6d05ec2e4d7b9f99248b3ca00b697968893", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304100, "uuid": "377e843c-191f-4519-a164-821bd30d3885", "comment": "Malware payload", "value": "3ac6255a8e0d66fc638ee91bdcc8f9d5ec5f2c0bc9faac675d352a8c919cad05ddfcbbc5425220d652f840a8e64de12e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647304100, "uuid": "96643239-93d4-4c01-8da7-663f44343cf6", "value": "T15F7302305DCE0CA1660B59B80A3B4B24BAF78582CAF7CB4277858DC7D816AC25EF095D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647304100, "uuid": "986942f5-597a-47b3-b766-b7650a929022", "value": "1536:Dpl8d/0haqG268L60MXkjhfZC8j6P5wLKOGEJ7adjO9Dzexn/I71QG:/8J00qxs0MUjhobBw7g4zexn/CGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647304100, "uuid": "790f976a-0576-400d-9ef2-c45904a2300f", "value": 77430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647304100, "uuid": "24230492-5748-4dd7-a2cb-449485495668", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647304100, "uuid": "c951a660-a2dc-46c5-a662-5b7df4e15dcf", "value": "documentaci\u00c3\u00b3n_2734927.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60b2469-a47d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647362037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362037, "uuid": "11980a59-a57e-44c9-8c74-bac4eb71a240", "comment": "Malware payload (Heodo)", "value": "d0d4eb4f8b8de8da83c587c59f91e7e4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362037, "uuid": "981b8b51-53a5-4eb2-9906-2a644aee253c", "comment": "Malware payload (Heodo)", "value": "3fdc21b98459bc0cd34300d959d89e3ffbe12d634cb9b49d8ac0b695aeeb5778", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362037, "uuid": "b4816a0d-949f-4bf8-9fd9-9f0fbc518701", "comment": "Malware payload (Heodo)", "value": "8f12343dadfaf6c42f256de9a6ed685364fa83af", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362037, "uuid": "04bd356f-434c-4856-b559-b50d3611a027", "comment": "Malware payload (Heodo)", "value": "d9dba75b71017b63418c6a220fc67b6d69ded3679b7db98684e2c5818b82a7cf805652f6e23cd1da401362dbc85c2f18", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647362037, "uuid": "1efe02ef-66ef-460f-81b0-56d42e75554a", "value": "T1BB33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647362037, "uuid": "e664419d-559d-4b4d-834e-83a486a0fab5", "value": "1536:UAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:9cEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647362037, "uuid": "dfcca1a4-b06b-42d3-8ad0-d6497e7eac2e", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647362037, "uuid": "f5d93ec0-03a6-4f07-a78a-b027fd0e8142", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647362037, "uuid": "b7f6071f-392b-41b8-a3a9-a92e1dda1409", "value": "RechnungsDetails 2022.15.03_1521.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e6e441-a431-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647329281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329281, "uuid": "5596afb8-a31a-4d7a-bee2-f135f1a69139", "comment": "Malware payload (AgentTesla)", "value": "0b1ebe1a5c6aa9677a76cffad19cd7ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329281, "uuid": "175baf1a-d761-44be-8249-255ad3839172", "comment": "Malware payload (AgentTesla)", "value": "3fee0d32925b8e8b2525e9b697ef141fe0635570ad42cc8b9fd0819913983db8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329281, "uuid": "9a5d004c-6a6e-44a0-adda-ba8730cf571a", "comment": "Malware payload (AgentTesla)", "value": "c236c5b30def8c69b9af1a64da625129a1768299", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329281, "uuid": "4a91a9e8-ccaa-4302-b9d4-b77d9f227dca", "comment": "Malware payload (AgentTesla)", "value": "0d0d2c0c7395a0679008ecff1faa3536534386209e172e265da45618cbf5798bbfeb64ffb588a7a8903d01ffc3761656", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329281, "uuid": "603625df-992e-4d58-8a85-07b6a2cbc5e7", "value": "T1CA15129A73E45F82F87ACBFA9836191053B6B4290509E74D5DD270DB19F3F0183A0BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329281, "uuid": "8d36f07f-cb88-42f6-aebc-5729f6b151fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329281, "uuid": "762a2cd7-3360-4720-bf80-e207665dd842", "value": "24576:samlwOU/fALyhS+0dEseBx/T3nLDrG8h/ZnF:saIfU/kuv0msElf7hRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329281, "uuid": "8d992c77-159b-439f-9ebe-dffb35bf423c", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329281, "uuid": "0cb24ae6-ac2e-4a4b-95ea-2d120e4a204c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329281, "uuid": "17069720-84df-42a6-938c-46df62d48008", "value": "DHL Delivery Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352e2f0f-a467-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647352372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352372, "uuid": "7172ac4f-260f-4b7d-827a-7f727ab54209", "comment": "Malware payload (SnakeKeylogger)", "value": "91f8e2934c614cbbb54634930816dcf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352372, "uuid": "4538a352-ada5-42d1-9ccc-9a751e34429a", "comment": "Malware payload (SnakeKeylogger)", "value": "401a6ed544894642edc00fd31de81c342e07ceabff3f97518b079bec7763d16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352372, "uuid": "16ba8d82-67bc-47cc-9dce-8d134508eff0", "comment": "Malware payload (SnakeKeylogger)", "value": "338a7dc7d8bf926df01c7ce405778aa525b134fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352372, "uuid": "6ac18245-77a9-447e-9906-ad939a8f0f55", "comment": "Malware payload (SnakeKeylogger)", "value": "dc0ad1b20dc1f84fa85b25da10536af260d5587bb0c79f8ef563343354599f0f8c9bc2ba7acb6b8059362b72a04e2a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352372, "uuid": "07db65cb-03d6-41d4-b871-7188d3de0482", "value": "T1DA44027D1756AE77DC1ED6F900E623AEA7F053506722BB552F8222E50B2BBD004C4A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352372, "uuid": "c6c3b63c-b5df-4ce8-85a8-65c400af6f3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352372, "uuid": "40ca5a01-3f9a-4378-a681-08f69d70d9ff", "value": "6144:O+j691MYICxnVivBd1LfcjbRxSiKwHZ9Cw1sZXWY:O+jnYPxYvB7jcTSiDH/SZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352372, "uuid": "53b8b5f8-2bce-42c7-8db6-18dfcb171922", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352372, "uuid": "7554497b-be9d-4944-85e9-67c46fab92ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352372, "uuid": "742b55f1-6eac-4749-8e23-c37f15bae026", "value": "order delivery documents -pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f15414-a49f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647376390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376390, "uuid": "e0f0e8c3-cd48-43cd-851f-d735812d6bdc", "comment": "Malware payload", "value": "55383778388c9159458291c08a745f6f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376390, "uuid": "a9c628ee-9c22-4855-99ac-77d2624bd821", "comment": "Malware payload", "value": "40560893cabfa0a6c6630df67ebe3859608e51234c4ece53ab4feb193108385e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376390, "uuid": "5da64230-9802-45fb-9fc3-8e20456f5f4c", "comment": "Malware payload", "value": "6bd3f100f016f370a593ed352eee97e1bb468353", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647376390, "uuid": "4f39e333-378f-41b3-8653-66721021019c", "comment": "Malware payload", "value": "4f7219fbf9a6c8abbfd908a8cbd64d94b264e9f610236878157b6004680adebfc66adfcd62053e59d51b20715e718989", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376390, "uuid": "a27bf103-bfe3-4b97-82f6-b35bae896cee", "value": "T17A84F65114A36D71C3E3C9B2A7D90C2639E6E2D2CFF7900ABAE45A38C524D83D33B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376390, "uuid": "21b8dcbf-c861-47b5-946b-c7c4e37cd144", "value": "6144:cfF1NzGtVoGsil4OahPx1Sd4BHTVDjK1wj1z+fN:KFxGsTPy4BHT4Sj1zU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647376390, "uuid": "12407437-792c-422d-a3d5-3ebb4f810ce0", "value": 391885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647376390, "uuid": "a3d1a685-cbfa-444b-99df-94f2b3afcf6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647376390, "uuid": "b3ccabf6-e495-4337-86c3-79d5baeb5d29", "value": "emotet_exe_e4_40560893cabfa0a6c6630df67ebe3859608e51234c4ece53ab4feb193108385e_2022-03-15__203303.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26147ad0-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647353205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353205, "uuid": "2c512a6e-d399-4b01-9e00-bc637167f6c8", "comment": "Malware payload (SnakeKeylogger)", "value": "91403f2b4acbceec98efcce4a086ad70", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353205, "uuid": "e553cda6-f45f-4714-af8d-90ed4f41cdba", "comment": "Malware payload (SnakeKeylogger)", "value": "405b1218f0de9c402127bb6799fd2e2c407f8d28854afb06f1e12a02870f730d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353205, "uuid": "53b54b51-aefe-4b22-a636-a88207500e98", "comment": "Malware payload (SnakeKeylogger)", "value": "91ac483b4f22fd55f70c2f8dbf8eae16811d305e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353205, "uuid": "21367d13-6fc3-4fe5-a375-0d16ad30a0bc", "comment": "Malware payload (SnakeKeylogger)", "value": "2bd33a836f6887199abf89a5fd46c075d9b3a033ac435b0666e72d51d9063f43f456362390e34625fc8ed39c4a903ba3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353205, "uuid": "db777e76-685a-4388-a427-be88da14adaa", "value": "T1F8917121633C2853DE65D0B9D07AFF4B56E2F22B81CB1686336DF8B01B1B7653A15544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353205, "uuid": "322decad-4f88-490a-aee5-c0e9b4198148", "value": "96:yj+j5Wqam2YKQQCzmL5T3K6ZU8CQzlFXi:yj+j5Wy2YK4zmL5T6KUbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353205, "uuid": "ade45a6e-9bbe-4847-85eb-c3c341a782a6", "value": 4612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353205, "uuid": "09575184-ac2d-47de-a644-e08395bbaeab", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353205, "uuid": "a478159a-4b50-4a6d-b4f1-004205e1ed8a", "value": "document 1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2de3d5-a4b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647387366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387366, "uuid": "be3cd0af-2812-424d-91d4-6dc8025796dd", "comment": "Malware payload", "value": "3bd81a1cfdff23adf929b89e07452441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387366, "uuid": "93c43b50-1de1-4329-8f94-196f821795f5", "comment": "Malware payload", "value": "40b2724e08232e2a46f3ee36e9b0e5ee2bb49e81570abeb28035adc71db8ac99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387366, "uuid": "326c16c9-8b22-4391-bfc9-3a5e79f55a60", "comment": "Malware payload", "value": "cee174ab8c94de29112b379fb993120fe706dcba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387366, "uuid": "8ce03ffc-63c3-4190-a407-294d6fa7e790", "comment": "Malware payload", "value": "e6fd3a32f41324afe27652c6675216f42ff30b0e645a1e53d9d5b9f479ca836020214ca130bbd506cb9210faa8ef310e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387366, "uuid": "01644bf6-fa43-4d98-a910-042b843be75c", "value": "T1AE446C0FB49294BDC0ABE83097DF99B266257DCD4314393B7282E9313523B642F5AF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387366, "uuid": "127aa452-a26f-443c-8dfa-e706ff1b424c", "value": "6144:W7ZzUdcez3qK74XY+5gdWSlqqD4qgf2bVgu:WuepeISIqPg+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647387366, "uuid": "960e0132-272d-4e7e-9f4c-42b6b679fdd6", "value": 268040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647387366, "uuid": "851c76df-8c83-4626-b4a9-107d6887be1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387366, "uuid": "3e71e8e4-8009-4c55-a25f-e66cb73f267e", "value": "cee174ab8c94de29112b379fb993120fe706dcba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3822b498-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333479, "uuid": "6ea51c23-d22d-484c-8d8f-19076044c862", "comment": "Malware payload (Heodo)", "value": "6e880beea014ec8a214539251386a2ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333479, "uuid": "a8492155-5772-437f-9ca0-5a6755993db1", "comment": "Malware payload (Heodo)", "value": "40b5b3818636809145e6b6d9d157ba3cf50df3e32f665c16d3553c7b2c8b4e57", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333479, "uuid": "6c5396a4-32f5-4eff-ae96-bd659acddf4e", "comment": "Malware payload (Heodo)", "value": "2c3fc06555281fc52665d0adb9a32a9f5502b7fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333479, "uuid": "197acfa1-48a4-468a-940d-3b59a6cd0980", "comment": "Malware payload (Heodo)", "value": "ea2bdcbba84784c7cb73358ac7ef6d4bc8f2b18e1998efd8b6d54830e926d0ad8cea73ac93dce8982d46b5732dfe4b7a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333479, "uuid": "147b1445-a173-4a43-b6e8-a218fce15147", "value": "T1A6257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333479, "uuid": "09ccab6c-5153-42ae-96ba-ae8ee4818f3f", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333479, "uuid": "5c9d4330-2cf2-466b-aa1b-1bf51c900fa0", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKl4OlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8gl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333479, "uuid": "2f20d082-982f-4f46-8371-81044f15a0ee", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333479, "uuid": "adfc87ee-f341-470b-9ee6-73f66571f45c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333479, "uuid": "ea691453-12d4-45c0-8d35-dc41aa5aa80c", "value": "emotet_exe_e5_40b5b3818636809145e6b6d9d157ba3cf50df3e32f665c16d3553c7b2c8b4e57_2022-03-15__083754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c5a7dd-a49a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647374457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374457, "uuid": "e45fa4a1-94b7-460a-94db-020c93cbe163", "comment": "Malware payload", "value": "4142b4b60207bf08ba6635fc695c4d70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374457, "uuid": "4b923ec8-bcad-49df-8d59-d39ecd1172db", "comment": "Malware payload", "value": "412a35e136f23ca72da90f34c05a9cf3fd10db76b09c4ed47bff085a56e0922d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374457, "uuid": "7a01493c-73a2-485a-9e56-69074b249e95", "comment": "Malware payload", "value": "0e350ce890abaff309c0a693f74f90c4fa67e157", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374457, "uuid": "3bb0dff9-d5c8-405f-85f2-33583a8eaff3", "comment": "Malware payload", "value": "bba4e525e3ab550531b3162d5a39ffee15c695a8b2861e24bee0060ee4efa48d86fec91dabc3ead0ee9f3e35129a4920", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374457, "uuid": "949d2f61-6ec1-40d2-b6e4-6311ed5d0648", "value": "T161E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374457, "uuid": "89b5510f-d9ae-4598-a129-5c7d0022526b", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374457, "uuid": "549d697e-b90f-4b39-9f0d-2cbccb9fb154", "value": "12288:E94YBCR2xP7guDo463OP4egsiSOZjb2woE+MhJT:2kRAguDogP8ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647374457, "uuid": "e7c18419-a756-4c6e-b632-03a54e614aa4", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647374457, "uuid": "6394304b-d822-43e9-b309-c93fddc09248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374457, "uuid": "5eefbdf3-b323-47e9-ab32-9767b25bd2ad", "value": "4142b4b60207bf08ba6635fc695c4d70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c90fd0-a42c-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1647327276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647327276, "uuid": "8ea6fa80-ed27-415a-9c89-52e4a092b664", "comment": "Malware payload (STRRAT)", "value": "e7314a9403b6605d130299d4f94272f3", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647327276, "uuid": "16029e63-8d95-4842-a004-7854b1a8cb0b", "comment": "Malware payload (STRRAT)", "value": "4192c84012f17154c3c76c21b39ed29a2fb6fcf77c94c41983f789a826cb4b6b", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647327276, "uuid": "43c5aea3-8505-4989-a848-79adda0e69c2", "comment": "Malware payload (STRRAT)", "value": "0de114c415a83d2be9ed65ecdb57b30f5eca594c", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647327276, "uuid": "50ea5f47-25f8-4d93-a142-3fc5c3d1f8a9", "comment": "Malware payload (STRRAT)", "value": "aedb5a3c6209a48fcc73c9767383aa2a55d7816d2b22e64e9684357235763b7ececfa910ab6359a0a3dee177db2ca597", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647327276, "uuid": "75bfee45-be2b-4240-aede-f39f9338ffb5", "value": "T11C04121F2E83D1DA7865A6D4F3320AA7A0F8219507E351EA6D2DE8DC4E53BDE0D83059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647327276, "uuid": "03c0ca2a-321c-4db1-b68e-eff690ac1b85", "value": "3072:sJbniVYRkzxg20WJGydlqAk8ll8ntthm93njgDdZYD6EkrbI55PfWSv:yniVYRaL0WJ1dXk8bkttOXjgDd7EyILf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647327276, "uuid": "80796510-8747-4390-a7f5-f646c42b7a95", "value": 175412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647327276, "uuid": "7e351474-3cfc-4ad3-ac67-40b33333e5bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647327276, "uuid": "64147e06-eb5a-4f6f-9ad8-02bf870f217a", "value": "SHIPPING ADVICE#NEW DOCS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae2a458-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353294, "uuid": "8574909d-b2ec-4c0a-a1ef-eb4287bb88e1", "comment": "Malware payload (Heodo)", "value": "3af0441549650de70c483ee71db3b4ab", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353294, "uuid": "4011b2c5-8343-4fd0-a026-e4b63d1e3dc1", "comment": "Malware payload (Heodo)", "value": "42114fb9a54d633c11a87050108f88660519f19c04390b7f337443c5e26ea532", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353294, "uuid": "c3bee349-827d-4668-8d70-308b2a69f9c1", "comment": "Malware payload (Heodo)", "value": "f38543e0c01fdf3e0803020f23bfd29e85ae3025", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353294, "uuid": "7c865759-b120-4b41-9959-0a5ea63ba0fd", "comment": "Malware payload (Heodo)", "value": "e4eec6403cca52e5d4b2e1005069e08cf7c3b0ce0bbd35a164cf27265d823d824e409fae43b688d8c09d7a5eb54df86d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353294, "uuid": "a3706597-d8a1-42ce-9b7e-5f6c7eff6888", "value": "T1AE33E01F9522F5ACC3136C7DCA4C59F5650D5893E089F62B08857B8CBB1B2E7178F286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353294, "uuid": "134c3e0f-e212-48d8-affe-717850578ed0", "value": "1536:3FmPpcEglt24xZdRBzH9hJBrdEwwNXekVIc07:14cEk2Kd3zdtdEwoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353294, "uuid": "dae9c4b6-0506-4234-af7c-e7c61b278f1e", "value": 50551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353294, "uuid": "78d51e15-a077-4876-a5e7-308b0c3fe35c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353294, "uuid": "0debd0da-0525-44fa-b110-1817465e5831", "value": "OMICS Online_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb83d290-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647333807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333807, "uuid": "b59760f5-a770-4dad-83c2-f5b71f0ec1fe", "comment": "Malware payload (Formbook)", "value": "54274239311ff6e5e8367e2df2ab55a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333807, "uuid": "79e5de4a-7da8-498a-834b-9ba865f8cd47", "comment": "Malware payload (Formbook)", "value": "42bed45454511067a6358d37aaab96c745722d990125bd1951bb42346ff3717f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333807, "uuid": "29e1ab5b-1482-46e1-818f-09066f2c0043", "comment": "Malware payload (Formbook)", "value": "a682b1d77055542aa5b4ed54f38c2aec46ce3518", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333807, "uuid": "c6516275-b7af-4d26-aad4-b812559e1f45", "comment": "Malware payload (Formbook)", "value": "0147156c1a18b24c1db21653f5fdb9fcba4810afab24536769bfcc2b80d720467acc7841aa827bd60e294b7dfea6a996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333807, "uuid": "d07d05b1-984f-4abd-aa4e-83003216ae4e", "value": "T17CE49F22F3E1C532C1335AB98C5B9364681EFE21AD1468573FE9AE8CBF79581243E153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333807, "uuid": "c530dce6-0e37-4178-af70-01d1fb910019", "value": "f411b7c64ae0f16bd14a751e9077781d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333807, "uuid": "8e5d3354-5eac-4a44-9691-866a4d828c6a", "value": "12288:/5VHItCEqofo3cOS0aYcdexwGN94Y9/rIPR4KeBIQCN1+ZAzl/+RIlRfkK:zopqofo3cOSpYcdexwGN39TIPR4KeByZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333807, "uuid": "41d4d30e-ec20-4c1e-b373-85f73d9c22ed", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333807, "uuid": "87f64a9f-b431-41cc-b4a6-d649ab2f0b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333807, "uuid": "04b0a7a2-0cd1-4e14-85ea-3ac2f1e7e8fb", "value": "Jupjybbmmvgseybjvdnuakeumascktsfkn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d981a412-a41d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647320865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320865, "uuid": "a924a57b-b7e7-4869-88bb-76d6103886a3", "comment": "Malware payload", "value": "6e9becbd47c65c242165ce455214abf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320865, "uuid": "59a56ba4-4ecd-4109-b49f-bdc22ffc56b3", "comment": "Malware payload", "value": "43175c4659e5b0a1323547918c6f3ac5c0bc0d0563f4f6ff226b3fa228934593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320865, "uuid": "b730ea1d-4a42-466a-859b-8e92907236b2", "comment": "Malware payload", "value": "b64a8410aaaa724fa5bb6e3b8cb75159d1f34205", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320865, "uuid": "ddd1bd36-e13e-41ca-a420-3461341ca334", "comment": "Malware payload", "value": "13506f27a3209860b84416404b7926574fd18c06cdceefcfe77fac4a55c242223654201ee1a5fb617fd70605da5a9273", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320865, "uuid": "f4687c59-9635-4954-92bd-f52a58e78955", "value": "T12525D06ECAAB924DC680FA273881113A21330A4545E857EF77135D4D4D7AEBD2EFC0A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320865, "uuid": "ff4e5350-c70e-4c7c-9f19-c3a529842a5e", "value": "24576:6imaH3fUk7isOUr4btnC7Ze+eVsfmizxQ/qvho:6in3fl2vVtnMe+eV56K2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320865, "uuid": "acbab4e3-fcb1-4303-87de-29d447efeb04", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320865, "uuid": "b3087826-a714-4f4f-a034-8d40ba13722d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320865, "uuid": "5dafda8f-3197-4baa-8889-2856d070583a", "value": "41375.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522c7775-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353279, "uuid": "5dd1e509-9fa6-49a8-8a1b-48f3fd33326e", "comment": "Malware payload (Heodo)", "value": "93c8001bf96189f93ae54884193332eb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353279, "uuid": "ee3552f6-3db3-453b-94d3-2b47de214a30", "comment": "Malware payload (Heodo)", "value": "4391a312ef364f52235bf17fefd1f2a1d80a550cf7591d40386ffa3f2a244689", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353279, "uuid": "698bc24e-134f-4806-8576-ab489f32d080", "comment": "Malware payload (Heodo)", "value": "4a52d731dc646ce536228257eda6f6367a8af221", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353279, "uuid": "f08c2b4f-f351-4a35-9451-d84ee6eaa97a", "comment": "Malware payload (Heodo)", "value": "092a87678d7b473dbf8494c5957e8b747d6bf125800b57dad4dfc8fe04de5062b628b5e081140d2dccb7b363b356ab07", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353279, "uuid": "e57f76f8-3a36-452f-9aee-de2ac54942c2", "value": "T12133D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353279, "uuid": "349c0b85-fd66-4af3-aceb-167eff47f01a", "value": "1536:0AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:dcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353279, "uuid": "a5fece49-4366-4b86-8749-1417c6aaa22e", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353279, "uuid": "4171d46b-c126-495d-9251-78b62d594d51", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353279, "uuid": "2e94a7d1-36c3-42bd-8dd2-574585600eb5", "value": "Insight Medical Publishing_3.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f00ce7-a442-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647336433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336433, "uuid": "5199d66f-68fc-4f11-89f1-b59f970f0fa0", "comment": "Malware payload (Heodo)", "value": "1c4e9219b010634650534d557b225dc8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336433, "uuid": "b07d4abc-030b-4f9f-9fb2-318f8aac589f", "comment": "Malware payload (Heodo)", "value": "446f47de80f236c58f6845a946682265eff5bddafd71137bbd60e5c8079cd297", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336433, "uuid": "59dc8eb6-3711-4e63-a86d-6cbdc252851c", "comment": "Malware payload (Heodo)", "value": "758dee6dd05759d2db591e55a936e631613933d5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336433, "uuid": "2ed222d0-a190-4c26-97e9-39323825bd4d", "comment": "Malware payload (Heodo)", "value": "a17d5da7f5465351bf9a08b41e4f7cc735ec20656829499a98dba6bc6d7dabd3d00a961159f45bc10f3c9e7d4293efb5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647336433, "uuid": "4eb14267-c691-4594-bd62-7071d243e0b5", "value": "T11C33D00F9A22B5ACC3136C3CCA8C55F9650E5592A0C9F72B08857B9C7B1B1E7179F282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647336433, "uuid": "0ae6fce8-bbe8-47d7-b949-0704c07dfb1c", "value": "1536:wkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:hcEe2Kd3zdtdEwo/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647336433, "uuid": "9efd5aea-0004-430f-869a-aa48509dbbf4", "value": 50643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647336433, "uuid": "80e690c0-fc28-4e3a-b10c-3144520480a0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647336433, "uuid": "f64ce273-4c40-4470-baf7-88e50f2a7a1f", "value": "Fattura N 000091-19 BIU 15-03-2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03fa7e8-a473-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647357732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357732, "uuid": "e912c25d-a99d-4373-95bc-354b4971c35c", "comment": "Malware payload (RaccoonStealer)", "value": "e2abf4955a35d2f6bfeb21200ea1f836", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357732, "uuid": "bd5e060f-ad5b-4014-a1e9-7c1d0be97913", "comment": "Malware payload (RaccoonStealer)", "value": "447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357732, "uuid": "26a556b8-d8fd-48d4-92bd-3c903edda430", "comment": "Malware payload (RaccoonStealer)", "value": "be5d778d38688a5db52a3d72adf76a59433975ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357732, "uuid": "ed270070-fba5-4ebf-9659-b5a1475ba422", "comment": "Malware payload (RaccoonStealer)", "value": "f5c0153155585aed76ba42572dde61870515cede77dfc524805beb9dbea2d84d01622b114aa0dd60f77cbce1878f40a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357732, "uuid": "63ee770d-6a40-4db9-83b3-42151d5962f5", "value": "T12F1633D9DA87710EC2C8E23BCDA9DD3BED2E9211C068CC51757244B95CED4D88992ECE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357732, "uuid": "6b7cb22f-3039-4333-ba78-50d772034ce0", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357732, "uuid": "49ad554c-090f-4be1-88ca-ed472337c713", "value": "98304:m5OXL6rIQ5PklAqxpP1+L4ZULXiP2AolgM2gkHhvv9BJL:rb6MQtkusc8ZsiLolgMAH91Bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647357732, "uuid": "3b691a89-af89-44fe-8f43-4f8fb80a3775", "value": 4058360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647357732, "uuid": "943502df-e393-4cde-946c-c2a9f36bac5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357732, "uuid": "2d897bba-f9df-4527-8e55-e9ebdc90b9b8", "value": "raccoon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13652726-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647354463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354463, "uuid": "d7fba2fd-2991-4062-9ce6-3506089f3498", "comment": "Malware payload", "value": "8cad5fae1a610580120f0789c5888df8", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354463, "uuid": "d8ba4733-83c6-4feb-9796-08de45776b59", "comment": "Malware payload", "value": "449888a9bd8efbfe0f9c15965882d3ea50fec4a124bc7fd603ac16956289a16c", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354463, "uuid": "f8c998df-195e-4f26-9c0c-b92b96c4d657", "comment": "Malware payload", "value": "9fed205b9f439df25e8fe5f7aa3adbda6301edf7", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354463, "uuid": "eab55c33-78b6-494e-9eb5-e9ef7257d940", "comment": "Malware payload", "value": "69b370af6087fc030ea1d723270eb5a8bdf8aac30c556f10633c76ebb91e3f22633b37b2c079338779441fb318ef23db", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354463, "uuid": "08a59d60-0470-429d-a9c0-6a4df05ca2b8", "value": "T16A512AF47737D3D8C0D1445CC5645D8307A2F30DE28AEE48A3D6F140BA8225FA31A2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354463, "uuid": "1edf0071-9a61-49c3-8a9c-938dc131c2bf", "value": "48:1IaWpka13mshMhDIFD1BCfT8FvLEfooBVCOJhY1aoOc7/tocCKCVVYW/:Ps27ICTcLEAsVCOJhOa8HbC7YC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354463, "uuid": "7147074c-68ac-4006-8be8-3eda1910989f", "value": 2452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354463, "uuid": "7b7c0e0c-cc92-433c-94c1-7df84202858c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354463, "uuid": "a6f500f7-6e54-4297-9a69-21a6568e1013", "value": "Uq6uX3Ex.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f588a7-a49c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647375162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375162, "uuid": "31266bdd-2cfb-4b5e-baa4-9575624a1bdf", "comment": "Malware payload", "value": "b4baad8a392da0697cf1ce5b90a1fde6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375162, "uuid": "5172e9ad-4794-473a-93dc-34d3d18ad81a", "comment": "Malware payload", "value": "451a50b8bf2ba4291cd0f9c654ddfc04e46d4b7e2e340d14205003b7fa4467d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375162, "uuid": "b38f3add-8d14-4b0d-b3d0-9ffebced6fac", "comment": "Malware payload", "value": "bfe67e573ed7ed07e7f4f5811b35389a4a00d40f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375162, "uuid": "c98a4e6e-9f2e-4431-acca-4ad04a099be9", "comment": "Malware payload", "value": "a421324eeb6f0d7977830af92135ba76ddd80daeb1a9c81361afc09d5174ba4e29ab6fd5bdf9a9d494fb318e86046d38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375162, "uuid": "3b7fd36e-18e3-4c31-801b-27edf3408efb", "value": "T1F6E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375162, "uuid": "250233f7-f19a-4d7b-b4f0-492a42d0f3c2", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375162, "uuid": "d4b387b8-05de-4c66-9ddc-3e1f2ec6147e", "value": "12288:E94YBCR2xP7guDo463OP4eWsiSOZjb2woE+MhJT:2kRAguDogPaddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647375162, "uuid": "a7d53771-a50e-455f-bdbe-71234e355130", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647375162, "uuid": "d25661dd-c1d4-4dad-9a9a-806c18a959a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375162, "uuid": "2e72d2dc-853b-46cd-9598-558b09ccf663", "value": "b4baad8a392da0697cf1ce5b90a1fde6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2894994-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353468, "uuid": "9f089a34-8147-4556-8c85-2515d16d7f99", "comment": "Malware payload (Formbook)", "value": "f8f334c981f15d1d6d6393cb353e5a4f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353468, "uuid": "7a4271b2-7f3b-4b34-9779-f6fd34c349a5", "comment": "Malware payload (Formbook)", "value": "452478db84817f954926bd0d13cb3313e7a6b377c40176ac1a41fb9775b0bf43", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353468, "uuid": "1fbc821c-7425-4913-9ec7-06c1005ef492", "comment": "Malware payload (Formbook)", "value": "a38ddfe03787f9d7838f6262b5c7582613cf36f5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353468, "uuid": "e7ee4c7b-4720-4d57-859c-044896e89392", "comment": "Malware payload (Formbook)", "value": "fedb505c4b454f2b38de47d1a4270c787f7d4c78c7b79f112edf820ef132fec32cf2c715d322691171779774912e1799", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353468, "uuid": "9e9648ea-9b08-44c1-81fa-3120226257c5", "value": "T1E91402897DFAED84F5BBBD3E0EA2C131C52EDE078D1D601A7643FA64B03AD617641212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353468, "uuid": "e725d9a0-309f-4f40-a73f-a404abfba71e", "value": "3072:/Vb3YBTojzfUekod0x4Yuy2Q88/jfVWs83b/SoI/AyF8IQfk7DqTgDxWActrqXiw:ljzNdYuyr88/TVpMb/IrF8VkD4Ac0Xiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353468, "uuid": "64f8ac44-190b-4211-ad5e-0f2422cb3d8d", "value": 190360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353468, "uuid": "58eadb9f-4db7-4082-bc7e-fd3b7f1c2d2f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353468, "uuid": "7819e995-22ed-44bc-a294-688da0f8ce5b", "value": "BANK_STATEMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ea65b7-a451-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647343171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343171, "uuid": "567c4aa1-d777-4bf4-80c0-85b8ab943aa7", "comment": "Malware payload (Heodo)", "value": "dd6c673eba896d985d9a8343c6773d6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343171, "uuid": "80e32885-c42f-4a8b-a33e-7ba73566aa3d", "comment": "Malware payload (Heodo)", "value": "4547ff21c5b35e53fa3ef4eaf73b97ad90cc66f838c730173d94676c66ce85ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343171, "uuid": "3cc0301f-5d41-420d-92e1-13629442ff5f", "comment": "Malware payload (Heodo)", "value": "613fa7140b036db44ba6fbfebf0765670cc34767", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343171, "uuid": "d4e945f6-d688-4cf8-aa1c-62c0655eca6b", "comment": "Malware payload (Heodo)", "value": "3c0d2a09c70417adb09b98cba689a50a5c9a088022627cffece64785740e13fa5baa0e039940d058312ad9b408e20ca8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343171, "uuid": "34287608-cef3-4570-a1b8-3602ec69d6fd", "value": "T1E1257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343171, "uuid": "3fe5c158-4809-4f12-84b0-1a632ddc179e", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343171, "uuid": "97fda983-8a1c-4841-a6b9-419341e594d6", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlSOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8yl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647343171, "uuid": "5c071c61-2593-4369-8a80-ae1e022d8ad1", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647343171, "uuid": "ee98f2d2-b6ee-487a-9407-79999d6995af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343171, "uuid": "33a20e0f-0e41-4041-8cc1-9d84a4987f78", "value": "9uXBIMLmWuiAP2fDg1f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83462261-a466-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352073, "uuid": "29b5da32-8919-49e5-87bf-d9cfc2ee2c11", "comment": "Malware payload", "value": "b3160ffbc66e602a5158316fffac6fdd", "object_relation": "md5", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352073, "uuid": "cb8f1ee9-7579-4698-931f-ca6f1e8bbc38", "comment": "Malware payload", "value": "4572ed1a6d5c262254e2a05107f1f4e7a885772349e67dd45c8491a090e1bf32", "object_relation": "sha256", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352073, "uuid": "5f8af4e6-cc6a-4a57-a1fa-db1088fdb79a", "comment": "Malware payload", "value": "923c17017857269f147cfae4b72d5489e49208c7", "object_relation": "sha1", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352073, "uuid": "f44c8718-a00a-44f2-81ab-071dd5733f10", "comment": "Malware payload", "value": "f009c4ace1f64dd76128ea70ff563cc2219603b680a115837d6e74c725229eed1a1a64f7cb63ef089cdba42a063124cd", "object_relation": "sha3-384", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352073, "uuid": "a26dfe26-9b10-40a4-9466-38c35d6c7052", "value": "T1C1428D69C59A6823D673727856797CC0F08C0EC39540EBCC7009ABC666563E4AB53E66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352073, "uuid": "fcd5dd55-358d-442e-9c9f-4c1ae9798fe8", "value": "192:Q86oNmvOJ2wc3rMKkTPukcx118H111M05AgPekKiD2h0vUsaaa0a:Q86tvIhTuHgH111/eVuhvUsDa0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352073, "uuid": "c0c18521-af83-4ac6-ad62-a1e5eab5f04f", "value": 12300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352073, "uuid": "6ecd8069-edad-4803-871f-7983e75c4ae2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352073, "uuid": "37f8e3eb-d687-4676-a241-4eea2beacfb7", "value": "200712005_Sep2019.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107851ea-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353599, "uuid": "fa7830e1-52b5-40b4-930c-1ed60cc4eb57", "comment": "Malware payload (Formbook)", "value": "61f99443ac801b8b314d9b1a796c6eeb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353599, "uuid": "cd13be64-1804-40f4-8862-719f1b1164b0", "comment": "Malware payload (Formbook)", "value": "45e57d3e261d0c12d3a1d29e157c44f6ba06dae3559798afe059d1c50930f640", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353599, "uuid": "89fa7906-cd4a-4002-9fe1-8b3963701297", "comment": "Malware payload (Formbook)", "value": "792079368adf072410a41754a3bd4715c1bd8858", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353599, "uuid": "daf5cbf7-65c5-4bab-a469-17a0ee855d9e", "comment": "Malware payload (Formbook)", "value": "243c8b453c2e625416b77cff23931bf320fc332d9b5b485a3016ef1c011fc0662ef79cd157caa3e752436948bccb2a4a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353599, "uuid": "0571aaa4-db32-48e5-94c1-b81f6275a56e", "value": "T1C31412A976490A8AEA544FF4A1C8A4C6BBCFAD10D930173233E4776C5F7AE2F14D0360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353599, "uuid": "f028070d-5fb9-4512-9585-f998bd21a099", "value": "3072:YaBp0EWFVCFuzwF51gXmJLScwoCPhegRZPZQ4GelB/3KsaSHaaIAlu9j1JMkLnpg:jwEW3CF+wNKcwoCZhRZxdRlN3OAQJJMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353599, "uuid": "9cad7796-90ce-4a49-9dd8-76c94bc78466", "value": 191384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353599, "uuid": "62269f18-8a74-468c-b676-43519cbe4246", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353599, "uuid": "ba951e38-ba5b-44f7-9ff9-bda8ff524468", "value": "NEW ORDER LIST.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25701786-a428-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1647325287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647325287, "uuid": "952c39f7-0db5-437e-854c-0ad68249c26f", "comment": "Malware payload (NetWire)", "value": "4275713c47a8448a5f8a131775cf5c8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647325287, "uuid": "23806e73-2933-4165-8c5a-759bc9786053", "comment": "Malware payload (NetWire)", "value": "45fd025d4d7964439d08a932823955f802f0e3932bcc8ed7d5db13b565007e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647325287, "uuid": "fb97e06d-fe9c-49fd-b100-c70bb3431659", "comment": "Malware payload (NetWire)", "value": "1aba0c8cbee90cc655ccf8a0bdadf6ba6c961bce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647325287, "uuid": "ea2ab27f-71f4-47f9-b772-d466f4a6d552", "comment": "Malware payload (NetWire)", "value": "b1f37339a27291251d2ed318de4e6533f35fe1c206465df9b23cdcec3e7d71debb23b6792a6f9574246b45c6feea5661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647325287, "uuid": "a788cf0a-b896-4fb8-a63c-0fd2d83ae4d9", "value": "T1A794DF629982E95ACD25C874D52BD7F5936A2C0DCD4263070326FC5A37FF2E3C96A407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647325287, "uuid": "be64d8b8-69ab-41dc-84d2-ac7fcbca3425", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647325287, "uuid": "31d89451-2790-406c-9582-ac566f7760b6", "value": "6144:JGimzhkas0173Jb0qL4nbiRZaKMfmZjrDaQZ1YtSxb96NjJiZECIh:y173SEabizaKQir+Mwib96NcE1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647325287, "uuid": "acca668d-9082-4631-a580-38f2b94e6688", "value": 426978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647325287, "uuid": "5871140c-7af7-43cf-ad67-50e8cf22a1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647325287, "uuid": "d6ae29af-e12f-45ae-b9f2-d193937bfe10", "value": "imegess.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e452d3-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353284, "uuid": "76a2edec-e5c5-4a08-b3d7-cdb79e7b46aa", "comment": "Malware payload (Heodo)", "value": "9f3de32b1c095a5385f3a199c6eb4bf1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353284, "uuid": "8aeb8cb2-f672-49b4-97bd-24796d327dad", "comment": "Malware payload (Heodo)", "value": "46d12a41021284d5c0f383bba52e00dc45999cea530095545dd77dc174bc68d9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353284, "uuid": "cd6c86c8-6cd3-4a7d-b4ca-9ad81e8ddfb0", "comment": "Malware payload (Heodo)", "value": "d4fbb8e3c4571a4115263e799dee0f356137c660", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353284, "uuid": "5b50495a-b59e-4515-840a-4bd977b116c5", "comment": "Malware payload (Heodo)", "value": "8b05153cf4f89f8fb6bd9d7b9eb1c4e9b039d3b38fe6f811aa94fa95ec0d655baba7761f52a9d7a81fc875a418ea6112", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353284, "uuid": "cc20574c-fdcf-4e9b-b505-ad243b76ff4f", "value": "T15533D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353284, "uuid": "bc81c602-29b5-42ce-9abd-cb15365d609a", "value": "1536:IAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:xcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353284, "uuid": "4a53107a-2b57-45d4-8cf9-96cee8adfa12", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353284, "uuid": "7af2e164-40e8-423e-a4fa-d7d08058f8e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353284, "uuid": "628766b2-7e23-4e3d-bf02-d9e969a135a4", "value": "Insight Medical Publishing.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd438068-a462-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647350506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350506, "uuid": "68b49bb7-47c8-4386-b76a-ac65b2b1aa0d", "comment": "Malware payload (RedLineStealer)", "value": "b9b573643e3ebfd3b2ad5a9c086eb71d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350506, "uuid": "0d1b8a25-a513-4df3-a920-01a6a16fe233", "comment": "Malware payload (RedLineStealer)", "value": "46f52f9d3e5a836fa62d821aec8408e8110138496fdcd445be79a95b30a07557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350506, "uuid": "97e1c2bf-d0c3-4d68-8694-596141e3d5cb", "comment": "Malware payload (RedLineStealer)", "value": "7496bc83c0414e7f57912f8d8db81a3d48f313cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350506, "uuid": "ec6731de-a395-4664-9a41-2a59f43fb2ce", "comment": "Malware payload (RedLineStealer)", "value": "388ff03c7c03064f7f135b27f56490c4e0cf39cdd5aeb6fc7e6f6c15234ce8616a7b17a205bafd32f2bac26dc8b09d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350506, "uuid": "d4de9adf-4cfd-4299-ba96-1cff14c16eec", "value": "T1CA1633E69311692A855ED7F648F01D5F35F14B0F1EE06A69C0F9E1520A489E8B3FCB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350506, "uuid": "65b7ed50-63ed-4f55-a248-e5a59011e821", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350506, "uuid": "0c1db757-cdeb-4666-a15b-2f5c4469f4c2", "value": "98304:r5wk8XfIcaUnm/ZT1tZKrUoDwmeluzgAg98cgK37SZB0:r5lKI7/ZZKrUoDRzc9bglZB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647350506, "uuid": "2367df62-d39f-466c-9a0c-8d4fc30910bd", "value": 4164608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647350506, "uuid": "c7000422-1948-4799-9ccb-e0ead734098e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350506, "uuid": "a6b5a8f9-b90f-4cb7-a7d9-6c555d4da08f", "value": "46f52f9d3e5a836fa62d821aec8408e8110138496fdcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0358b66-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "725226b5-099d-42b9-b5be-aa224f5ce2e0", "comment": "Malware payload (Heodo)", "value": "0d4a25c046960bf879e29aa2d5ba7771", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "1f61e066-6a3a-4e4c-8166-edcb1093b13b", "comment": "Malware payload (Heodo)", "value": "475384e2e3abaaa72ff8690b4e5d5444348b2c0f9b32b84f28cf57eca5034053", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "bff70c7a-75c5-4df9-961f-dc349a9a9bf7", "comment": "Malware payload (Heodo)", "value": "26a52466a582d670c8daa6c327dde4422ff80668", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "525d0638-3330-47a2-b871-6deacd1923fa", "comment": "Malware payload (Heodo)", "value": "6a694a5d92c9b0c841a462c9de60d8b6b15dcc8cec2c75efc5016986e9aaafa84d9e949a196080220142e1ce2146d5af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "66c21238-9de2-41ef-bf66-30d3100be583", "value": "T181256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "7d0304cc-f21a-45e4-94b7-63aa18938a62", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "d0d485d5-9ea4-46e0-b71d-246b1f86ffcb", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1AWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6SWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302837, "uuid": "a6e85334-303f-4c55-9a1e-490e03ba93db", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302837, "uuid": "94417785-100e-4b5e-ae4e-f66f249a51e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "56646f9f-84c9-447b-b9f2-2a650df8707a", "value": "emotet_exe_e5_475384e2e3abaaa72ff8690b4e5d5444348b2c0f9b32b84f28cf57eca5034053_2022-03-15__000707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40bbae5-a48c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647368449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368449, "uuid": "a3009a7b-3fb1-4665-9e88-168897db6f53", "comment": "Malware payload (Heodo)", "value": "b281aafaf4119f90308f6c69b67dea77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368449, "uuid": "85569ead-1c21-4754-b45c-1304876db844", "comment": "Malware payload (Heodo)", "value": "47684478528c73d0f4ebdf6699ff2656a56e0063ab641775ae96ebe751c4ca0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368449, "uuid": "e3f4a5f9-04a8-452c-9452-48b3aeff9da7", "comment": "Malware payload (Heodo)", "value": "9bb76e6469d0b923b06c1ab426ec2ca75a244177", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368449, "uuid": "56028283-7750-495e-b792-20c77e2536a6", "comment": "Malware payload (Heodo)", "value": "c1390cef8d15c0ce78476b01b07d077e5d338fa18122fe8b04e316efde3e8415161500d584f5634231a92452b129e533", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368449, "uuid": "0ba7816a-eed1-40ab-8866-0d8730ae4feb", "value": "T1D4257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368449, "uuid": "c8f15397-e7ea-4469-bb2c-f5f0bcc97c1e", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368449, "uuid": "e33c4178-80dc-4f56-8f55-1056b4728ba0", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYfVP6FuR6shQLj88F+Krf6:v6oycln8cACi+P68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647368449, "uuid": "a4e9fa38-e67a-41eb-bbce-8dd3d33d5646", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647368449, "uuid": "ea2c9f8f-7917-4d9f-9465-2930564d9fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368449, "uuid": "750591ce-9418-4ef5-823d-54ff270f7236", "value": "b281aafaf4119f90308f6c69b67dea77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516d4d8d-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353278, "uuid": "77135f2e-a44e-4213-995e-4224d4b54e0d", "comment": "Malware payload (Heodo)", "value": "61dd67f1b21e9885be8ac6ab6100b7ef", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353278, "uuid": "3b176daf-2a41-47b6-930d-0abdb972877e", "comment": "Malware payload (Heodo)", "value": "478f4d860b09500c5c08223cd0504ab063f02ced3d5d9905f3bd5538bf15266c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353278, "uuid": "e9afc7e9-c579-4087-a83f-fd0815cb8492", "comment": "Malware payload (Heodo)", "value": "426d9d4da54db90c90274812bde683e61c856199", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353278, "uuid": "55536164-13cd-4c5d-86e7-1b6b281ed698", "comment": "Malware payload (Heodo)", "value": "38950aeca1a550925df9d5ad4c9e217c619b7e6b85501e0156ec870a257bea8585572f56868703dc677484fdf460cb01", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353278, "uuid": "ed78574c-efb3-4baa-8b19-8fe98903e72e", "value": "T12033D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353278, "uuid": "253c6539-5927-49d6-8655-e91def2baeeb", "value": "1536:EAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:tcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353278, "uuid": "73732754-ec92-4892-95da-5aa5e9afce9b", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353278, "uuid": "499aab01-0ee8-4d26-adee-c72aedfc1280", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353278, "uuid": "493244f9-3969-44d9-b4f2-8f6b85278f5e", "value": "Insight Medical Publishing_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08ae239-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "ca3a988a-ef06-4432-bd5d-781a4ea16233", "comment": "Malware payload (Heodo)", "value": "2e4f50da4cf3718b4089ca0f400c0f54", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "9dfed978-7ec1-43eb-bef9-4f92e4aafd76", "comment": "Malware payload (Heodo)", "value": "479c7335db275f42bd640790ffe41568491f978c6611f5821c40d5e5c7baa951", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "6bf15426-6d83-457f-ac00-703e6134f996", "comment": "Malware payload (Heodo)", "value": "4f491663d21f9748f8d03a0d0005a7447ae5bac2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "4338bc1c-acb1-4479-a6c3-8788425cdf18", "comment": "Malware payload (Heodo)", "value": "5bf1015863b18333033c465176ad0d2514fa0b72099390b3c5ba14da1b55d6d6cd627784f255f056a62eec45be3cc1fa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "c71626c5-f499-4713-af05-5bee0cef7038", "value": "T180256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "c8d69716-1df7-41f8-895a-b6dd1fb786ef", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "dbe439fb-825e-4493-827b-b5cf50ca8833", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1NWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6TWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302838, "uuid": "f9ae4f98-dc47-4af9-bb72-56cf53e96858", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302838, "uuid": "622d5310-e7ab-47fe-8e09-6c2df0d3a960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "52485092-f018-438e-9288-2ffa5b495b5c", "value": "emotet_exe_e5_479c7335db275f42bd640790ffe41568491f978c6611f5821c40d5e5c7baa951_2022-03-15__000708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cbc198-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333790, "uuid": "8e758a26-a28d-4551-a34e-4c77f07743cd", "comment": "Malware payload (Heodo)", "value": "71918b3b6fb18c09f614895a5b4f7794", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333790, "uuid": "8c1c2fd2-6c79-4333-8371-08df9b20742a", "comment": "Malware payload (Heodo)", "value": "479f32a4e7d7263d6325f12ab058c586161c5d5f4b584bfe2a90c1f70724041a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333790, "uuid": "3f0f60a9-49dc-494f-a501-183507155ca3", "comment": "Malware payload (Heodo)", "value": "94546ebbd4ce443d1a5804fcf039a2c19d403718", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333790, "uuid": "7f01cf7d-acbe-4bd7-945a-0bea55cfd588", "comment": "Malware payload (Heodo)", "value": "8a047f133c12f6847fb557267255fd1e6971fc95656399e2ee28d5af5238800046ad9e2821827bebb3175208047814a3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333790, "uuid": "70e2c4c8-4911-4ae4-93f9-a4251d960b9e", "value": "T17273E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333790, "uuid": "5439053d-b005-40ef-9f9e-b1bf34ee35fa", "value": "1536:2uSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:QtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333790, "uuid": "132e0c78-2602-44ad-84a0-76ab098efa36", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333790, "uuid": "7a01cb89-2f43-4ea3-9f9b-c208f8e3fa30", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333790, "uuid": "66c32f68-4a3b-47d9-b574-75dfa8fe7344", "value": "imedpub.com_8.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b1b598-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333800, "uuid": "41f219dd-9dc6-46e8-b264-8b0a0f046d59", "comment": "Malware payload (Heodo)", "value": "c3387164da681b8d3033401c65d41c5a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333800, "uuid": "fc6627a9-776b-4418-9300-0bc0c7e54fdc", "comment": "Malware payload (Heodo)", "value": "48154bc734f67a19e7676e098cfbf04d58e0853c070d66d671fd5486e833d91e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333800, "uuid": "fd170125-d5c7-4bf7-a51e-6bce17ea8fc5", "comment": "Malware payload (Heodo)", "value": "24d13efa02c90de3f45bc6670f166ea995de5f43", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333800, "uuid": "897e115b-f8a7-4667-b008-85c9f4c86955", "comment": "Malware payload (Heodo)", "value": "19ef1312af624357960e73ff874a3c7c59d56172cedc3916eb7e210010b2f55f442c3a6d0aea21cb23b2f832ddc4db7f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333800, "uuid": "69533f42-723d-493c-9147-def93aadaa0f", "value": "T12B73E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333800, "uuid": "29943ce6-db75-485c-8228-5077a1580175", "value": "1536:muSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:gtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333800, "uuid": "71ba6045-eefa-4c88-81e6-791f569e437e", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333800, "uuid": "e35af979-5f99-4fbb-ad45-8e48ebe0c84e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333800, "uuid": "7b9e1532-b443-45d6-9941-fe07944f9868", "value": "imedpub.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb4665c-a449-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647339825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339825, "uuid": "09503491-e076-44ad-8234-582cd3682983", "comment": "Malware payload (Heodo)", "value": "0936726e6291eadbca094d69f101be6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339825, "uuid": "0c0a5e58-b26a-4b84-845f-462ef7527d5a", "comment": "Malware payload (Heodo)", "value": "4836d1a688da82ff442062fbaffea4cdb71ea98a75788802625e1c694a328b30", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339825, "uuid": "77661e62-6a4c-43b9-90d3-56af27b45cac", "comment": "Malware payload (Heodo)", "value": "63d8aec34c768cdd38dd50495e471a1c48dc1c57", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339825, "uuid": "380cd40a-6c3b-4f0d-8293-444fa6ab4c8f", "comment": "Malware payload (Heodo)", "value": "12892ab27cd2347cc7d069b4e03f0c2d835ecdcb6858fb03547815ef1c240ed27c121187034ed049a355a099e5aa0f5a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339825, "uuid": "99f9057d-e172-404f-8dc9-b9974b235b8f", "value": "T1D1540A03E58E437CC85F94BA82AB723A28A7C87D0771D99BC3D46CD477248E1993EE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339825, "uuid": "af359802-ba36-4900-850e-4d2915162bff", "value": "3072:/oFqSxNTXh/5DaNaKUQA799Q6i7gLifbvYI2MEeFqjOcmKpBgJjdgGNE:AFFTxx+67O7tB2MEcqCZo+fgGNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647339825, "uuid": "888d34b2-1c35-4b70-b490-e1dfd27a8bc0", "value": 300645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647339825, "uuid": "4ee3ba10-ebfd-4071-90f8-6d00b7a185e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339825, "uuid": "2b0135f1-f741-4a9d-bd2d-2fbf18b3f833", "value": "emotet_exe_e4_4836d1a688da82ff442062fbaffea4cdb71ea98a75788802625e1c694a328b30_2022-03-15__102341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5b3047-a4ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647383202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383202, "uuid": "49be1226-9172-4a4d-b0ea-072416ff913d", "comment": "Malware payload", "value": "7219b610dd368473e71284f7c864c2de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383202, "uuid": "96146d91-944b-4edf-88be-9cb5aea621c0", "comment": "Malware payload", "value": "484eff2e8db42dd54c76249b0be1bfcc5933d4efd27f790819899c2e8cda775d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383202, "uuid": "7b52a7fb-f527-4aa7-a09c-f25cc74b6205", "comment": "Malware payload", "value": "e01f0396207fd950fb7b1e813dbe6a42be587872", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383202, "uuid": "67d17a66-bf1d-493c-a6c2-9c6155eca27a", "comment": "Malware payload", "value": "d17ffc175b7f80bd6759b1a9cdacebbd8ebdbd00622da666e722f3285a1bc4dc4349bd461207cbf217c3935cff5e12bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383202, "uuid": "6d8ce0be-6885-424f-b1f5-4d52fe4ce95e", "value": "T1F6722D856E329FEDF669C63047B34A2067A8339523F1D684E75DD9041FA030DA16FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383202, "uuid": "18c18808-623e-472d-8177-cce5ae80b081", "value": "192:MlFhz0UdA/MjAj6krAw9tOWlzznijf08pBYQK6bsBW8g7gpXyJvVHk2dOX:60UdA/MjA2kUw9t75JObD1iiJvVHFwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647383202, "uuid": "d472534a-d351-4834-ade7-6c64678ba81e", "value": 16564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647383202, "uuid": "7a316cab-f81f-4b60-855d-ca5ca103d478", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383202, "uuid": "d93347ac-f8d7-4a47-bb62-f25d109cef4a", "value": "Ugliest.mips-20220315-2226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dae8465-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326187, "uuid": "b47cf3fe-7f46-4bf2-9edc-c1a2dcca7912", "comment": "Malware payload (Mirai)", "value": "33fad2920596a3849aa8eb9d11898056", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326187, "uuid": "5b89f3ac-5daa-408b-91aa-33202f0592e8", "comment": "Malware payload (Mirai)", "value": "489df703a146b008e880d2bad42e8e076f8e22f72dea97817e8c5f01aa6640b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326187, "uuid": "26a1137e-32ba-472a-9e3c-2e39efe074f3", "comment": "Malware payload (Mirai)", "value": "bb554fc97c5a491afe930275e3c895fd04b6d522", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326187, "uuid": "3a75fb3b-e2b7-405d-85ba-1384b4b92b2a", "comment": "Malware payload (Mirai)", "value": "b17d91d2bb0cd250d9a1082545729051821cc8ad273b7d293d6e1fb9a16feb0d16425e186ebd26993c2210f6b6259ea6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326187, "uuid": "f9c1d159-538b-4bba-b470-79dc2d4a61d3", "value": "T1F853E781BC41A629C7D01777FE9F559E3710A3C9D2EA32538C240BA07A8F94B0D67F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326187, "uuid": "b2e0ff2e-55c7-4fbb-9583-1ac8d4d37efb", "value": "1536:4JvgTS8OsLHv8yBSD3SievsVYa33eZtMozGz:yvgTNOsLHNoyvL63wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326187, "uuid": "8572f42a-cf90-422d-b51a-1c2bf4836bfa", "value": 62904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326187, "uuid": "e459ee0a-0940-4b88-beaa-db0915dee22c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326187, "uuid": "8a06ea21-3cb4-4ca2-8964-53c244203173", "value": "33fad2920596a3849aa8eb9d11898056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0d7b53-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353269, "uuid": "ce9a509d-8274-466d-bf36-f9edff9092ce", "comment": "Malware payload (Heodo)", "value": "d3d8aad36f98687cc8fa069fb4bcaa68", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353269, "uuid": "3a20714a-b750-429c-ade6-cbce64c3d2bb", "comment": "Malware payload (Heodo)", "value": "497a28ce2c3b7188c118ae11ae74164355ce8c871d57593dc87b7abb82dc2d53", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353269, "uuid": "208f63c4-3ed9-446f-8fe1-8ce92f331a19", "comment": "Malware payload (Heodo)", "value": "fb45d29b2f3f72baf16cd33681807b503fc42fea", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353269, "uuid": "8683427c-e440-4451-bee2-839daf5b912d", "comment": "Malware payload (Heodo)", "value": "107fb39a0ee4be7848f2ac76b0fd02ab8e07c57ebd77045f240f196f3624465cddb27563bc682e525081a1d6f3492e30", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353269, "uuid": "e6d9a0ba-83c4-4a44-9ee2-8ca19fc04bef", "value": "T13D33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353269, "uuid": "ae363d6b-5f8c-4129-8d14-e54ed1d9f800", "value": "1536:UAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:9cEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353269, "uuid": "8dafc551-6f89-403e-baa0-cf5ca59591ee", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353269, "uuid": "a3e2de2c-04b9-4b3a-80d8-a9348b032009", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353269, "uuid": "1c3ff872-6812-4651-a04b-ed518f917407", "value": "iMedPub LTD_3.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f584448-a46d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647354939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354939, "uuid": "cd62ae12-d199-425a-9770-4cda27113490", "comment": "Malware payload (Heodo)", "value": "31a51ecf63ab141b1b16ca723c8b1f02", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354939, "uuid": "758f86a9-69ed-4850-854f-5a8942ff8389", "comment": "Malware payload (Heodo)", "value": "49a9f5d28e778291cce23acfdb82dfdb4104c4b83c6db4fab6d12895f2331c52", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354939, "uuid": "6e64f0bc-eced-4e20-a376-782628110bd5", "comment": "Malware payload (Heodo)", "value": "4f874d737fa48e67dc345c12237639e5ddf198dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354939, "uuid": "217baf37-538c-4fbf-a9cb-bcc2e5e11d57", "comment": "Malware payload (Heodo)", "value": "410becf0a1dc8a3a48f83cfb7401ecdfe6ef2768bc14bbd1faa4a550ff08dc43170fb5255dc5b7f4e11a7ece7f57d1ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354939, "uuid": "28b7bc37-5fb4-42b0-b595-00f29903492e", "value": "T15B257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354939, "uuid": "a3bfccc3-c2be-42e6-a70c-3460a995e5e4", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354939, "uuid": "d0a4f666-6725-4b95-9e78-2cc1f416580f", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYAVP6FuR6shQLj88F+Krf6:v6oycln8cACijP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354939, "uuid": "884fa27b-154f-4ebe-99d1-437916e65186", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354939, "uuid": "1ca865ce-6f58-4d68-82ce-8e0050274383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354939, "uuid": "d3c2e8e7-0aad-4ff8-a0ed-fd80bd3ab641", "value": "rJPRQeeV0FeSnbuUs0O5R2qGvnemuAwRk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ddd1a1-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647348970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348970, "uuid": "e1c25bb5-7bf8-43a4-bf26-4ee0073f31ff", "comment": "Malware payload (Heodo)", "value": "8644c4b9b3df8ca5ff36ca5809b7735f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348970, "uuid": "4a889e6a-a9c1-4332-8749-6bc98f95fa4e", "comment": "Malware payload (Heodo)", "value": "4a5c408513e4adff262f6df973071bf14098fb7a37e34e27f92c8ca668347214", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348970, "uuid": "07ab11a3-b86b-4544-9667-18a8c8d5faaa", "comment": "Malware payload (Heodo)", "value": "32ef38bcb5a8944602bbd383b5bc2f9404cfab65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348970, "uuid": "490525a0-d6bf-4ff8-a4a8-9577c44a6fbd", "comment": "Malware payload (Heodo)", "value": "c7e1a5e19e2d69efb7177eb04ecc5882b409502382251cd5cd49b3903639c314936456d7d5405cd9a92e5419508d3d64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348970, "uuid": "ed41847e-4dbd-4762-b0a3-1e181f691ffd", "value": "T109257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348970, "uuid": "0c8a7533-8f8a-4aaf-a9b3-152735e23297", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348970, "uuid": "8148051d-c73d-4406-9d3f-184bc6971a07", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYUVP6FuR6shQLj88F+Krf6:v6oycln8cACiTP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647348970, "uuid": "09ca7771-7a6d-4805-9073-cfebd8aaf52f", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647348970, "uuid": "7766b028-ecc4-4d49-94a6-4fcd130932a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348970, "uuid": "d021e1c6-9fe6-4e4a-b5d7-5a7dcc8304cd", "value": "8644c4b9b3df8ca5ff36ca5809b7735f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803bf490-a436-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647331452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331452, "uuid": "7860f146-8b1d-4d0f-822b-e4b3b355e586", "comment": "Malware payload", "value": "6cef87a6ffb254bfeb61372d24e1970a", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331452, "uuid": "e6b8a500-f75f-44ef-b502-61b26e8c2abd", "comment": "Malware payload", "value": "4b2862a1665a62706f88304406b071a5c9a6b3093daadc073e174ac6d493f26c", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331452, "uuid": "3faa2fe0-6464-4a9e-bb98-35559bb38811", "comment": "Malware payload", "value": "e21d95b648944ad2287c6bc01fcc12b05530e455", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331452, "uuid": "6640d269-dffc-43fa-82c7-e22ceddc177b", "comment": "Malware payload", "value": "db31ebc533ad4965b3ee1f4eb6bbeadf1f7cb11ea621cc9380cb3c870a16304eb6527769a5fa1c258f017a5c2288f42f", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331452, "uuid": "955cef32-bec3-49b0-8773-1c674edd2629", "value": "T1D744B0B07591C446F5690F3359E7E5A8B3217D56FE8B4B0F3050BB6C2EBAA80DE0548B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331452, "uuid": "52369ac7-3a65-4a2c-9dc0-d1b93bf90c53", "value": "6144:8k3hOdsylKlgryzc4bNhZF+E+W2knArYi4uU4pVZ8lx+tSea4awSi:PiLZpVZ8lx+tna4TZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647331452, "uuid": "5579469c-2f99-4413-a352-23e1d725c0e4", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647331452, "uuid": "40986f81-1605-424c-a7c7-ad11f0a74a48", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331452, "uuid": "0ea4587a-6844-4f92-af0e-224bf54c27ae", "value": "ZaibCb15Ak.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02f15cc-a48c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647368443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368443, "uuid": "8bd005f9-4e40-4847-b59d-1ca868ca585b", "comment": "Malware payload (Heodo)", "value": "ca74f99c64c191eff86a5a4d6c0ebd33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368443, "uuid": "fb1cc447-87b3-4f75-9a60-c695c9929341", "comment": "Malware payload (Heodo)", "value": "4bb1cc1b94e7a65012dac2dbbeec7a64e6abd9f3115686ebf598e35c5b47f562", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368443, "uuid": "1949c3a1-2f41-4e00-8e18-b21789c996b9", "comment": "Malware payload (Heodo)", "value": "93f1930a3e2da94f483efda49a853e2704f708d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368443, "uuid": "ab4f2ba8-6323-40d5-b9d9-14ede973cdff", "comment": "Malware payload (Heodo)", "value": "83ec2a1f4d8b6fc658899d6f681f2f0d91cd6fecaffe0bc0848a7ca51fd533872c959f136a23e380657efeee0e6e38f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368443, "uuid": "b6bf695a-04df-4bb0-8541-0ecd6f64f5dd", "value": "T1BB257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368443, "uuid": "3f4b7718-7451-45ea-a59b-0e4adf97e219", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368443, "uuid": "982c4949-4c2d-4f11-97f9-f12df8294546", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYWVP6FuR6shQLj88F+Krf6:v6oycln8cACixP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647368443, "uuid": "5e89f64f-f468-475d-84d0-876d08857744", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647368443, "uuid": "8510051a-1e2f-4c7b-89ac-ad4f9352fe8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368443, "uuid": "ad5f3afc-4e42-47cb-9974-c44ba24aeae4", "value": "ca74f99c64c191eff86a5a4d6c0ebd33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7605b33-a49d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647375890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375890, "uuid": "d652e0d8-90a8-4695-be32-3a6b0f027bcf", "comment": "Malware payload", "value": "ff424f2be05bcb30c52c4d75d6346d3e", "object_relation": "md5", "Tag": [ { "name": ".XLSB", "colour": "#CD7F8F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375890, "uuid": "85790f14-2967-4043-8084-f8245ba4e12f", "comment": "Malware payload", "value": "4bc32daf9d52bda4452f18c4b84cc0d8b6bdd8a49e3639057a1f6b56eed84b50", "object_relation": "sha256", "Tag": [ { "name": ".XLSB", "colour": "#CD7F8F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375890, "uuid": "df44ca0c-95e7-4e15-98cf-6be2e4994ff8", "comment": "Malware payload", "value": "e08b40fd38108b5d4cd8d381931d5b1182daccdd", "object_relation": "sha1", "Tag": [ { "name": ".XLSB", "colour": "#CD7F8F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375890, "uuid": "1fc6a89c-f3dd-41b6-8b52-c0ac4832ebb4", "comment": "Malware payload", "value": "efe351c141e271ff7d309261cbab14586746e1657591bf76e63893c5e8ca9e53f0d9918f6e4f715908c00b0bcfa2ce73", "object_relation": "sha3-384", "Tag": [ { "name": ".XLSB", "colour": "#CD7F8F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375890, "uuid": "e9370c9c-ba01-4c38-8d4d-44d5ad13e5e8", "value": "T19434E116261461B1C2EDB978720B0DC292EF707EE906F9244B5207FA7F423FA8D5D1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375890, "uuid": "f578d151-5b92-4277-b508-0eaaf62813d4", "value": "3072:nrpvZ+51+mCVdcmF/9OZNCsRCbOI59VzmWBgXEnkZtPaq4LwTGPCXVD:rpvY1MzcmfO4bOe5d/OIwTHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647375890, "uuid": "e2b83d66-308c-4c46-a794-e217e9fd50a9", "value": 244127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647375890, "uuid": "b0f24bcc-e41f-4915-a842-e791f1b12b2b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375890, "uuid": "59180ea2-6192-4605-a622-50774d0a6d18", "value": "mletssaeauiton.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affbbe48-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647354296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354296, "uuid": "82567e1c-52d2-4244-86d2-a409cce89514", "comment": "Malware payload (RemcosRAT)", "value": "f7c04cfc34d8683fe559faf3b4e22fad", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354296, "uuid": "bac36da9-d98f-489b-b1ac-bcd837e0973c", "comment": "Malware payload (RemcosRAT)", "value": "4ccc8a0286b73b62f34fee2f3927c12a73aa47f272f40a4ba7085d84dc1785aa", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354296, "uuid": "ebb0ceb6-ccc7-441e-b091-85e848fcb6bc", "comment": "Malware payload (RemcosRAT)", "value": "0ccf372db17a96c92485c46b751ac92a4bf8eddb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354296, "uuid": "4f9bbff1-14f4-4903-8a65-84ab4915189b", "comment": "Malware payload (RemcosRAT)", "value": "84b812372e1c30bd133418b74de57a3c0a0e7619327b71cfd5705c97393c88e0f58eb75a4f1bbb4b163362549e39a1a6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354296, "uuid": "95221b38-82c2-40f1-a653-e6496a837a58", "value": "T17811EB3C5E65F1D0A19BF18090091D0B2AD40C2FFD769829188B19B3B964AEC5C1E05B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354296, "uuid": "33338001-1544-4865-8fd7-7a105f5ac726", "value": "24:IB/ogoJGAsC1fvBxfWgPqF0y1tbD9gKGBD:soDGAsCRvDJ4TQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354296, "uuid": "3f1a8e69-9466-4701-98d6-af00b3d6f54d", "value": 1092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354296, "uuid": "a760985e-4e75-4f14-b905-40576aa2a854", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354296, "uuid": "61cbef7d-1ad4-4af2-a090-92ca65fdf818", "value": "Balance Invoice frm Astra.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b40d35-a469-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647353336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353336, "uuid": "7414f2dc-6f43-4dba-93d8-51503fab35d5", "comment": "Malware payload", "value": "898bba529a26c75b6d955c8c87645712", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353336, "uuid": "1a9db3da-c8cf-4767-80f0-c5c4484ee582", "comment": "Malware payload", "value": "4cf84de6af8556ccb7647a48bab232b0a8eaf89b8b08973df73745d3a170d40e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353336, "uuid": "c95ab665-2c38-47dd-9f2e-984880a58b8e", "comment": "Malware payload", "value": "607595bd6173d0b6a3e770ee80dda0c5cabca2d4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353336, "uuid": "8470ab22-322e-49b6-b515-9fbe77cf5bab", "comment": "Malware payload", "value": "3bb8223816f1a330ec98cef1874c63822e604d60b7fcd826f7a5c117f6dfc37fe2062e0772ba0f6a9701bd2902cb6d06", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353336, "uuid": "26d79863-c041-4b9e-995a-66bc08a77cb8", "value": "T1E5E39EF027509CD2EB9E9BD7E1696D9D1321217BEDCB218C1086FBD92A733419A0DCC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353336, "uuid": "dc004a35-01fa-474a-bea5-f3c69e31aea6", "value": "1536:YibOFc/31+gCEklfUTfF7AtYz7lTVjsaqXJJDqdhdf4vZb+4gZGBiRK7pR4kZVM6:LFXFGZ/4HAHjl8bvaz1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353336, "uuid": "c5f6ceae-34a2-41c2-9faf-e142028abd96", "value": 153665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353336, "uuid": "810e0ce9-7497-4df6-9c54-601061b5fc71", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353336, "uuid": "94da51ee-edc7-40be-a61b-b79eabec1a6b", "value": "02152022-002.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f068204-a431-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647329115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329115, "uuid": "e137dbd6-861a-421a-9a51-dd87546b76b0", "comment": "Malware payload (Formbook)", "value": "cf5401ef4d018b7c6ed0b31b0eb56995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329115, "uuid": "004c4cbb-d0e3-43fa-b3ea-2f77d7defebf", "comment": "Malware payload (Formbook)", "value": "4d11816de1a6429b0fa2f9754f7e51e45a6afb350ddd5b806974b629e8fc6fc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329115, "uuid": "8d2592a6-dcd6-42ba-9d91-0c9e3c756c10", "comment": "Malware payload (Formbook)", "value": "b5493dc156930ce998e45b91816ce9b6459ea181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329115, "uuid": "fec89327-f60e-47be-981e-889ff17b060e", "comment": "Malware payload (Formbook)", "value": "f9dbb237a3c3ee168ce059208f4a315d4498ebd2113f7e05168a2ce9d48f649065e6e0f50af264f1ebe1f2b475b09f3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329115, "uuid": "521d22e2-d416-425c-acb0-e6f9138fd750", "value": "T13494CE7351C8C4AEE86140BCB5119ED167FF3CE4A074998936C32E3FE62D7168296A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329115, "uuid": "05d4316a-0969-4a11-be64-756b83d265fd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329115, "uuid": "bb773989-091d-41eb-bbfa-6f3d6372d509", "value": "6144:/GivaEbizN63RTzr2gEmtc1vPMsjqQMMQdbKrSYAmj5U9Do4h+14IEn:XIzI3BzBEWc1vPOASYAmus4s1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329115, "uuid": "bd004864-d2b0-456b-8e7f-fd129703a4a2", "value": 415371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329115, "uuid": "f89f59b5-bc87-4158-955d-0ef110a59a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329115, "uuid": "efe43fb1-751a-4852-bcb7-356ad16e3bfd", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bac1d89-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "f0a8bcb2-5635-41e4-9c29-5fbf68bfb6fb", "comment": "Malware payload (Heodo)", "value": "b1bc7252a33e81a0e4d7ffea2740c69c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "450d5a62-bdc3-46cb-b4e5-13f16f38b53b", "comment": "Malware payload (Heodo)", "value": "4d236e3003bc89b76f2c9f011a15409260223faf1a74c28e6fd11c84762c3bb5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "7c8e5f97-7b3f-47bd-8872-f6c873a5953d", "comment": "Malware payload (Heodo)", "value": "46c4a72286f2fe3d96cd27dac60823e3c9edcfc7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "7bc8b027-5c83-43cb-96b6-a2382b13def2", "comment": "Malware payload (Heodo)", "value": "d351eba341089753fc946c0916378e3e59d81221056bc20d9543cdbba36bfbfd2b2012bdc3d33f07def493e2b9a5ba58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "e90237e3-7817-4c1d-a208-851de8f66ef8", "value": "T1E1256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "642ddf43-43db-4c2a-829d-f6a5010b4cfa", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "a8aae391-603f-4e79-93b2-ad42c3ef22b2", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkVwLBeUNKsuG31Pt8H:3dlV0EnIT/wgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302695, "uuid": "de344b95-df77-4f46-bc08-372d2d3d7adc", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302695, "uuid": "9710e918-2c42-478c-8eee-cbd91807419c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "1e01809a-deaf-4146-9508-e1e64cb6324d", "value": "emotet_exe_e4_4d236e3003bc89b76f2c9f011a15409260223faf1a74c28e6fd11c84762c3bb5_2022-03-15__000447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c8c288-a40e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647314225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314225, "uuid": "f6ad6868-8f89-42b4-b080-6043c0ea0fa3", "comment": "Malware payload (Mirai)", "value": "240733c19db7c3792d8cb59ff334a73c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314225, "uuid": "cc04fd51-b56e-40db-be35-e87f43a6a5ee", "comment": "Malware payload (Mirai)", "value": "4d4c9b90b916a46d9ac822976d39cc68c72420a8544b4916ceff0895e2b75973", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314225, "uuid": "9780c3ee-d05c-4caf-b424-96e6928a144f", "comment": "Malware payload (Mirai)", "value": "c66439a4b0ff1233ac4a5495dfc05658b3b47746", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314225, "uuid": "5ac2ce47-a8c4-4a55-8c42-2263e79e7f79", "comment": "Malware payload (Mirai)", "value": "f918ff0116c6831a0a11168b0497f3c4631f124d6b4f6542ae0039275e073b3d05fd99d1b7f07c18cb92a3b3bb0b7636", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314225, "uuid": "36cf3e16-ac37-4b45-9610-1fd697e42eb2", "value": "T18AC2C656F9819B11C5D11279FA0E124E77135B2CE3EFB3226E246B34678757B0B3A80A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314225, "uuid": "f2c5119c-9818-428c-8d4c-a62f4c8eb86b", "value": "384:/nNnIhJ/9njiXQwM6KF7m31C8sZJE/JAgfdxeaDp3EgXx4elkLhVy:vNnIv/9jigIK7m36ZgJAgFxZDp3aNLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647314225, "uuid": "a7d653f0-88ff-49ee-a965-a1cf16fc1db2", "value": 26388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647314225, "uuid": "3e59163c-9d17-4146-bc9d-850fc9ae004b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314225, "uuid": "4174cc4c-72e5-4b86-be2b-e247f1f390aa", "value": "Ugliest.arm6-20220315-0317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5fbe72-a486-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647365834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365834, "uuid": "eac1fe43-ced9-4594-82de-c04ab82686d6", "comment": "Malware payload (Heodo)", "value": "36354a9f18bfd23345deae79117becfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365834, "uuid": "1f9e7a28-d383-4357-a771-4872de53f16b", "comment": "Malware payload (Heodo)", "value": "4d6aeecffd4ea87a171d7678b97ca71366241e5fcc55e4ffa08efadb3d35183e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365834, "uuid": "b17611ae-c32a-4682-ade8-3123d8492f48", "comment": "Malware payload (Heodo)", "value": "66524f5185282dd8bf043dc575705d598b279c1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365834, "uuid": "f58601e8-72fa-4110-a9a0-79b533a65ceb", "comment": "Malware payload (Heodo)", "value": "5381d7a576ef150e0ab87427b1864761d32c4764e2c747ab12e95a6f77c8c21d666db7215a2c65e11e62c08650d931f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365834, "uuid": "5fff3c58-05da-4561-b35a-131c8b317e8f", "value": "T1E9257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365834, "uuid": "5645cde3-1f3b-483c-a4dc-95f89707152f", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365834, "uuid": "9a47d2d0-b71d-4ce3-a4bb-a17a543611d4", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlQOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8kl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647365834, "uuid": "148fd474-7f80-41d9-939b-59f9293726ef", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647365834, "uuid": "5db8d4fd-4eb9-49de-9fab-9a899cef3913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365834, "uuid": "137e4bf9-a455-45d6-8f4b-979ac9415965", "value": "36354a9f18bfd23345deae79117becfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46026730-a488-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647366573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366573, "uuid": "36d3acec-4040-4471-8df5-bdbacf8a3db2", "comment": "Malware payload", "value": "a64f7cfc31fb2974e4e3c5a0895a238d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366573, "uuid": "d805dc28-e7d7-401e-b522-3f4625e1685d", "comment": "Malware payload", "value": "4d7bb71f657c608e65d6d628cddb7b75872c38d624cc109533303ba0b620fc2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366573, "uuid": "06a6c538-fe0c-48f8-a809-2cbe6d72d98c", "comment": "Malware payload", "value": "f763fc30297a874ab2ed5d08f6f32d7404678d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366573, "uuid": "1d55f9f3-c7e7-41ac-8214-c0b0027cdd2b", "comment": "Malware payload", "value": "5bf0b9a7582595f634abc2bd44b864db015f691f074d7c1c060b659e22f012ac610efc7d968418a6d485a99de271901e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366573, "uuid": "a601c506-5b84-432c-a7bc-38d801afbebe", "value": "T19FA52B079A407E73DB67467A0D7B0536DAA3C310833898CBAF6498656B267D1BF3324D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366573, "uuid": "47d91ebf-c62d-4f4c-9077-65bcf8ee68b4", "value": "802dcac7aab948c19738ba3df9f356d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366573, "uuid": "e9367737-cfe2-4b28-ac08-1d2fdc663d5f", "value": "3072:UrUrkrYrkrmrkrYrkrZrkrYrkrmrkrYrkr9rkrYrkrmrkrYrkrZrkrYrkrmrkrYw:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366573, "uuid": "fac9b2ea-65f4-4c61-86a5-9cf359f020db", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366573, "uuid": "86be1f41-4401-469c-9011-9a66f45524dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366573, "uuid": "dcf1f2d0-587c-4c4e-bf9b-c8bb38eeeb88", "value": "3d7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdf4f81-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647348976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348976, "uuid": "4c7e2345-0ae7-44dc-bbe2-b42d74c99ba3", "comment": "Malware payload (Heodo)", "value": "49179ffefdb8e99fcdda676e83342f5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348976, "uuid": "4d632f8a-53f2-486e-83ca-7e8eb2d9c4c0", "comment": "Malware payload (Heodo)", "value": "4d80ea13e38fb1771fb9344dee26b0a3a543c8646cafa7efe0f91f5788c83784", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348976, "uuid": "230cb2ee-aa44-4cf1-aca9-973f4c616008", "comment": "Malware payload (Heodo)", "value": "9539223eff0b69304902fb6b213131871881f6ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348976, "uuid": "c0b652eb-8e4d-4067-b560-a03ff3d710fa", "comment": "Malware payload (Heodo)", "value": "f8f4351af671d9a7608af7dd9393a72858deacc4068c86e95cc6f617741dbd3ae5829c766b9fab6ed904d460be4e2818", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348976, "uuid": "f2b73487-1b67-45af-acb7-13d9f60abff6", "value": "T195257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348976, "uuid": "b6807028-1e1c-406f-8fb9-c62eec5fd5ad", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348976, "uuid": "f8d99b1e-51ed-405e-a650-8bc1c5624f2f", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYqVP6FuR6shQLj88F+Krf6:v6oycln8cACixP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647348976, "uuid": "6fadc622-65c8-4581-ba0f-0d1fb167b3ae", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647348976, "uuid": "9a9eadd8-6fd9-4511-98c0-e3785213c3fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348976, "uuid": "ea208e50-dfae-4d1b-83a0-14dcb9e74602", "value": "49179ffefdb8e99fcdda676e83342f5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db85ae3-a467-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647352386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352386, "uuid": "dddb0a39-f262-4f74-b4d7-ea8c6ba95e46", "comment": "Malware payload (SnakeKeylogger)", "value": "68225001c10ccf0865f92cd74d77e4cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352386, "uuid": "a238a934-c66b-43f2-b476-4288f0dd9d84", "comment": "Malware payload (SnakeKeylogger)", "value": "4dceba1fa678ab8537d060e5011b98b292ffef554e492a3c19bfdf25d1f13118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352386, "uuid": "6c739dfc-39b5-43b6-9990-8fd7f19f62c5", "comment": "Malware payload (SnakeKeylogger)", "value": "119bc52de9586c33578cea34f137c6d75d80bf4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352386, "uuid": "149b4e78-e756-41ba-a4d4-3097fa18acb1", "comment": "Malware payload (SnakeKeylogger)", "value": "ea9836d061f6e8419325d4307dec80a31b65e3051b5ae68cf7379bcf14809dcd0dd945046599f13e17d7381ef1811771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352386, "uuid": "befb55b2-bf81-4d85-8c89-a0a69bb7a1fc", "value": "T14F357ED1F1908D96E86B46F2AD2A653015A3BE9C54A4C10C5DDEB79B36F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352386, "uuid": "1af153fd-ea9c-4ea4-a3d0-8560492b38a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352386, "uuid": "b6e3f488-ebe8-489d-baae-7c5ba5192c52", "value": "12288:zzmokwOEocERnHnlyfBQ70y3vjKwBr/o3WT26kGX9dZHYf:HmbwO/FyZhy3vjHBrxy0X9dZHYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352386, "uuid": "0efdeb26-5c0b-47e6-ab4a-0972a853ef3b", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352386, "uuid": "a55b7a7a-5c98-4088-9a7f-12ca563cc201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352386, "uuid": "c9ce955d-8bdc-4bb2-97bf-0875847224e5", "value": "P0A2249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e44c007-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353273, "uuid": "8f6e92cb-3dbe-48c0-9b52-fc40bf0d3f5a", "comment": "Malware payload (Heodo)", "value": "c17f013b0bc088d1d3bac748be582ae8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353273, "uuid": "ca6bf806-bd48-42f4-aae5-1eee3c2097a9", "comment": "Malware payload (Heodo)", "value": "4e2520af8f10a4f60bec029225fae89f4cf6e1d43c91b5dd361549189f969cdc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353273, "uuid": "d46969ca-2ced-4608-ad5f-336755200520", "comment": "Malware payload (Heodo)", "value": "89aa2b420c47ce7c65d8d6bcfdfe479a09d7820b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353273, "uuid": "39c5e841-73bc-4593-b91e-1ebe84e5b2b6", "comment": "Malware payload (Heodo)", "value": "ce0a2b220cc4701a90f85c5c70b51a6061f28bd2f6b7067361c4b6018f900eedcb436b0ae248000d91382687dbe6a220", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353273, "uuid": "56645e9a-3f1a-4e60-b146-86ec0837cd46", "value": "T1F933D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353273, "uuid": "7e533932-f993-430c-b2a6-f6bd34164c0f", "value": "1536:UAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:9cEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353273, "uuid": "ec065419-310b-4c9f-8fe7-0d16566555c9", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353273, "uuid": "c6f483a5-5dea-478d-b753-ee83617fbd6e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353273, "uuid": "dbe1927a-9ff8-46d1-a13a-a8be47f1d29f", "value": "iMedPub LTD_6.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd45f7ba-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353513, "uuid": "be333572-a916-460a-92ff-e6a6d8b81192", "comment": "Malware payload (Formbook)", "value": "8206f7c7c0d20cd1de55ab945bdc67eb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353513, "uuid": "b0870c95-73e3-40d7-a7ac-6357092a4cce", "comment": "Malware payload (Formbook)", "value": "4f9ec3f0f4171a9642310f8288c892a14708d2540ce061fbf33395f16fbeab40", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353513, "uuid": "b8e4816c-39c5-4e1c-85ef-136773f42e02", "comment": "Malware payload (Formbook)", "value": "cf3871095512558e75f1a85961cba20c25629618", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353513, "uuid": "5e36505a-9df9-4fae-9705-f006ec88e89b", "comment": "Malware payload (Formbook)", "value": "ad0a8d544c1e4d8b6dabae8c10a7115ebf79c64a17ded0bff5c4635a24ad6c92184af054d9bc079e078cfaebf049ed8b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353513, "uuid": "441600f3-c53d-4ebb-9102-912ccfb840a6", "value": "T10C1401A63350EE66EAE206F8BC2586D52A2DBC4240532ED6E7C6777D71BD0705C4B270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353513, "uuid": "0258ab9f-211f-4487-b7a2-caa3324bb5bf", "value": "3072:+R6W+iSQezeAu/Q2SCdK2tPHFo1CAOqDdxe/u3pNpoZg+KVNDnGfv4lQ8t/:uG3MQ2Sv2JloCCxo2pNpoKTE4eg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353513, "uuid": "d6a072dc-9a00-4772-b292-7195bd16d5e3", "value": 191112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353513, "uuid": "1322f70e-f168-404e-ace8-277876321d8e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353513, "uuid": "60d8e4a6-0287-47ef-ad45-7e02a958e5f3", "value": "PO#4500550329.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b098969-a451-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647343040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343040, "uuid": "4960fd0f-2bd7-4ea6-8c49-ba1dbf1c7e71", "comment": "Malware payload (Heodo)", "value": "d8c06e44e78cfb31cd298ee2414ddd95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343040, "uuid": "ba1e81ae-696b-44c5-8ad4-3149fef45aca", "comment": "Malware payload (Heodo)", "value": "501286da60c316980cb0348cbcdf06027dacbb65cf967cbe6aaf0faeea26dec0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343040, "uuid": "aad8ca23-0296-47c8-b98d-91e28cd822fe", "comment": "Malware payload (Heodo)", "value": "56a8c621b276f609581e2318f9a8575d425a8313", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343040, "uuid": "3ea8c20f-3553-4f45-acf9-b56b7a6d47a7", "comment": "Malware payload (Heodo)", "value": "38197eec2b39fddfcdd91be5c3d0d258b15a052da4176938029890c5d6f3766ff07743a390afdd438f6d26c306b07d05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343040, "uuid": "84b7bf9c-641b-423f-85aa-166617d037c0", "value": "T1B1257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343040, "uuid": "b4b01ea5-8c4c-4208-90f7-ead4d92cc619", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343040, "uuid": "e0570219-a96a-4141-8292-508e7c8d847e", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYjVP6FuR6shQLj88F+Krf6:v6oycln8cACiOP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647343040, "uuid": "14b9ba4f-a4b9-4bf0-b755-f4095f4b343e", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647343040, "uuid": "a3e56a61-d8e9-439a-84ce-80e667f9e806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343040, "uuid": "895f54ab-0aea-4f53-a9f7-6f22b12b3fd0", "value": "d8c06e44e78cfb31cd298ee2414ddd95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadb4f09-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647334208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334208, "uuid": "77cc48ae-2233-4d15-a65a-26894b0996d5", "comment": "Malware payload (Mirai)", "value": "4bb777e9c186fcc0b56c6eee24c2c4b4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334208, "uuid": "3f69e464-5356-4381-80ad-7461eb4c8b6b", "comment": "Malware payload (Mirai)", "value": "5056020cdcfa0d62b447016854d91b930babf90341ad6634ec87f8d5187e5bfc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334208, "uuid": "d4f9851f-2841-4ee5-8ccf-370075cdf897", "comment": "Malware payload (Mirai)", "value": "68fe84c32cd7e8702d710dfff7882bedee98bab1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334208, "uuid": "7c70b650-c604-4e8b-bae5-8b06db2460fe", "comment": "Malware payload (Mirai)", "value": "2641250b839bd4dcfe2a80c90e761b08351538a9e85674222b5893f1a0747f578c96d8ddbdcabe801026c9876eb32ecb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334208, "uuid": "f25e8cfd-c5ce-4a05-a242-a9dd36ecdad9", "value": "T191430752BC818A16C6E0527AF96E85CE3B2123E8E2DF73078D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334208, "uuid": "b46b2029-93dc-46e0-a230-db07eda0fab9", "value": "1536:Q64i29YzaK1r5mTPAzHcEe7Z1suV27c9hMDHs:Q6ia7dm1b27ehq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647334208, "uuid": "9f274192-ca79-4aeb-9a53-9ce9a873af5e", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647334208, "uuid": "6adc78f4-b00a-420d-ae8f-d6b459525c4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334208, "uuid": "913109bf-ba0e-47ae-baa8-545894fa13d5", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efd6a91-a43e-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647334886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334886, "uuid": "20107707-3dac-4729-8a7d-252cc894306a", "comment": "Malware payload (NanoCore)", "value": "9f9012f7d38457e5825b0c78dbe59f02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334886, "uuid": "ff8fea58-949f-4a7e-adb8-e4acd7a40561", "comment": "Malware payload (NanoCore)", "value": "5091b0812652b76aa775615c4887c2f01934763ebd857bb0cbd40f3debc36770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334886, "uuid": "ae7420c2-e20b-4036-883a-8743e494b250", "comment": "Malware payload (NanoCore)", "value": "decec94a4ef14d4b6fedb8f91a4682641e4d5ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334886, "uuid": "b5465839-20b0-4224-918e-af00e427ad38", "comment": "Malware payload (NanoCore)", "value": "d81b0ebd98b35646c4b7632e70e39e0f563106efdfaf8b2ba04da79e13afc1c8f1bf57bbdce8afef9dab73659701f809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334886, "uuid": "7cbaa122-bf7f-4b76-9843-b08dc6d0cf26", "value": "T14735AD3523851B98D07D5734413AC4B027F62D0AEA25CA5E3EF10E9FBFB1A06A633656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334886, "uuid": "36ee3e79-b733-4cab-9a3f-fce33fad682c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334886, "uuid": "47c4a2a2-b196-4051-ad40-a13ac7cd2da4", "value": "12288:JPl1oeyWwQ0Z570ZE5Uye0JJMEw1TeuWBH3EAnBZFxzzRbvBAA4RBMsn:LYWwQo6ULU1CxfBZvzzBv/8B1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647334886, "uuid": "59895f9f-54a2-4fe2-886f-efc39c490b02", "value": 1083392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647334886, "uuid": "1de21f92-59dd-4e64-ae95-f120ded52ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334886, "uuid": "d2d01106-4174-4431-92da-bcbdfebc9d96", "value": "QUOTATION#RFQ827636-ABWShandongZuozeImportExp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc2b96b-a47b-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647361000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361000, "uuid": "4b6919ac-0d2a-4d7c-bc1b-76d037b67b88", "comment": "Malware payload (RaccoonStealer)", "value": "aa2777846aa15f08d01069dd8922c133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361000, "uuid": "c5c73098-e813-45fc-9e41-f91acd20a8eb", "comment": "Malware payload (RaccoonStealer)", "value": "50a1e08f353094c0a19b84ea61f13d39e7c3e9731269c35fd05844cff198071f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361000, "uuid": "fc555c5f-200d-45c0-9792-f637739f3ff7", "comment": "Malware payload (RaccoonStealer)", "value": "ba8fd20364b626fe4da96e974f71999f0b9817d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361000, "uuid": "df80583f-34b7-4ed3-9cce-185d096f856d", "comment": "Malware payload (RaccoonStealer)", "value": "dfef09636262c83630c194073a9b43c33109d79b56cbf91d5e9aca20bc7ec946c0825b154f4a24381d03481d3492d226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361000, "uuid": "4f908d55-df7d-4c73-aa15-9b6f34327cd8", "value": "T16BB4E110BA90C035F8F712F859B597A8AA3F7EB16B2451CB63C52AED56346D0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361000, "uuid": "dfbba67c-d4fa-475b-89fe-7a74b996917e", "value": "0bff565af25c1bc5033321ca0bc710a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361000, "uuid": "b93d71d7-2493-4788-a259-3956214302c7", "value": "12288:CSrP87b7eSBbrunfCBSjy3MECt/tJA6TvP1BWsv9CqZK/L:/8TeSZrV8uZC/G6T3H5v/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647361000, "uuid": "364058fe-4bfb-4fee-9617-bbc3b859a838", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647361000, "uuid": "e4e07046-0f3f-4709-9a77-a5e9d95d97c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361000, "uuid": "e34f6ec1-d9b6-49cc-a14d-09320287aa62", "value": "aa2777846aa15f08d01069dd8922c133.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbc2de2-a45a-11ec-9275-42010a9c0029", "comment": "Malware payload (Blackmoon)", "timestamp": 1647346856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346856, "uuid": "1816d90e-e4f6-4545-aa4d-c3f65b79da56", "comment": "Malware payload (Blackmoon)", "value": "89ff9041ab75978a700821ac1e880a3c", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346856, "uuid": "822d0460-3ba1-4c9f-a57b-8ebc88715d78", "comment": "Malware payload (Blackmoon)", "value": "50cd2bd0753c4f9644b56dda2aef563eda6f5a145e7ec2069f5c3bcc814b1686", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346856, "uuid": "cfa12fc0-cf62-4cb2-a222-6847a10429a8", "comment": "Malware payload (Blackmoon)", "value": "8b35c0a0e105a010e446e234a956c67e9acfdb2a", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346856, "uuid": "53bbda09-704a-47b5-95b9-c9c55c4e5335", "comment": "Malware payload (Blackmoon)", "value": "c7a94c034e626b9f24e2614fe7d2403c458ad9a863167a4496d7450d7432606baf56e53f0a52c8fe69a4b878f327e885", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346856, "uuid": "0ace9cd8-6101-424c-8b7f-4acaf745c3f1", "value": "T163462342F0E392EAE43E48F3E16F5197872A7626BF41A9D4B3919B473E305936C1C25C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346856, "uuid": "40773b76-facc-468e-8847-7080721d58e0", "value": "0cf96c708ee0054443902766c47bd3bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346856, "uuid": "8d6627e0-443e-43be-a561-242509449f67", "value": "98304:PETYZdQXT3p01KZs47iI8LeOovWTzeJ8jB+e6BzZ9RGHHk9qQdN0D:PEmQX9oKZ4LpTzeWw/fnGHHk9B0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647346856, "uuid": "77d17541-9610-4e80-b574-1b3d2ec9de9d", "value": 5882080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647346856, "uuid": "db7fffbb-a29b-4a7d-a259-7f2728d81a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346856, "uuid": "a860b9ab-b128-4349-83f4-4a825ecd48b7", "value": "50cd2bd0753c4f9644b56dda2aef563eda6f5a145e7ec2069f5c3bcc814b1686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac52b65-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333805, "uuid": "bec459c8-036e-42d0-9bec-29941eb46dd4", "comment": "Malware payload (Heodo)", "value": "87b2e6a14f87b8dbfe6817150243305c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333805, "uuid": "b5607524-02b7-41fb-81c7-dcf3b6e2156f", "comment": "Malware payload (Heodo)", "value": "515dffd0b42ebb26ed1820d5348106d9b39bafdeb3af58fafad59b15f6158725", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333805, "uuid": "15501e08-2237-4804-b11e-ba828bf36d58", "comment": "Malware payload (Heodo)", "value": "8012038ea541a3b53f0081959daad5d4b796667f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333805, "uuid": "f3fdfe16-ed62-4a3d-a54d-b96ad1a18a33", "comment": "Malware payload (Heodo)", "value": "d7ca72ed140a49b712e1edda6e787bbb00dec2000bb57fe3f99e0cef5a87eae7a3ed19878b06343d1a6b4f967248b72c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333805, "uuid": "879b6cb8-70d5-4c10-93bc-1a17d926c917", "value": "T14273E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333805, "uuid": "32353382-221d-424e-9b90-29a9c22a8456", "value": "1536:2uSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:QtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333805, "uuid": "b6292ecf-bb4e-42e5-8b4e-7f8a49c70e8c", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333805, "uuid": "ce4bd3d5-1e0c-4bdc-9ee9-74dc41c9d061", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333805, "uuid": "34c2697f-d9a4-447c-96a2-b5f775abdd5a", "value": "Insight Medical Publishing.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2ecdc5-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302694, "uuid": "96820aa9-f644-42dc-bfe2-013f3b33123d", "comment": "Malware payload (Heodo)", "value": "98c7441e461f07aa8a6b545a1ff382f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302694, "uuid": "78196afc-87c8-4cf2-99b3-487e21cc36a7", "comment": "Malware payload (Heodo)", "value": "51742d7e916aa7b4a0ba1ac6ec286e1ecbf71b0e3690fc40a2274f6f3925e12f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302694, "uuid": "b9156c72-ab61-492f-a810-401f98b511d0", "comment": "Malware payload (Heodo)", "value": "492694a833020d959037acf214ff47ab05d44adb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302694, "uuid": "811d0f91-4aea-4405-93d7-2bb68c08bd7b", "comment": "Malware payload (Heodo)", "value": "727c682db6f339a673b427a460f09e5cee19f36721047aed43706e8309e5c2c34b3e606c7706bddadf1759e8cd7c7c29", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302694, "uuid": "ccd76fd4-c587-4721-974f-4066325e17c2", "value": "T15C256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302694, "uuid": "10839a31-fd9b-4a73-afc3-ca37a401b2f3", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302694, "uuid": "afb2eb7b-b110-4920-be17-1d05d8328085", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkawLBeUNKsuG31Pt8H:3dlV0EnIT0wgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302694, "uuid": "a36a9d33-04a2-4c50-bba4-95c85700bbff", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302694, "uuid": "99e08c43-6bdc-4aaf-8074-b3c9a09e22e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302694, "uuid": "0c98344c-ac5c-4151-a5a4-e6e983f41c8b", "value": "emotet_exe_e4_51742d7e916aa7b4a0ba1ac6ec286e1ecbf71b0e3690fc40a2274f6f3925e12f_2022-03-15__000447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6f66e8-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1647353432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353432, "uuid": "abd105e8-aa29-48c7-a50b-bfddfca9e89b", "comment": "Malware payload (OskiStealer)", "value": "fde0bfb6b29ad5ab011a731f8804b1b6", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353432, "uuid": "afaea5b0-13b8-42f9-91be-1b4b691a2ecb", "comment": "Malware payload (OskiStealer)", "value": "52453139504bb0f05f9f8bb46d1ac9f1ba94d94311d2065b003fc5ea6dabead7", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353432, "uuid": "06b6a9f9-0681-422c-93f5-12f071e2cabd", "comment": "Malware payload (OskiStealer)", "value": "9a3a446e0c06efd7bcdbfe7816ad9dfc65718f59", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353432, "uuid": "434bcbb2-b901-4aa6-9909-2a14c34d4b7a", "comment": "Malware payload (OskiStealer)", "value": "6bb49f90e64a65632b1032f111336bb73a89d947c4b599504592abe4a4bd1dba36c492b1f7ccbc054a1bfe0bd4c45f1d", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353432, "uuid": "98b9d10d-8b9b-4fc4-b543-779898eaa58d", "value": "T1391412E5B150B72DEF7EEB3196D672130B37FE3A9C806D17408EB3A91278990056883D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353432, "uuid": "c774c01f-3e96-47bc-b2f4-4c47e603e0f8", "value": "3072:EsOutV3qs+fFMBiBCdADxYeaPVrt5XxH+mSbnPt82uo+q2d5Fbf5nKhsbp:HOruTADWt5Z9+mYLEq6fz9K+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353432, "uuid": "54e34172-91a4-4132-b735-6c0b1375c53c", "value": 190344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353432, "uuid": "eec61ce8-5a44-4630-9d16-bb5f34be2d57", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353432, "uuid": "580c2253-b394-4d02-bffb-0eb8d166542f", "value": "Order Confirmation _10001256.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dead28d-a434-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647330643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330643, "uuid": "19e1e18f-b855-4eaf-b76b-28f33bb7809d", "comment": "Malware payload", "value": "ae952649cfe84ace55296584afae9a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330643, "uuid": "3b8c2dfc-61c3-4133-a773-4090439a3bb3", "comment": "Malware payload", "value": "52bcfa7046f7ecd8fdd3bdb105bed5201089e3e9c27e0bd33cb6d5134cd4bb5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330643, "uuid": "19d45591-cbf2-43e8-a801-d85c425fccff", "comment": "Malware payload", "value": "96effd0fbd5a06921115537be330fcfa525e60be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330643, "uuid": "5fbddf38-5a3d-402d-8afd-65fef45014b1", "comment": "Malware payload", "value": "268ccc99491724c009399274c39feb34a3226889339b1a6d2f7430d5a0018c6b0a264658f4bf9996ed01768e5272c946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330643, "uuid": "c8a9059d-927b-4aae-8ff6-f40f0abec5e4", "value": "T10634E8873944C59CCF6D55F7A307854433A9DCFFC918A6096BC833579EE6BA20822B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330643, "uuid": "b4b651ff-9477-471b-a7b1-50d6c466a96e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330643, "uuid": "98960ef9-d322-4fe3-9d25-c6ce4a9b0122", "value": "3072:8Xq9x4CuwqhAp0ZFoGRnN6dfy5AmqKnoeJ:4qvShAp0ZlnNKmqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647330643, "uuid": "1d76f586-ba1b-47ae-b076-4aafd6967c3b", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647330643, "uuid": "ae76caed-8151-49b6-9498-416f8a94317e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330643, "uuid": "ea4f1bc7-b705-474d-b406-d2a0a8f48163", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6c837c-a477-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647359390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647359390, "uuid": "3a66b1f1-719c-49c0-b059-4b2cb0c37a20", "comment": "Malware payload (Formbook)", "value": "15ed95eaed3d1031c2e7dcc9d129e0f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647359390, "uuid": "1a3ab4d5-8b4e-418f-9ae8-dcca14750832", "comment": "Malware payload (Formbook)", "value": "5310b41169311c55d3dbdd3bf129510349d4eccac82ebe11ab34be1a291f2916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647359390, "uuid": "39c6ad1a-ae63-42df-aeed-9b06d0f722b3", "comment": "Malware payload (Formbook)", "value": "98148eb8665763ed2b1dafbe2050d4b638f5078f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647359390, "uuid": "19edd793-1dad-4f92-8963-08a9e8c264ae", "comment": "Malware payload (Formbook)", "value": "c79ad4889a322a371f088886e782ebd8740b1920448c9a62387df294ae6b988a0fb406937ce20578cd95fa1edd4e88dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647359390, "uuid": "04c1702f-f657-48ad-a385-05262c89e9a3", "value": "T14C6412073FC64DA3D8E38570D0FBA6BA6B7BD49406164EAA5F042E7B1D71183CD29293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647359390, "uuid": "b57fd275-df80-46ae-afa3-e12649222e6f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647359390, "uuid": "7428877a-1522-4d2e-84f2-e403217348af", "value": "6144:rGiSRzYeILE7JJuBZG618rLJY7UKNHQ6fzV7acl3ByPIOnwlW:mRXILqLuBRANY7lNw6fd75ByPHnwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647359390, "uuid": "297fea1b-90f2-44e4-89e6-5abaf557feab", "value": 307477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647359390, "uuid": "59ebb724-254d-40d3-9c2b-f6ec1a50968f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647359390, "uuid": "4b25a1c9-1409-4e98-b375-c8afbd91619a", "value": "COMMANDE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac10ca1-a455-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647344704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344704, "uuid": "59db3896-16ba-4dd6-8055-f00df72ed4c7", "comment": "Malware payload (Heodo)", "value": "c6047276955d337029b5a406309033b4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344704, "uuid": "0d2539cf-99d3-4970-b2eb-d1421b8ae7a2", "comment": "Malware payload (Heodo)", "value": "535927102c704896eea7fb11c923ed2a5b87f7c8bf3bff6e341a32ecf4d0d6a1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344704, "uuid": "ca780697-a16f-42f2-a9ba-59cb5b70e7a8", "comment": "Malware payload (Heodo)", "value": "0b9e0a536b961346a29d0f54fb79c49b290c3055", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344704, "uuid": "222488c5-a493-4baf-9e69-e544a2e5ba51", "comment": "Malware payload (Heodo)", "value": "0c485f736330c99abe016b05b0541b6cd96176a0c02d875dcc5e8d3bd856d302c933e74d4540428fb3c5f30e45853d45", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344704, "uuid": "e5205814-016f-4e7c-af1f-14f5d1fa96ec", "value": "T13333D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344704, "uuid": "88de6b8a-423c-49cd-b702-34c75a7f595b", "value": "1536:kAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:NcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344704, "uuid": "64ae61e1-a370-4dbd-a47a-7426f13cf3a2", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344704, "uuid": "08954a90-2748-4f5f-8cb6-c0e61c0a5ba7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344704, "uuid": "44fde153-fd07-4319-ae08-e051ef6cdb5a", "value": "Fakturierung 2022.15.03_1229.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdd15fe-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "919fd8be-4acc-459d-9ac6-78e5a00af17c", "comment": "Malware payload (Heodo)", "value": "3b373c2d2e19fcac22e7ff8118c35342", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "98f81570-9a61-49f4-bb8d-c3079839e8af", "comment": "Malware payload (Heodo)", "value": "53772317082da967931f9707d1da96ed84692e0e5fa72694a67ce100f0b396d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "1541f0bb-0bed-437a-beac-bd2f3dd4401a", "comment": "Malware payload (Heodo)", "value": "10a83d3b690feb4fb40d7bc99e4fc2f506bc4c03", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "4a589159-47ee-434d-8225-2135a07c4c7e", "comment": "Malware payload (Heodo)", "value": "a44551acc4bdcfd99cc0fac3c3f46210a2d404070372f0151a7ccf3e78ea235571fd617db69f08099d2b5cc4cafb2a7c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "2a72a1ce-a94d-45fd-93a8-d5a66329c74b", "value": "T1B9256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "1ed8d069-a443-4c21-b338-8d49d13c98aa", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "bdc58b87-170e-4bc4-89c9-ed56c859cbe7", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1SWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg68WeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302836, "uuid": "53c6dc5c-0afe-42e1-9aed-e1187bf79130", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302836, "uuid": "24ac680d-531d-4ca3-a4e3-877176451643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "bcaec542-83a3-491e-a350-0fd2ed83f1d4", "value": "emotet_exe_e5_53772317082da967931f9707d1da96ed84692e0e5fa72694a67ce100f0b396d4_2022-03-15__000707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38559374-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353666, "uuid": "026b8f93-f669-4c3b-a232-112081eb2838", "comment": "Malware payload (Formbook)", "value": "40a64e714d5b6c9ea9b1a58a5107ff89", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353666, "uuid": "dc36f4e7-4237-4714-b00a-5f24cf38c928", "comment": "Malware payload (Formbook)", "value": "53a01f91946ff2c6d71c3d1a8cc3f20cf7c8cd29d3156a16d5a1c1694e936e61", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353666, "uuid": "9b56dc7d-3bb2-4591-b0f8-cd8da3ab9121", "comment": "Malware payload (Formbook)", "value": "9f8efccde0ebc8473edc389e60ea94bb2b25809b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353666, "uuid": "485b0734-148e-4545-9669-33714219547c", "comment": "Malware payload (Formbook)", "value": "1c42cd99a0a11543c3aa0121416b84c354964b9cad151bf9b31300d864d3221d31ecae40f556887397d6b6f32186bbb2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353666, "uuid": "18d7b5c1-d825-4a13-954e-79a8030fc195", "value": "T1FD141219FA5B25C4F03EA2380E4098A771F1DE61C1ABDABA34653752013693C764E9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353666, "uuid": "88f79b69-c4d5-4e02-a0a7-0822d3d5a755", "value": "3072:S/dkknP+Tsy6X7jwpIQOtTcyRA/xl4kjcGRHKUaFM2qZGbjPA1tIAOTpaqMO:IvP+P62POtTct/T4Yc0mMdGjY1OAOTQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353666, "uuid": "19baba82-eb30-49ef-911d-7d5a755575f0", "value": 190600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353666, "uuid": "d5465e20-2b60-4189-963a-0ce99cb2a522", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353666, "uuid": "5301681d-3626-45f4-8529-0b2e3f03ffc5", "value": "SWIFT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c8e8e2-a3f6-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1647304006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304006, "uuid": "c9625d92-b02d-49dc-bcc3-773745ba3fc1", "comment": "Malware payload (NetWire)", "value": "9979deb7fa7f3747ce871ff471ab27ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304006, "uuid": "db7bab1a-4ec7-4b12-9ced-49cf03aa0572", "comment": "Malware payload (NetWire)", "value": "54c1f3123187554c4637a2d0ab80abfd06a27d61bb72dd5bc93f102e4993769e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304006, "uuid": "b704adbc-6910-4b8d-97c0-0cc63929a045", "comment": "Malware payload (NetWire)", "value": "a92742970448d5ce4a65377b2c8a6415f46ad2a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304006, "uuid": "26873355-4a53-4fbe-ba6e-ae23cc90bf17", "comment": "Malware payload (NetWire)", "value": "1b0c23e2434b978a98be1b1349441a6ce2fac0f078960f6a08cd680aac7b331d713a9cb2eb8e6fa778940d63e6c4492c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647304006, "uuid": "901f197b-44fc-4e2f-b4f6-0cdb875bb22b", "value": "T132A46B667455D0E2D244AABC2DFEC8CD3123BC50DDB5ED8B31D6BB5F02BAACC401694A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647304006, "uuid": "7abfc99e-60cf-4297-9f1e-f2bf5469f889", "value": "1ed20cebb268169d08c9a097f425277c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647304006, "uuid": "25231252-30ff-4068-ba03-ecd9c900e25e", "value": "12288:uI/JlVjzYqn8MYpqJQsk/3qRPzVHwQ0q+vcdywf:vlVnnFz2Xdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647304006, "uuid": "42e3143d-427a-462f-8522-5cec2786eb1b", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647304006, "uuid": "ca94dc3d-57d7-4eab-b74e-b6dd9ff233c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647304006, "uuid": "ae1accdc-be41-4670-be19-30423e864ccc", "value": "54C1F3123187554C4637A2D0AB80ABFD06A27D61BB72D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9baa46ae-a47c-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647361563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361563, "uuid": "6007f180-f6a5-465d-bd5a-4257c379c26d", "comment": "Malware payload (Quakbot)", "value": "cea7a55bc03796e18b764ff5c717e144", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361563, "uuid": "9654e897-476b-43de-964a-af4dd7e68cbc", "comment": "Malware payload (Quakbot)", "value": "554a1565f2708e7d4c5323a0fa483b44b2ff0685bf9c4889d24bfe7b2ccc5df7", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361563, "uuid": "a6098d1d-4395-44ad-afcf-8f301e011f66", "comment": "Malware payload (Quakbot)", "value": "6f1643b7b2ad2f2f2c69f08637f5f0750d2d600e", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361563, "uuid": "b9c80da6-41fd-422b-86ad-dacac08c43e2", "comment": "Malware payload (Quakbot)", "value": "de59cb1e622204804dbfc9ef8a295f161be1180ec5bdfa522edaef9dec54f4f47de50c2081c7d5450c620735f3af241f", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361563, "uuid": "fd4ff2aa-6249-4556-9e87-cb2a9a45bc3c", "value": "T13034E116261461B1C2EDB978720B0DC292EF707EE906F9244B5207FA7F423FA8D5D1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361563, "uuid": "86400498-c122-4bd8-9618-d0bc025b1cc0", "value": "3072:brpvZ+51+mCVdcmF/9OZNCsRCbOI59VzmWBgXEnkZtPaq4LwTGPCXVD:vpvY1MzcmfO4bOe5d/OIwTHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647361563, "uuid": "ce83a4b9-3b72-4116-9de1-1b6cfb2869ff", "value": 244127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647361563, "uuid": "76a89115-f869-4065-9320-0cee384dc13f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361563, "uuid": "9554b9d7-27f0-497c-b8af-0a1bb93f623c", "value": "uoutq.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d40172-a431-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647329450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329450, "uuid": "253280d6-d556-4110-a54b-0800ac742c79", "comment": "Malware payload (AgentTesla)", "value": "4f7ef4857f8751404f85d43b7212ab81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329450, "uuid": "f28cdb75-a921-42d8-b21d-135ba5915e8f", "comment": "Malware payload (AgentTesla)", "value": "56328da1ed43d2626390a7f7ba9a55c67e3c16803627c8d7f35e369278c603fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329450, "uuid": "aa8110e3-0cb7-4905-97fe-2ce4d4d1edf3", "comment": "Malware payload (AgentTesla)", "value": "63a9500eceb2b7a0beccc67c6e29afa0e1579e86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329450, "uuid": "0a058d76-7152-4969-b8c4-9210fc442476", "comment": "Malware payload (AgentTesla)", "value": "206798553dcdb527882cc24fcbffc79a81e7dbcd57f145d40a3aa5ebdaf98e555f5d690cd8ee3da54f0916360bf6c518", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329450, "uuid": "527d60a8-f8ab-4e84-9134-537ab50130f6", "value": "T17B35F1913E192FD1F9394BB4401A56AE83F36D662E12D9391FF03EC7093FF0295A5A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329450, "uuid": "35f1dc19-58c2-4bac-9db2-bd9ef44b96d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329450, "uuid": "c36670a3-0211-4779-a632-beb2ce493d51", "value": "24576:xKBUrlLOTguUqd59FJ0HYoqdO7tiyGfYPo+DBphzASeZ:xKBs5jxkFJ00dQeQQaphzASe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329450, "uuid": "beb8d923-0494-4465-91fd-c3abce322eb4", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329450, "uuid": "9764cbfe-6311-4b63-994c-4b3ac22962bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329450, "uuid": "8f1580fe-94cd-4084-8a4a-0b0598373189", "value": "RE,quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec671304-a435-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647331204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331204, "uuid": "2cb79d36-814f-4038-99e7-8633d030861b", "comment": "Malware payload (NanoCore)", "value": "3691a4ff24e5b690cb5a906acf4db5cc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331204, "uuid": "cf066ff4-a133-4af4-90d6-c571019c8e12", "comment": "Malware payload (NanoCore)", "value": "56b9301cb3bc01ad5d3166e88638c30a45080fc182613a4d12d0fdb685a0785a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331204, "uuid": "e4bd55d5-f0fc-4852-87cb-4171ef92dadf", "comment": "Malware payload (NanoCore)", "value": "99ab34b3571142c33dac68444eb21337e471f862", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331204, "uuid": "32be3673-2be5-4881-829f-926250f37594", "comment": "Malware payload (NanoCore)", "value": "12eca3a1fed5995b31e920e5fc8a56898d48092f2854383b4dfd523591126c20eeb2f4aa1db56a0d26ff6498d987d9c8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331204, "uuid": "a763446f-8074-4a15-ac2d-d2138a53f3e8", "value": "T1A802B0601A144F9FD6CF9AB77B221B8BB0E6F41C41491D1B569057C72D442F67C08EF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331204, "uuid": "94246329-7b50-45c1-98f2-7cdd70bd4766", "value": "192:+FkshypqILV9a3WMUpzN0+8vxgpvPRtrd8CGMFMpzd6Vh8kqe:+Fkshysw4RUL09vxkPRk72MxECkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647331204, "uuid": "fb6fd0f7-9651-46f2-ab73-52da535ec8a3", "value": 8438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647331204, "uuid": "dae798a3-89b8-43b2-8ac5-cd5c36021327", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331204, "uuid": "2085a0e4-85ad-4428-a87c-0541ce30fe8c", "value": "CV.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a7fd1c-a456-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647345286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345286, "uuid": "e5361d9b-fd21-47d9-aff1-a1dc4f73d868", "comment": "Malware payload (Heodo)", "value": "22371e22def7361fe92a18c4acf7588b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345286, "uuid": "fc9717fe-cfd0-4303-ae1e-871f49116a3c", "comment": "Malware payload (Heodo)", "value": "575a0f97f474340cae89d7f6655ae0bbc615e8399e2341401da87c2e3aad4651", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345286, "uuid": "50c7ddf5-4dfe-48f3-b1e2-9756f5dfe4fa", "comment": "Malware payload (Heodo)", "value": "92e6df141bb51d77eedb04198a34d140d20b2d2d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345286, "uuid": "fcd7c651-1bf2-40a8-8ee5-582bcd1e0d99", "comment": "Malware payload (Heodo)", "value": "66237a2db0c164943bc3942af8e8975f33a8e93212b983d3720b0d81c84eb127baaf938582078b092b3c569abd498e19", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345286, "uuid": "11e29138-38df-445b-9bdf-eb5eec4210fc", "value": "T1D4257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345286, "uuid": "6715f214-c0e3-4095-b62d-89a0b1b84293", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345286, "uuid": "07e4edef-34e4-4e6f-8eb0-f0ed1f6d8907", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYHVP6FuR6shQLj88F+Krf6:v6oycln8cACimP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345286, "uuid": "ff728375-ae09-47ca-ad14-729644c4af78", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345286, "uuid": "ed71e7ad-78c6-4390-b5e7-970187a60a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345286, "uuid": "dbdef290-3c84-4f31-ac23-67ded82d7b38", "value": "tFipAlJdsnGjzv1gHxAtdMSlGVTLiWcwnAu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085c8ffb-a449-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647339412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339412, "uuid": "6b137ca0-e935-4269-8312-cb93c3cc8011", "comment": "Malware payload (Quakbot)", "value": "9d4f7b418f842025d922e299ba146a13", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339412, "uuid": "09131b91-8afe-4aac-b70d-507be504b26a", "comment": "Malware payload (Quakbot)", "value": "57aba8538fbcc27feb78e86955c96ed35c81bf318cbac50cff07ff9ade62d1b9", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339412, "uuid": "853f03c0-0d29-4c4a-9f3e-012a5623f396", "comment": "Malware payload (Quakbot)", "value": "d3ae2089a64eeb251179742a8b320e8a6ce90f3f", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339412, "uuid": "93a3eb06-b352-49ca-ad48-74ff07c87fc9", "comment": "Malware payload (Quakbot)", "value": "ed0b599f22e00089bb484916a67f9edde1af14c9f19dd97370fc397f5117f995ae74f6d1247dde3829fbc8f74d38433e", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339412, "uuid": "baa28616-8e6e-4d73-868e-529f84b36d63", "value": "T176C3AE5BA4195F47D66846B4FF070DA81F01235EA8C276AE11562C8A3F663B32FCC35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339412, "uuid": "e2095adb-6a77-4ab7-b618-111944cae94d", "value": "1536:yABOrQAfAeiimLbLdbLwdKmjlvpLllllllllgEMTsqym0yKF5fRPPYIXtmHl3MYy:hnAfDixLbLdbLwgmfMBs+KjHQzVdcl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647339412, "uuid": "e75fa450-5d30-4f57-8626-890c110bd5b7", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647339412, "uuid": "ca58ea25-8a31-4dc2-ae5b-3542a4ee50eb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339412, "uuid": "1aa5ba91-0ce6-42ef-b972-0794bf3cb523", "value": "payslip_ord-76357827.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c570849-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "87aed494-0c13-4e55-9f24-73708b11d3af", "comment": "Malware payload (Heodo)", "value": "1f630df7f5f897bebe53b398a32d6dc8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "f9665383-710c-43b0-9d3c-8e8e4fc40179", "comment": "Malware payload (Heodo)", "value": "57d9a75ccdf55e65047e3519f1fa0288b4bd5ce56406a2de3a761de97081dbdd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "d6a89c3c-4ece-4761-aa8b-99b315324d32", "comment": "Malware payload (Heodo)", "value": "827fdf78153562da724bf0cf075d4c8189f69e41", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "014d0bb4-e63c-4fbd-aa3b-bfdb19ba7ac2", "comment": "Malware payload (Heodo)", "value": "ab8e2f63890fe691f6762f02ab36ade3f48c4050f21aa20efe12a1daf30fd05211aeb912b0fe235b403be33cae804ca1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "6890768a-61ae-4267-aa94-aa1a65711d98", "value": "T1C0256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "ebefa2c7-29fe-44c2-b666-b4401d71900c", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "0ce7ed66-6567-4033-b3b9-f4a3ea22d9ea", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkhwLBeUNKsuG31Pt8H:3dlV0EnITHwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302696, "uuid": "6a2c5326-6ebc-4e49-a654-021fb7ba54b6", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302696, "uuid": "8243a920-d279-41ef-b0ff-2ddfcfcd5f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "5a02e7b3-0700-4135-9b82-259a443bd8f4", "value": "emotet_exe_e4_57d9a75ccdf55e65047e3519f1fa0288b4bd5ce56406a2de3a761de97081dbdd_2022-03-15__000449.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230895c4-a460-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349335, "uuid": "f96bea24-f8d1-4f0b-ac42-87a41602f0ea", "comment": "Malware payload (Heodo)", "value": "c69130bc64a60cb5ca0abee9eefcaea2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349335, "uuid": "78d14ab9-0887-4147-b4d5-7d1ef80638da", "comment": "Malware payload (Heodo)", "value": "589c64a3214f8b114e73ddb945787c19853e53013ddfcec6259039ccc11b6ce4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349335, "uuid": "d29e4777-0a9a-4347-a62c-000f44822d2f", "comment": "Malware payload (Heodo)", "value": "09b0744a80b2b31c2af8e632baca59dd0df2cc8d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349335, "uuid": "52657c27-d6f7-4db8-8ade-3a405f91d058", "comment": "Malware payload (Heodo)", "value": "5b717813c959b1844f59de03472019e17bed1705abfbe1b53c8caf8570401880f912bb83156f0f8b7d406a3340421acd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349335, "uuid": "f97cf20c-03e3-47a9-a910-e3c03f04e44f", "value": "T13133D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349335, "uuid": "9757a492-cfff-444d-840a-7910ea37fb2d", "value": "1536:YAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:BcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349335, "uuid": "c80e5973-faae-4ffd-955b-19914e384073", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349335, "uuid": "26057e63-3b07-4bb2-9daf-b725a2a58423", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349335, "uuid": "8a409c42-d642-4fd6-b173-37ecd53d3c76", "value": "Rech 2022.15.03_1322.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a39950-a430-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647328769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328769, "uuid": "f3cd5f77-a45c-4700-b96a-39fb0d651042", "comment": "Malware payload", "value": "c82732066961556bb26acaa43c2dfbef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328769, "uuid": "492ac666-9b08-4ed8-86c7-3c4893645158", "comment": "Malware payload", "value": "58c0907ff94ab985f6bbe91b4e851bb65d5953a93186889ac0624b9a473c124f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328769, "uuid": "21620c3a-76d5-4bc1-aa81-83513a387348", "comment": "Malware payload", "value": "0c7bbb515ac8a690cf747ef8b5b2d2f12b19f4e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328769, "uuid": "dbf0f7be-988d-4e57-8c0f-0fc430dfca13", "comment": "Malware payload", "value": "3585f1f0d4f992e6f2cd2cc247b479d36a50c135ca24da61b11f277a6b819716022526662334023af397467b540d6c12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328769, "uuid": "d4f289c9-010c-4095-8cdf-753423dd651c", "value": "T100034A1B2AA17052C59320B0FA991F34C47D4CB6116BB066FB417B6928B2D63CFB0DDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328769, "uuid": "ea78a670-40b1-48a5-a6b9-81e1c73218d1", "value": "170193414cc4abf0ae27dc2a19d74879", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328769, "uuid": "214c2e38-a3ae-4434-b597-12a30381507b", "value": "768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHp/:OLsF2Kerc64sTiX2IV0Dhu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647328769, "uuid": "9a763d6e-a223-40a8-9cb6-a370e6d71daa", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647328769, "uuid": "91f70240-1122-4fb5-9d4d-66605700e067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328769, "uuid": "fc729226-2443-41ee-b293-96af98b4ea70", "value": "58c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14eb5a9-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "d69f7557-9a31-4d20-9f1b-785e3fc25a00", "comment": "Malware payload (Heodo)", "value": "fcb73e00f228c4784827cb4151f62fa1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "780a156c-067c-4409-bf54-7c2b2e953ccf", "comment": "Malware payload (Heodo)", "value": "58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "ba6b93a1-e601-44c7-a3f8-1cdb153270b6", "comment": "Malware payload (Heodo)", "value": "a7380f2d7cf2732ba3bda90b9b6e29468a4ae304", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "26a0ffaa-80ad-40fe-98cf-de39c6e75f96", "comment": "Malware payload (Heodo)", "value": "d6b54a73891d716752e900d653e20b569bef2cd6ae3c2e50900174caff9a4244ebf091e436479b797254094b583424a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "006d7556-18cc-4ec5-8c2b-30353b278b94", "value": "T157256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "aa17fd8b-2a49-49af-adbf-b494c5c8d25f", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "4f559739-38f3-4ae0-825c-9e6988a7e45e", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1CWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6QWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302839, "uuid": "3d11fd5b-5869-4a0b-b48b-f44f986edf28", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302839, "uuid": "6560a4b4-2cd1-4337-a4f3-3820790aec9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "51689c8e-44f5-4258-bfae-5bc5ce597139", "value": "emotet_exe_e5_58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f_2022-03-15__000711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa704ba6-a471-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647356863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356863, "uuid": "aecd58a8-2bf0-41b6-ae50-7713276f707f", "comment": "Malware payload (Heodo)", "value": "38155e5b2382dd13d2a6816900498763", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356863, "uuid": "d5f8fbe3-1189-43f1-988f-407be5f892f1", "comment": "Malware payload (Heodo)", "value": "5970724f2c7cf0f6de383d1adef2fa10e9fe5408b5dab14898d2ddfdf9b3334a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356863, "uuid": "57a077e5-84f3-4825-8b33-6a341c9a52c2", "comment": "Malware payload (Heodo)", "value": "6d4268ca6b4ebd1d5d7ccf5aab02997299bf6f77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356863, "uuid": "77011e1d-1221-4cea-9038-ac9a10c8fd4b", "comment": "Malware payload (Heodo)", "value": "c8a802aae18dce2f61a5f9398a286d746700120f2c68397bbe73be834b10b373d52d391660d172be8e12527eedd3ab58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356863, "uuid": "05ae5a8b-1c2c-43be-9ef3-c160096291ce", "value": "T14A257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356863, "uuid": "646cc5e7-76c7-4058-b7ad-b3adff9273e4", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356863, "uuid": "3f27d20a-0d12-4f74-8b0a-2a27b252afdb", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHY8VP6FuR6shQLj88F+Krf6:v6oycln8cACirP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647356863, "uuid": "d04a4a1c-defd-4e7a-8100-24f738686284", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647356863, "uuid": "ed6033aa-348d-49cb-b736-4b715d44b5d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356863, "uuid": "8b8448a1-a984-407c-8ee9-2213c9a8efd5", "value": "38155e5b2382dd13d2a6816900498763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f806bc93-a474-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1647358282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358282, "uuid": "69fb51e1-4e73-4ca3-97c1-3ec053775972", "comment": "Malware payload (AveMariaRAT)", "value": "ba267183d8206f9fc847683907fdf8de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358282, "uuid": "19cf8d4f-c716-4f68-a903-72c5039d4a55", "comment": "Malware payload (AveMariaRAT)", "value": "5a02823f2c8303e99e19d8737a0d21d54fd7817b949ae57574e54eaabfe0fc3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358282, "uuid": "41ae7061-2400-488f-b7ce-f04047615c8c", "comment": "Malware payload (AveMariaRAT)", "value": "36364f4b4c8dda5aed901d4433713ec3133e91cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358282, "uuid": "7712fb40-327c-47e8-959b-50082c4e3e44", "comment": "Malware payload (AveMariaRAT)", "value": "fa686e05ac6c321535a9b02dafb4476c1591b030d3b06c58fda639ee8efa72ebecaec2b12e62fa3b00d1466879e0bca0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358282, "uuid": "65fbea5e-869e-4c83-ae41-ec1f0952df1b", "value": "T18705AE22D5D6CF22DB4F12FDC46E9110FBB4ECB16B3445DE6A8270C786CE502B6676A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358282, "uuid": "3c8a1902-798f-4fe3-92f5-88af6607e3d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358282, "uuid": "deb0771a-808d-4eff-8ef0-3e58c2a39546", "value": "24576:w8U1mKGvZHabkd3iF04uypvGJx+kqfxUH3njsD+dTDARpxki:x/NeYY34TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647358282, "uuid": "bc0597a7-cd2f-4b4b-8536-218aceb8fa5a", "value": 842928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647358282, "uuid": "46a863e5-80f1-4800-8e67-fe33c31c545d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358282, "uuid": "9024fbb9-4091-4307-a421-048ceaa51990", "value": "ba267183d8206f9fc847683907fdf8de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009466e2-a4af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647383207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383207, "uuid": "098f62fa-8536-42a1-9c12-eea9d4cb39bf", "comment": "Malware payload", "value": "6dbf190b61092732eb4131148c84890f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383207, "uuid": "5e884be2-9fd0-4ac2-9ed2-0cd4b9c4aae8", "comment": "Malware payload", "value": "5ab2a08c900aaf90e904ca9cece9aaebfb31ae116f265f92e92de7d2ea183a21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383207, "uuid": "7043e9ce-6986-423d-a2c5-d67bad925486", "comment": "Malware payload", "value": "8b4c02fa24ab649ef10f1adc8def9b5065e743de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383207, "uuid": "00df3eb2-dc29-46e8-be7d-d73b387ed004", "comment": "Malware payload", "value": "b37cc94a7d125a4cf7cb93af492811d8063bd6e218fc6d1caa6a89abe5c9cf238553172e693e7e3559faa574ef245b26", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383207, "uuid": "6a034ba0-9612-455b-a63d-53cc2e7aa406", "value": "T11B42D98579849B03C5C56137FB0E93887B3A161CF3FF37436A2A6FA12747832096E456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383207, "uuid": "f107ff82-c69a-4ccd-97c4-bfb9e3005a1c", "value": "192:6jToJ3iN65TwnGp1b5B7OjFvTdGILEIcdqlUw4v6kEZx4e8J:6j0J3DZBKRZlEIcdquHSFx4eI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647383207, "uuid": "bbace9b7-ba40-44a9-8cb7-5ea8cc971638", "value": 12500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647383207, "uuid": "63af8d32-0250-4854-9158-5ac6dd16fbe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383207, "uuid": "50b2a198-ce40-4c69-a025-d5ca7408f8f1", "value": "Ugliest.arm-20220315-2226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fbb3fe-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353262, "uuid": "05380906-6235-4c76-b899-7742afeb2059", "comment": "Malware payload (Heodo)", "value": "0bba19367d427de42eec315f7618bbea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353262, "uuid": "0936b8a8-61c2-44f1-a861-56f2e9a378e0", "comment": "Malware payload (Heodo)", "value": "5ad7b52f351914dbcfc07a840b9d8fa3421d9ff725d35795483615de1dca2d37", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353262, "uuid": "c6dcab1c-cc34-4278-a7ac-649c5610411d", "comment": "Malware payload (Heodo)", "value": "fc5bff1b10f193feb62a38ae8bc158e72df2d9a6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353262, "uuid": "06bf3914-8365-4d97-84cd-8cc4235f3339", "comment": "Malware payload (Heodo)", "value": "55a6b21509a2160081a115f4c194bb9036576a5f8b621da476c90d13277a34aad221320db986b14d629018b975115fa8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353262, "uuid": "b3781c4f-8b78-44bc-a50a-04a2663b48ac", "value": "T1E133D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353262, "uuid": "932036ce-8a08-4ed1-bbce-0f0beb7c3c4c", "value": "1536:kAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:NcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353262, "uuid": "44dc6d29-e080-4acf-86c9-0bd2b908213a", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353262, "uuid": "71ce5df0-a83d-4f6f-9560-4e4371c51144", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353262, "uuid": "94eafca8-48be-46f8-9b43-4bef41da2a80", "value": "imedpub_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352730ac-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1647354090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354090, "uuid": "75cd6631-618f-4e56-8431-cc1fd84e77d3", "comment": "Malware payload (GuLoader)", "value": "8c4e6a73b1894cc38c09b5d76bcf2afd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354090, "uuid": "e816c2ae-eeb6-465e-b2ca-deaa2d70c497", "comment": "Malware payload (GuLoader)", "value": "5b2f76923f8eb3a6e1f25fb2ad0f2eeb593f27a84b14e7fed7ceaa9fbe8189ed", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354090, "uuid": "dc174baf-464e-4cda-9dad-ce64dbc928df", "comment": "Malware payload (GuLoader)", "value": "2f2f2db69a6afe63285dccbd6862c48d7c890443", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354090, "uuid": "bde516cd-fea4-43b6-a3fc-532c5206c34e", "comment": "Malware payload (GuLoader)", "value": "63487e5d3f9cf9356f9847102c36c588bb048b8755e9f85f14b1123496444cfb9e43460e9174f07fca61127dd79aa58e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354090, "uuid": "a2f7aa55-3723-4c24-bad3-e365e132ed9e", "value": "T11033172D7721E29C8F3A52F18D85CB3D55A0F53D7321E106D9688C8174E81BABEE9C83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354090, "uuid": "65e54906-f247-4026-b7f1-f33b7b039495", "value": "768:fslMyuHQALwNdrgmMT5NosuTO59pbtDnprIiuG883LS8S4EHBxrBSAlmOx:USK7kbTuKbp51rMkS4EHBJAAlms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354090, "uuid": "72d658a5-321d-4506-b77d-cbb4d8bd686d", "value": 52316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354090, "uuid": "7541f728-d1c8-4435-8ef3-b3c3bc2b8c4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354090, "uuid": "46badb28-48cf-415c-ad32-75f34dfa9ea0", "value": "screenshot.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b98f1d-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647353586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353586, "uuid": "68bc3c28-c83b-487d-b7e5-287c61617cfb", "comment": "Malware payload", "value": "a1e30e1c6e64204b9154a0d650e433dd", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353586, "uuid": "957020c8-9811-47aa-8ed0-7e1de5b7e76e", "comment": "Malware payload", "value": "5b4695f409fef73b29814dbd44545de46c493e05b657f1ffd037df6103e03c7b", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353586, "uuid": "37b07842-e3cf-4733-b4bb-21cfee9cb3dc", "comment": "Malware payload", "value": "22582e004664975f6f912be40d9a9210729e1f2f", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353586, "uuid": "72994fcc-2a6f-4174-92f5-afd324c51220", "comment": "Malware payload", "value": "df96eea23d3bb1cd5f7e716284ba870ff6f39566145a73c903a46b690f4a9537a0936052c25a8d599eab412b795fbd61", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353586, "uuid": "4236ffaf-f8b2-4f1f-b04b-ba35f7684b6d", "value": "T11B140119B7E8CBCDE633C67F60BB6844C5799E1F784A9B7177AA759008BE0040827B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353586, "uuid": "7bd9efe1-acf1-406d-951e-538dac988615", "value": "3072:buIImy+86iUBJhFotAVj6t14xk4WfkR8dpsBTE+Jp27VXyAa3g5pSH/:umJ1iUBJhFotAd6XwklkWf+j27x+QjSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353586, "uuid": "21f939dd-c4c4-4253-970c-de15e96b56c5", "value": 191432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353586, "uuid": "aa366eed-5219-421a-ac37-76987fa50421", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353586, "uuid": "c7ee73ed-8a11-4eb2-b136-18d27a2ba642", "value": "sales contract 21-22.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508855f9-a433-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647330084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330084, "uuid": "941c6da6-38a8-458a-ad5e-c61e0a6f23a7", "comment": "Malware payload (AgentTesla)", "value": "39a7bb38df8cdb43e77bdd4de3aeb0bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330084, "uuid": "17f50fe1-6af2-4f7f-b9b8-d94ec8db2c82", "comment": "Malware payload (AgentTesla)", "value": "5b7442388f3f5d80ffc401971fc11bb916c7ef9a1d05debbf774f997534d0506", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330084, "uuid": "488cc11f-19da-476e-9a4a-c34dba9e6cf8", "comment": "Malware payload (AgentTesla)", "value": "24aa86112d5c998202b0e0145c954e61375304fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330084, "uuid": "cff125a4-1bc0-4c65-a91e-470c526154f9", "comment": "Malware payload (AgentTesla)", "value": "38eeb5353d2bdd6089ccf613d59ecf851281e2f5be970a73e0c0735121b8b5d5f1edbda0c5443944ec87708d83ce6b67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330084, "uuid": "1dd506d8-e2f3-47a0-9728-a94aedd3bb9d", "value": "T1131519A8B25070DEC857C5728A14DC34EF917EBA930F415260E73D9FA9BD9938F14CA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330084, "uuid": "717ce37f-e574-47ad-9df7-567cd6b96945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330084, "uuid": "63bb6825-6074-447e-8c56-49c60f969fa6", "value": "24576:6LaXWGOkCyt7k91UaD/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMM3:6LaWECio9WaD/MMMMMMMMMMMMMMMMMM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647330084, "uuid": "bec75a11-fe30-47b7-9207-a1c7dc8abfbe", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647330084, "uuid": "91a334a6-97b3-4781-9ff0-de41ba69acb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330084, "uuid": "196b00d9-b35f-466f-ad43-414baa8424c4", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb4057f-a451-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647343068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343068, "uuid": "edfa7189-e633-4b90-b95a-c46f39684efc", "comment": "Malware payload (Heodo)", "value": "732f980ef558543a66f9fcf71980d9e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343068, "uuid": "51ae9732-61df-49a7-b4b2-57bbf042cff8", "comment": "Malware payload (Heodo)", "value": "5b7dbc339b328951062196222e5d969cf7e803dc449e199e2caae322fecd12f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343068, "uuid": "49280cdd-b5b9-45ac-b254-4cc0eb5b80ee", "comment": "Malware payload (Heodo)", "value": "543237c2c2022b2c53859d5b50e210e14c8a9f89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343068, "uuid": "e3a8fb88-020b-4321-800c-efe20d58eb27", "comment": "Malware payload (Heodo)", "value": "7dbc8a1151b3339cb4bfa219b14bd041109255cff6ff2e0d15e337308baf18f6a29e80ad3c660aec5645367b2a968af6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343068, "uuid": "276a7640-f20d-4759-8654-fdb7efe56392", "value": "T1DA257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343068, "uuid": "261b0c8e-15a9-4539-b6c8-6432b4107304", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343068, "uuid": "7d17900a-cd49-4587-9da9-293204489e67", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYOVP6FuR6shQLj88F+Krf6:v6oycln8cACihP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647343068, "uuid": "50fba1cb-804d-4b76-abf0-082b61c0120d", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647343068, "uuid": "2b6f00de-17dd-480f-9ee6-b706ac22eefb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343068, "uuid": "97e3d62a-5454-484c-88ac-961cde76e072", "value": "732f980ef558543a66f9fcf71980d9e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4095116-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647353980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353980, "uuid": "bb66f7eb-7a73-4d4e-a44f-54c269b3aa44", "comment": "Malware payload (AgentTesla)", "value": "a1ce5490505b5659a228fe4696344380", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353980, "uuid": "8a583880-050f-4a96-a52b-717c94abdbc2", "comment": "Malware payload (AgentTesla)", "value": "5bb929e30fde449bfe361256dd20be0a469ca7c4363486b38de3468f7e1fa723", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353980, "uuid": "b3cdc381-d4d6-485e-b4b0-19365554e4bb", "comment": "Malware payload (AgentTesla)", "value": "7bddad0cd02ab93372652e392eb6173be11d8f4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353980, "uuid": "042422cd-6050-4a24-be2e-2c3c9d1073fa", "comment": "Malware payload (AgentTesla)", "value": "35f58a51e0e5f1fcfa7b257b18d35cacf11c4a3dd63ecf7d5ea40bf636e6c27b830da7bbc4804161f7e7252baa33c2d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353980, "uuid": "3f48c91d-14bc-4110-a936-cc2fe459dfe3", "value": "T184624D059BDE4637F5A69E31985312D00B7DE707B493FB3FCF88400ABA512584AD1E71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353980, "uuid": "200a0738-c23b-429e-a344-cd74df30e91d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353980, "uuid": "75ab36e4-bc63-440d-91ee-7781d2ac5cfc", "value": "384:KhCN4Typb9Jo7meAojEXhCwypiY9Z/RdqW/L:ECFnXhHy7dqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353980, "uuid": "60720af5-2623-46b9-b5d2-ab2171fa233f", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353980, "uuid": "7af722f5-93ae-40c1-9b2c-755e453b1a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353980, "uuid": "a85e43cd-f5df-4949-9857-a86950ba93d5", "value": "documentosDHL.pdf_______________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de4545f-a420-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1647321999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647321999, "uuid": "6c248dc6-c561-4cc9-bb88-8ecde32f4a05", "comment": "Malware payload (GCleaner)", "value": "b4c9e5e0d6c7bda7586e4c8cf80ce549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647321999, "uuid": "b370d1fd-9bd8-480d-a1a9-2c25bfd35af5", "comment": "Malware payload (GCleaner)", "value": "5bbc865f0347c81d627eaf6d11a2e7f34403b7ab4d12dd860af4b6fd650d41dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647321999, "uuid": "c2bb82bd-f8ee-4dcd-a244-62c5037ba623", "comment": "Malware payload (GCleaner)", "value": "cdb310f7417f150c0632e5739783b1d25b3a020e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647321999, "uuid": "f323f3e8-b3da-45f0-a58e-fb341d422af4", "comment": "Malware payload (GCleaner)", "value": "4b05eb485014a578d73708a0dc2f1db3300fa8c7f4d1f24740e7f73597348c2b264708d87df77cfb83ab8b1cdae79eda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647321999, "uuid": "d4c0dbdf-e2fd-4e5d-9a73-d69ea9273db9", "value": "T1B0763312B7F4D527F0F416775B5F12AEA4A8E06420D1276081843E4F34AADE4E5FEBCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647321999, "uuid": "604871de-7d68-46e7-8013-b3d210e6e068", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647321999, "uuid": "688a2b4c-d70c-43bf-a34d-9cfaf3797792", "value": "196608:JTQasSaycxELWYzIjTkDXAsVZW34fGZ3Z9wXjd:JTzUycxERzzDXTV1Gxczd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647321999, "uuid": "5f778732-cbf5-4b5f-ac4a-6066a8f921b3", "value": 7165809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647321999, "uuid": "9596f801-9c48-48e4-861a-0f3f32f24677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647321999, "uuid": "c600cc08-6897-4618-b8fa-a2014ef54f77", "value": "b4c9e5e0d6c7bda7586e4c8cf80ce549.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0c34dc-a473-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647357514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357514, "uuid": "30a49b2d-636e-459e-9ef4-0369cf19ccd4", "comment": "Malware payload (RemcosRAT)", "value": "400f3f8b43a0de170ae258521e256ba3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357514, "uuid": "f18da4c1-cc70-42e8-9f7d-3966f15c0cb4", "comment": "Malware payload (RemcosRAT)", "value": "5c374e1534ffb2f6ae7e6fc88f9034dcf475551c5813bed15458d94cb62767e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357514, "uuid": "d1091391-4fcc-4f38-9a8a-e17bcfae5012", "comment": "Malware payload (RemcosRAT)", "value": "6eb0a56727989b4da3d54a8e68c6c3f512da37c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357514, "uuid": "2caeac23-aee6-4388-9ec2-1fb97b0879f4", "comment": "Malware payload (RemcosRAT)", "value": "2203163c7ac0d0cc0321b77be421c9526b5e0eb01b01692f05e9649bf569a3ef277ec5b6fd9dd7fb897ef6d0e30da31a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357514, "uuid": "de8ed2cd-dfb6-4254-ad23-e4646e7e9d4c", "value": "T1C955F1AC32847E9FC527CD76CA641C20EB31747A9B07D203A11721DD9A5DBDAEE106E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357514, "uuid": "9250c8f1-3adc-4a81-b624-3855f46dc5a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357514, "uuid": "63654c61-fb5b-4be8-b807-06094edc3b17", "value": "24576:PBZwOZowjDOtE5lxuQQxqJZCVo0m1v00NjMENguiHUi:Prf2wj6t4lxhGqJQVoT1v00NjMGiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647357514, "uuid": "ba42be47-1fa3-41e6-bb8f-32fd83a2352d", "value": 1297920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647357514, "uuid": "30b21d77-21d1-411e-9971-5e984ac718b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357514, "uuid": "f4cb07e8-cf48-46e3-92c3-7a87064d9b2f", "value": "400f3f8b43a0de170ae258521e256ba3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327ffcf4-a456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647345066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345066, "uuid": "fe788e21-1ecb-4901-9c9c-c59d45bbc35a", "comment": "Malware payload", "value": "62fa4397665c234642de0cd966ba9305", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345066, "uuid": "4d813c1b-7330-4fc2-9555-b04ec2c4582b", "comment": "Malware payload", "value": "5c8074eb3f767399724b0f430c4697aa5bb509175c8e7f2f38ce2fc4df2914fd", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345066, "uuid": "905a6703-c7a7-48e5-a29d-97703d9dc4be", "comment": "Malware payload", "value": "8d95bb789941e4b86d8c740068f4cf87e5b2d4f5", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345066, "uuid": "02c3fe7f-dedd-4288-904f-d18c512eeb5c", "comment": "Malware payload", "value": "7d962c871a19b67cfbe5e9b35cb7f7fc5ab61f3c3e279b0df25ae22fc1be9a01110835d9142cca452b2f02b846ef5d26", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345066, "uuid": "702300d7-1a5d-4d64-abdc-f337a1aa9196", "value": "T104410A3842A2A149EC1D7F315753AF0A1FA1E6034458AC7AC24986A16D125FBEC83811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345066, "uuid": "52060132-8115-41a1-8fcf-5890f93ceeb4", "value": "48:9Y1TDh/IviVxxz/M/9z/FUH2eCcU1WkJqUTiLEmwZPSgi:6Dh/9VTzM/9/eClWkJ74EmwZqgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345066, "uuid": "7c32cdf1-74c8-42e7-b6ac-e96c6723f21e", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345066, "uuid": "cbfa9511-3f81-4c9d-9495-3ade793f2e2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345066, "uuid": "695022af-dd4e-4151-ad3b-907131423da3", "value": "accluso_169.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cd28eb-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647353817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353817, "uuid": "8b6b4c88-4c7b-4610-9f71-4d2900256aae", "comment": "Malware payload (Loki)", "value": "e2fbfd2032900459f5379aceece09d3f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353817, "uuid": "a90750f2-6c76-4cf0-96e5-3bda2958f26a", "comment": "Malware payload (Loki)", "value": "5d16321c416647ed6993eadfda354d3931f9bf42e1ef352609b3a583122f7db4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353817, "uuid": "5fcb453a-f8ae-45a0-ba79-51b6744fd909", "comment": "Malware payload (Loki)", "value": "70eca08bc29dde735d37bd35349bef2f5c290c5d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353817, "uuid": "7d16e760-8ced-4b96-a555-2c72514d9d4b", "comment": "Malware payload (Loki)", "value": "4e1ebf5ccabab8dd82a30731a562308ed644a58d375a44121d7f9163b15dc6fe87916b40a6ff2e387721f83f8d37b87b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353817, "uuid": "aebb36a1-8f49-4ba0-8831-a368878ece15", "value": "T14DF1D801E3F84B31EEB70A726897A2408374E7125C6FAF5F6944534B6E112D541A3FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353817, "uuid": "aeaae87e-82f8-42f0-b724-658c1c20d3b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353817, "uuid": "50f84774-ad44-4c84-aeed-2e9353e73f9b", "value": "192:S8MB5cvzjNWirqWoZsJhFguJcMdwdyUC:tMTcvzjPrqWoZkivMdwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353817, "uuid": "25ae87e6-a376-454a-b593-d679e15d79aa", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353817, "uuid": "9a2af4ed-cb9f-47c7-ad55-aca098e0dd03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353817, "uuid": "5186d8b1-0904-4c9a-9032-3c1d1719b915", "value": "DHL Express Shipment..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58726740-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353290, "uuid": "7b15d0af-2e64-4bfc-bed0-862c0026aef8", "comment": "Malware payload (Heodo)", "value": "26e5160765ae7f49f6c9a2126c92c409", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353290, "uuid": "7933fd3d-dc1f-4381-889d-5877b4c3429e", "comment": "Malware payload (Heodo)", "value": "5d4f1339c1259d9484f029e1f15941007b357beeb1fb9594cae2dc733fd0e902", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353290, "uuid": "bb4a610f-600a-443d-8d0d-447b6b5144a3", "comment": "Malware payload (Heodo)", "value": "d1cc790dcf214f5b49b1d69701199dca70496b95", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353290, "uuid": "267b30ae-d2a8-4046-87f9-11b94d8a6025", "comment": "Malware payload (Heodo)", "value": "9ac3ed7036420d5a3756db6849d3d0cf5d267a1ed0597f4e5a36a5647422f45de296397dd7c5204f956fa2354992a880", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353290, "uuid": "21cee74d-7965-4ca6-91ec-01a8b6487ee6", "value": "T1F733D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353290, "uuid": "3dda9b75-3e09-4a5e-9b5a-68690a98078e", "value": "1536:oAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:RcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353290, "uuid": "26c6b4cb-7fa9-43e2-bed9-23a333700abd", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353290, "uuid": "c6f17409-aed2-4e4e-88c4-49ece2fd9869", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353290, "uuid": "65cabb38-f97f-48c6-92f1-3b6c222ea21f", "value": "Omics Journal_4.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67687198-a40e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647314231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314231, "uuid": "d37f7b50-dbed-4cd1-9b3e-951ae22e284b", "comment": "Malware payload", "value": "94cb0fb79c783d4b4215c285c25ddc0d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314231, "uuid": "52eaf0e5-f774-4a98-bc61-0592e70b99a3", "comment": "Malware payload", "value": "5d6d28f55cf05f93f96d74f2e39a4d0809603051ef3145e4a10832e96b100f6e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314231, "uuid": "2c1a881c-2f19-4bba-8e45-6958846ee1e6", "comment": "Malware payload", "value": "06889baa8e3b4a97fc706bd3f5bdecd34d5961ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314231, "uuid": "30bfaaad-0576-4a3b-84bf-7b5ad9d83d42", "comment": "Malware payload", "value": "74eab8545a6c17140572edaf92e3bdf2bccf608a3918685a4da6cdd160686446ae8419da03116e83f1d6700c23c9a647", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314231, "uuid": "40042303-10bc-4d2b-9b24-40ccbb893c83", "value": "T19F721E892E229FEDF62DC63547B74E20635823E526E1AA84E76DD8040FB030D559F7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314231, "uuid": "06808100-189f-4e7c-a343-42d545225e6b", "value": "384:Ok1A7+cb1dU+OA9GigJL7+fvSFAS5cqRvP4qUMB:OQOuvi9fLB0vPJUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647314231, "uuid": "b6c29127-af78-400f-9eb4-88d869af52d4", "value": 16164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647314231, "uuid": "58e16c50-ebc7-438b-a37a-74a250f6c46d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314231, "uuid": "fa780660-b5e2-4392-8e80-e07bdee6876c", "value": "Ugliest.mips-20220315-0317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bafcc2-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333768, "uuid": "ce6715c2-0cd1-4334-abf2-c0ddaf347a2b", "comment": "Malware payload (Heodo)", "value": "0821a936b1afa6e848626d1e6aaf1321", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333768, "uuid": "50ebe144-3d40-499b-9712-786e7b1d7b9f", "comment": "Malware payload (Heodo)", "value": "5d6e4f8470057ffd5720906b1c9f448d03a9bf2eeb42ce27fac391771cb1eab2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333768, "uuid": "cb5afb63-604a-4af0-8f01-b387353f46d3", "comment": "Malware payload (Heodo)", "value": "fbdeb40071df6ec689369deb468190c56bf2e7f4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333768, "uuid": "32e2e804-4c3d-41d2-a971-0ec1d69cccff", "comment": "Malware payload (Heodo)", "value": "4e39a69e1684549746062b50a4dfcc656a3a107f530c703119ca5cac81825f82a99bbff75a0ba96c971184b39254da95", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333768, "uuid": "f7d56df2-0952-4f7d-9667-f16f2cfe8a4d", "value": "T19673E11EC522E19DCB2700BDD2CF4FEB948F75153AC0E47A93C0E94D2B4895AA74E64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333768, "uuid": "35c1529b-1275-48bd-8706-47cbc56f3f85", "value": "1536:+S3FXUcSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM7VI0E:d310tzSmICpH7OZuvZGsMnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333768, "uuid": "3b7a2f34-5218-4087-8461-b4784deef575", "value": 76170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333768, "uuid": "a2090b5a-4359-4d7c-b359-38b5d3d2cad0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333768, "uuid": "3c76c460-c220-4031-bb8c-292ff6486ec4", "value": "475.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d55273e-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647326159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326159, "uuid": "b133acf2-72d7-4712-849f-f4f1e29e4ae6", "comment": "Malware payload (AgentTesla)", "value": "7ff1f4f0f25e6613a3b9dfe3e7bdd418", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326159, "uuid": "c370654c-6b6d-4d5a-a0b1-948f9195cf83", "comment": "Malware payload (AgentTesla)", "value": "5d9aac3c7656c034273bd7f2095587ca82dc649c18befd144db0ff5fb5c93936", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326159, "uuid": "88d79755-37c0-4560-9dbe-120eceb45642", "comment": "Malware payload (AgentTesla)", "value": "876f79625fccc4ff5003a6f6159eee7a177c3f17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326159, "uuid": "0fefa511-a2a6-492b-abc2-4f37d3963076", "comment": "Malware payload (AgentTesla)", "value": "a1baa3ff3d1222cb84d06d8205219bfefe6fa4fc7b293191698094104867ddc8ec6d09c0920887e318df83be025e9489", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326159, "uuid": "6e5591bb-10c2-464a-922f-c12224988eab", "value": "T135D423E957656825BCEB531E8D3B56432282EC91AFD55221A00CB0F9F0B4C7C3CFB59A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326159, "uuid": "abf42918-4565-4a72-aa3c-be4c8fbf57fb", "value": "12288:Ze43hilXvNNhNYf/V+K+4oFsLh4t9vl/217kctmzGw3Tniuw5VDqmsG3:Ze4A1hNdP4oFg4t9V26ctM7TiuwTB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326159, "uuid": "0b6bc758-3369-4b70-a516-47c4ed409e10", "value": 628537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326159, "uuid": "8110fb18-3162-45f7-b9c7-b1d0bd798f81", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326159, "uuid": "6f699117-f896-499c-84af-5dd93a617ef1", "value": "invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7856a66e-a459-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647346471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346471, "uuid": "8d33da3e-4e9a-4647-bb05-2a24dfc82dcd", "comment": "Malware payload (Heodo)", "value": "5af023821a7f2971e796395b4cc2f300", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346471, "uuid": "699e97d9-df3f-458b-8f94-0cf6ee55b75d", "comment": "Malware payload (Heodo)", "value": "5df60f2fde243f2e884089c5c19335a22e25d56ec03dd1b3b2f3be0160201467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346471, "uuid": "2dbfa55e-4ff7-4d4e-8805-0a06f4e011f2", "comment": "Malware payload (Heodo)", "value": "8333ff0b924808d493718ab432201ccabf295df9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346471, "uuid": "b42fee76-0c77-45ce-b17f-1ddfddd765b7", "comment": "Malware payload (Heodo)", "value": "cd1606ee368c11ab5a09c0742214bf31e1fe3e46f0f6a6f21f92120002a5cf2867f603aad94064165ecfe9cbb324ddcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346471, "uuid": "0066b0b6-e9ed-4bdc-b5af-d4418f39be8e", "value": "T16F257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346471, "uuid": "73df8f03-85b6-4385-ad6e-e68880373298", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346471, "uuid": "e06be4d5-9cef-4d09-96c1-76f325168cf5", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKl2OlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8ql65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647346471, "uuid": "f8730aad-322d-406e-b349-a98d14adbbd1", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647346471, "uuid": "6dab078e-85af-4014-a8c1-57e1b1134c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346471, "uuid": "6c6910f3-6229-4b0f-86d8-fb8db882af74", "value": "5af023821a7f2971e796395b4cc2f300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39869564-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647354527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354527, "uuid": "62185478-d823-4967-b798-5371e74240a3", "comment": "Malware payload (RaccoonStealer)", "value": "e76a72943fd90042a8e1e3df2b5d4280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354527, "uuid": "bdf90c0f-17d1-455a-81f5-7912f0555c20", "comment": "Malware payload (RaccoonStealer)", "value": "5e2c211900e145c9aad6d6970858eebbadf07ea9cfb517deae7e5edc66e41cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354527, "uuid": "485fdfcb-8e07-43ea-8230-1def012878a4", "comment": "Malware payload (RaccoonStealer)", "value": "724382a0fd9cc3e6bbb2eb6dbae2dbe57d223cad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354527, "uuid": "afff51f3-26f4-4d96-b12e-7af1dc8fdb00", "comment": "Malware payload (RaccoonStealer)", "value": "44cec2856a477dded11d715049a50469705e6656a60da29e125c03cf08fe51d3b87d89694681a51e65a80305e96ee72e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354527, "uuid": "113bda21-4d0e-4ca7-86ca-fe48c6580581", "value": "T13AC4D010BA90D036E4B726F8457A936C6A3E7DE1973454CF22D56BEA57386E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354527, "uuid": "7c8e31c8-4600-4afe-aa71-9ab5210acabb", "value": "15365c930d750ee03adb61a7b335702b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354527, "uuid": "7b215429-a864-4d35-8725-a1d7f062ef90", "value": "12288:t5r6noYaP903/Go6dotSH+YUZhiE3EhMuYldeCOXl+4sFJjbp0:LP9O/p6ASmhizhNWOXlU3p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354527, "uuid": "2fd84cbe-2d9c-477b-9c51-27817730207d", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354527, "uuid": "f3553ace-b3bc-4cab-b805-008eb5292ccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354527, "uuid": "9639856e-1af3-44af-8d71-0c843ccb8e8f", "value": "e76a72943fd90042a8e1e3df2b5d4280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b05615-a4ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647381815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381815, "uuid": "a10c90d0-7e79-496e-be93-64eb123971c8", "comment": "Malware payload", "value": "88a9779b11d87908996b01426c620d2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381815, "uuid": "ee0f2008-df98-4775-86d5-cc619a5cd99e", "comment": "Malware payload", "value": "5e511a704dd4eaa8132e696e7587aa8a4add4dbca6b9a010ce866678a3b6699c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381815, "uuid": "86a0a06d-9803-4b74-8e24-82dc4d9d7151", "comment": "Malware payload", "value": "09d48a72877ea8786f86af6a2a4dab6bbfb02e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381815, "uuid": "7e9471e1-9b41-407b-b403-67f867432be4", "comment": "Malware payload", "value": "a5edacf8bfc620a0c514a00f47acf6dabd17c903ca5c65931b1961f3e89fec8797fab61672200e265698271970bd8a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381815, "uuid": "7daafd2c-19d0-473b-b3a9-7bb7bbb14af5", "value": "T15C23B5DE77E4CFB3D2D95B38D0A2B2802338DA2A3A17FB575948053A4D233D52E60657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381815, "uuid": "beeb2483-319a-4236-ba08-6a3939e14951", "value": "768:xeyEJEGzhak960YV3BRYq/45BBJCPv0wVE354aU9w2P5GwId7:gyEJP1a66p3NG4v0wVq54aU9w2P5GH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647381815, "uuid": "47a847dd-c67f-48ac-a25f-1e9191e483d1", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647381815, "uuid": "09de5feb-83e1-45be-85e4-e5af9f919eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381815, "uuid": "095e0c2a-bb09-42ed-ba87-b680a72cfe62", "value": "5e511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f281866a-a41d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647320907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320907, "uuid": "dc898ebd-3b9f-4439-9893-5ea40642ea6f", "comment": "Malware payload", "value": "10962f55a36fbf4399d62eb4580888a0", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320907, "uuid": "503530a3-2104-4c34-a051-b0f203fd892d", "comment": "Malware payload", "value": "5e6a23666c298879aa7f5d4dc86dff25b4779e4874e62c0d537966dd0e976bf0", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320907, "uuid": "1a9f345d-da63-4710-9914-c3021efe80b3", "comment": "Malware payload", "value": "b16afa1ba86bdd7608065865ebe653ce94407b0f", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320907, "uuid": "320584bc-68a3-483b-8456-d570f736f029", "comment": "Malware payload", "value": "e925324674e72ae65330cf33dac34b259a3bbe18ecc76bff80f018de5b50d4595df19be82f59c49f8d13182b8e9ca40f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320907, "uuid": "ea5a10a8-02a2-49ab-8e88-920bb72bf1ec", "value": "T1D8F2AE28CD76509AD17ED1B640AE6780A8A63F576900AB3F213D21D40DD1DEA9F1FB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320907, "uuid": "3c2713cc-7624-4533-ae70-27eb83595da5", "value": "768:edhnVhkjCBRp0JtYCUaCrFwBMHoyL6bTPMOG+v:yNVhkjYQbYCUaCrFw2IyGfMOjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320907, "uuid": "03006d82-2b4b-4fd6-b209-a09a204464ab", "value": 35395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320907, "uuid": "a3f67778-463e-4139-97f3-96052912148b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320907, "uuid": "258618a4-0835-41e4-86ec-f7dc9909b566", "value": "Sheet1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ad453f-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647352928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352928, "uuid": "d9dc3571-ba29-42ef-9152-07472b8dfe62", "comment": "Malware payload (RedLineStealer)", "value": "71615dd59bdb9fa6ba023db0b24cc0f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352928, "uuid": "037b9e3a-00bc-477c-9904-1f3da6ffa53b", "comment": "Malware payload (RedLineStealer)", "value": "5ef622c593d42132ff3adc54b2507032150d5632a6459523108d01c0ec7f8eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352928, "uuid": "f3e3c990-ed04-4b14-8619-b765bd829c9e", "comment": "Malware payload (RedLineStealer)", "value": "9acc0d3e2a32ada08bd520f063bb86523c37675c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352928, "uuid": "821d315e-d242-4421-b17c-d08b9b8c101b", "comment": "Malware payload (RedLineStealer)", "value": "2b877182baf72f7f50faefa20654319212b9056af3ad0293ba482b13fc1e27f3d187848bdda8736c6a6edbaacd80b4af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352928, "uuid": "db8406f6-b627-49b9-8ec1-dbab19065072", "value": "T134549D10BA90D035E4F716F8497A936CA93F7EE19B3054CF62D52AEA56346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352928, "uuid": "c04b2dea-015a-4896-b000-7f790e897a27", "value": "1a72927bac711ac16868d3b02bbb2c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352928, "uuid": "57423622-bd03-4a51-80a1-745ad04ab5d0", "value": "6144:/ru8+FC/wFZzMys87WoBWpyu9i3dbIl7x6Mo/uPq:/C8+SwnzMysQWoBWpF9uo7Ikq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352928, "uuid": "04532862-445a-4609-ae60-5739bef1e6b6", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352928, "uuid": "8d4cb460-5a3b-40d1-be05-32a7e04e0be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352928, "uuid": "5e0d33ca-1700-430b-a367-470b621e2187", "value": "71615dd59bdb9fa6ba023db0b24cc0f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6675e117-a40e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647314229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314229, "uuid": "ddb4ef53-df8a-4269-86d1-69fd37ef08da", "comment": "Malware payload", "value": "d8b0acda07126e72a373d6fdd3c8686d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314229, "uuid": "52e2a904-1ede-4740-b1ff-04b279bc6580", "comment": "Malware payload", "value": "5f3b9b5ef9fab8df5cc5cf3b8400a9aa5b44399034d0056c2afc122e4aa6008c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314229, "uuid": "b7a2b227-b632-4083-add6-75042ef2a99f", "comment": "Malware payload", "value": "dc50cade274a76f1b6f2df94d6c12a2f0845ecd4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647314229, "uuid": "fa06a383-52c7-4b0b-a2f6-a2898ae3f17f", "comment": "Malware payload", "value": "700ee6e10f947bc9e3c6d0f0e06b8fee417fa86dfe9ba8d1a1824c4baeaecabcb891a80fad04ffefd5541d5e7a6b2e5a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314229, "uuid": "c79355cf-b3d0-4c3e-a96e-e7d6fcac43ad", "value": "T1BE32A4D6B9428A17CAC49237FB0E82897F26670CF2EE33036B176F5065579270A6A449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314229, "uuid": "8c0ce437-e61d-4874-81bc-5c5f37a40d18", "value": "192:q2fxUodDX6HwHs5wF9jrr6OyTgev5+VG8bWJHb5B08kEZx4e4x:q2fXDqG59jrr638eQETB08Fx4ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647314229, "uuid": "09b4a000-4d8d-4c3e-8496-8fea2d6c2c0a", "value": 11820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647314229, "uuid": "cb37d27b-73df-4861-9af3-5fcb33e22dfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647314229, "uuid": "834a1cb3-b55d-4444-8aa0-cc95f0476775", "value": "Ugliest.arm-20220315-0317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0ef5e5-a49c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647375173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375173, "uuid": "6d2af374-7061-4587-9f08-3dfe605f1fac", "comment": "Malware payload", "value": "20ede056f9a1313ad85684f51eb1a05b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375173, "uuid": "282c3047-d558-4009-b298-20270ea18bc8", "comment": "Malware payload", "value": "5f58bd89e7206e8964e2f14f701dccb471ac7a87108246ff1de99fcb726135ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375173, "uuid": "d3aba0be-a655-4596-b0ae-8514b4c1825f", "comment": "Malware payload", "value": "87d8c6811c82e835cbf93b011ba93466e0dd6b4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375173, "uuid": "21e0bf1b-583c-42d7-bbb8-5d045e407815", "comment": "Malware payload", "value": "3fdebe96a5a91b1e3e995eb006828373435b9ea167b28d0a89f0a30cc5021c35aec6cc5c32f5469a1dfec1ff06955c14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375173, "uuid": "ed0b3aa1-5746-4420-8cf0-916dea19ade3", "value": "T149E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375173, "uuid": "110dd0b4-20cc-4431-8866-53f9c66fb9da", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375173, "uuid": "3243c076-d343-43df-b0ef-ceae25e1c209", "value": "12288:E94YBCR2xP7guDo463OP4eRsiSOZjb2woE+MhJT:2kRAguDogPlddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647375173, "uuid": "0961edff-c232-4743-8915-1a7791aecd87", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647375173, "uuid": "3779aa1f-d5c9-4d4c-a3d9-15574005f667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375173, "uuid": "4dedfd53-d57a-4a2c-8ebb-389ca1b6d8da", "value": "20ede056f9a1313ad85684f51eb1a05b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de80b12f-a450-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647342777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342777, "uuid": "5a427490-e047-43b3-b7ac-bf4bfd741a5c", "comment": "Malware payload (Loki)", "value": "1fb8a4ad120e2e89495348c8c1228e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342777, "uuid": "5d020534-4638-48df-8708-3ac0420f4688", "comment": "Malware payload (Loki)", "value": "5f7348113cdd2864993d21969192230a2b3b23ff291c147ef81706894662a9e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342777, "uuid": "9fbb883e-cb9f-4af9-9b89-86957b96a0eb", "comment": "Malware payload (Loki)", "value": "d1c77b04c48ed42648e8532ee446c6014776d45b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342777, "uuid": "a4ff797d-3a0c-4bf6-bfcf-3aed71ccd887", "comment": "Malware payload (Loki)", "value": "af78c9000c55853db6a3edab703e3a3eed478f73fe9a86a759cac1d9559dac6be4b392b01cd5b8e475a8c74878a91501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342777, "uuid": "cce0560f-7754-4f2d-b054-3af4b0f51158", "value": "T1F464238FD1E68DB3C2704972987B16FEF77792C0051641974BB52FBE7A02C22069A6B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342777, "uuid": "ef6f6228-c87d-4275-b1fb-b72c64a0b440", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342777, "uuid": "d74fa7cd-8df4-4406-8c68-a9c01ea2e830", "value": "6144:rGiLjJkdEc+AxFzhwX+I13ee7q0zv6HX0FvBH085OE8lAKeG7:9kdEc+APhc97fzvPFOUFKL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342777, "uuid": "be41eb54-805a-4188-b2eb-9cc863d9f6f0", "value": 311832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342777, "uuid": "3c6caaab-5672-4095-974b-469a35aa7175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342777, "uuid": "df4bad8d-14df-4fd7-86e1-4a22b2a89525", "value": "Pre-adviceREPORT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0857c360-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333828, "uuid": "1dde211a-bffb-48a0-9524-3b0e3a12b7a2", "comment": "Malware payload (Heodo)", "value": "26e73de72077229f89194d5141aea2be", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333828, "uuid": "6a41f6f9-3e13-46d5-b867-93882a8acac7", "comment": "Malware payload (Heodo)", "value": "5fa3f9fe297f93ff2171f766ec779f16f20a581270d097ceadce6f3106f4298a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333828, "uuid": "3c2f68a8-83b7-40d9-a333-a2c2d0b3794e", "comment": "Malware payload (Heodo)", "value": "bcd09ebd719ce1969dd0f2dc59a80c65089d8035", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333828, "uuid": "a8b626fa-4c39-4851-a86d-3314ea4cd53d", "comment": "Malware payload (Heodo)", "value": "fdccf214c07b98e24ac91c34140e0af391e16568b3c62d511f748253a4da98a7f46cb5ff218f7dc82c1f474cd3f96046", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333828, "uuid": "3b8527cd-b8f4-47f1-b3ac-1be89ee00267", "value": "T1C433D00F9A22B5ACC3136C3CCA8C55F9650E5592A0C9F72B08857B9C7B1B1E7179F282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333828, "uuid": "14e50c66-7bb6-4f7b-a30a-144fdcd631cb", "value": "1536:kkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:9cEe2Kd3zdtdEwo/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333828, "uuid": "42f2df0d-cca0-4f84-affa-a7222c365bb9", "value": 50643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333828, "uuid": "4ea78e71-b527-4732-b719-b8daabdcefee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333828, "uuid": "00591abb-e461-4478-a2fd-827ab0587809", "value": "PO 03152022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b2400c-a491-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647370521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "658f5fea-0cc4-48be-8007-cec899caf997", "comment": "Malware payload", "value": "7592d584f82062e67550d9252d0b176e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "4fbc8f14-ad3a-4574-ab11-3cb643e55ac0", "comment": "Malware payload", "value": "606c5d81dc27ab1870e59c9311fa69c699fb1fd52d2c5e527f27588201bd36c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "7a8bc359-d028-4fff-8929-2861e8a5b08f", "comment": "Malware payload", "value": "b57b70d5bf3a286f4c04df8eec3c4fcf55e9d409", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "768ddeaf-26ca-479f-a023-c30e1ae477bd", "comment": "Malware payload", "value": "0d3c74fa7969f8a252238e53382a8a37ac38322a4ead0dccfd3240b4aac96c60f1ceb9e89d84055cf0dce75b2d54152f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "5f57560a-8140-4d11-af02-e2ab87b2001e", "value": "T1D7E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "db64b4c4-934b-42d7-aacc-280d740074b4", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "0551ce5f-ab2f-4c62-96d9-0ecae480d1cd", "value": "12288:KFxGsTPy4BHT4Sj1zf/f7ABqDLkWynCsZ:obPy44Y1Df7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647370521, "uuid": "633ffae7-64a0-43e7-ac20-84136d30fd4a", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647370521, "uuid": "280b9a22-6fd8-42a6-bc10-09599a787f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "7a1e193e-5a25-494e-ac20-8b2b366afd2c", "value": "emotet_exe_e4_606c5d81dc27ab1870e59c9311fa69c699fb1fd52d2c5e527f27588201bd36c2_2022-03-15__185516.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c684a3b-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1647354048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354048, "uuid": "944fdcb7-8772-4410-b2e9-b969277e4f63", "comment": "Malware payload (STRRAT)", "value": "acf485b090a2af4f945beee9418d53fa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354048, "uuid": "602368ff-fb9a-48e3-8abb-68fbdcdc7428", "comment": "Malware payload (STRRAT)", "value": "60e0cc24b4f61cb3968e9244cbeec129dee8d5b72d157ebc727d7589634fb863", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354048, "uuid": "f0e8c02d-2f19-463e-90ff-969d5f7cff5e", "comment": "Malware payload (STRRAT)", "value": "e24cc07861ec4f7677bfb1454b28740350f8ac46", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354048, "uuid": "b9acbc0a-fa32-49f2-a2af-f2d4a83f3e6c", "comment": "Malware payload (STRRAT)", "value": "7e38f7cd66d20c336f43dc8e1c8ae8b568a16fbf383d590b53aa4b548119e97b0afc384edb968286503776657c752cfc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354048, "uuid": "a53e7499-0388-4ba0-9a8e-f9b87ef9172a", "value": "T1FC0413BB800B258FA684CEB06FD5F06262C9A54D36019B877BD141341BFE171A79BFC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354048, "uuid": "6173120e-e6a4-4072-a408-4affbeda05a6", "value": "3072:FqiTyG9SZFVPruEN0vlLZ99qY//inOIhiMQB2pJwiYWlu8YweOQ:4iTyGaFZuZZr7SOIhi/BSwl8QOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354048, "uuid": "b5a2a662-6f81-41c4-8320-a5b8d4b2ffc2", "value": 179903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354048, "uuid": "5d4b035d-fb96-4516-a424-0768e6ad2399", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354048, "uuid": "e41c17c6-7445-47e9-85f0-fe9f76740ba0", "value": "000288046 __ 99210013 __ USS2055D __ pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030fc9b0-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647354006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354006, "uuid": "1a8b0db1-349a-41d7-aa76-3e0feb2a5646", "comment": "Malware payload (AgentTesla)", "value": "3f65e3ab6c0a077b136cb7f557f21c39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354006, "uuid": "e7aa1105-96a3-4655-bf4b-ec0e5ee01c7a", "comment": "Malware payload (AgentTesla)", "value": "60fb10be5bca1015759f879b6f5d2efd21176ee8cb5067b55b312c8e71f1b728", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354006, "uuid": "beb8495c-5af0-4244-87f8-f134f13b2df6", "comment": "Malware payload (AgentTesla)", "value": "b90ebaa952686c592762c99df4de4fc39939ed60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354006, "uuid": "5352cd67-f81c-4f6d-a71d-9f4adb125c97", "comment": "Malware payload (AgentTesla)", "value": "026afa53dfdb41ceaef5aa3467f022ddc192448a1bf95577018582735e7459f74b2b46b1d12371194e8c42196ba2afd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354006, "uuid": "f8fb91f4-efe8-47d9-8ad0-7b8630e0de14", "value": "T1D98501AC32907EDEC623CE36C9641C18EA3174BB6707D6039107158D5A5EBEAEE147E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354006, "uuid": "727c597b-b0da-40da-b968-ff9f2ac295df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354006, "uuid": "15003257-6225-4908-a8be-66ae9cbb6502", "value": "49152:eftgEnR8MKEep+wl222lzXnkZwLH2HDTzuujk:cR8NEep+BzWKkyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354006, "uuid": "71cd7012-896c-4b98-9c78-56135fff1ace", "value": 1801728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354006, "uuid": "b92492ba-33b9-4eb7-8c91-9592ccb0aa0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354006, "uuid": "59fc8b73-a6f8-478b-b2dd-fd476580c25a", "value": "Halkbank_Ekstre_20222501_073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f56a920-a47d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647361945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361945, "uuid": "dc473c7f-f4a4-4fdb-a35e-0cccda40597c", "comment": "Malware payload (Heodo)", "value": "5a87bb1985bd1a7fa6b6356c111197ec", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361945, "uuid": "0029b526-8b66-455b-9cce-aa9af4de307d", "comment": "Malware payload (Heodo)", "value": "61180ae417cb0b40860d6f575c502d581b0eb545cf574f2cf34a08c11168b580", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361945, "uuid": "27be8111-8b97-4e92-a2bb-9632ee0930dd", "comment": "Malware payload (Heodo)", "value": "1348e737b6b65db7ccdac3586756a676c0e362a6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361945, "uuid": "fff74ea6-9f1b-44c9-bcd3-4fe2ac3416a0", "comment": "Malware payload (Heodo)", "value": "94136195e8b94913d7fba1a4faa68b7807fb146525ff46ed60cfe64c4e06ede45b4c0d8d3cc41690f2ec859b4f5c3eeb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361945, "uuid": "009159c4-352b-46a9-a027-f3f27c48d767", "value": "T18E33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361945, "uuid": "290cfcff-d262-41b8-8216-434acf20aaf8", "value": "1536:0AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:dcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647361945, "uuid": "e060abd5-d7ba-42d2-916f-a339eed025f7", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647361945, "uuid": "a1f651ac-0e36-4c87-b8b2-93ff0a4d0a16", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361945, "uuid": "47f05812-85a8-4262-a971-0cd4e880ccd7", "value": "Rech 2022.15.03_1602.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6288e2a0-a49d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647375641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375641, "uuid": "006348b0-431e-4831-8a73-fae7d5df944c", "comment": "Malware payload", "value": "a735dc9b5ec33e2443f8dfa9a474fd10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375641, "uuid": "f971da04-08a6-439a-9a79-b10324ab09f6", "comment": "Malware payload", "value": "611ff609b34b53ae5744ec6f9e8055e398375e228f3fca00a87b6d53db564623", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375641, "uuid": "fc1ddc62-5b10-4221-bc1c-a4de07d353bc", "comment": "Malware payload", "value": "2990ac090cd3590d8018adf6884e803aa521c705", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375641, "uuid": "6071e1e9-cb34-4594-b5d3-8e48933caf65", "comment": "Malware payload", "value": "8e95d3c8018681d221a617350316935b1e8ff46e5395d62dc4dd84fd9b3295e6e1d2318cd5fda5e42df2cb99b1ccf425", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375641, "uuid": "e7917e74-5aa0-47fd-b161-28b29baeecb0", "value": "T18EE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375641, "uuid": "2c5e5087-8c1c-415b-9dd6-0d052082fc95", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375641, "uuid": "5c9241bc-e203-478a-a76e-4f40770e9407", "value": "12288:E94YBCR2xP7guDo463OP4eisiSOZjb2woE+MhJT:2kRAguDogP+ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647375641, "uuid": "bf60742d-0555-41db-acdd-b826309e0831", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647375641, "uuid": "d49f8bfd-1af4-4cc8-9840-dde64cb8413a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375641, "uuid": "88938c11-1684-407a-8654-1e8cc45b7b6f", "value": "a735dc9b5ec33e2443f8dfa9a474fd10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360bcd0f-a41c-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1647320161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320161, "uuid": "227bec6e-4e99-4078-8948-dd864d096102", "comment": "Malware payload (STRRAT)", "value": "975b8a4f9bf5b73ccdb7bb19f01cbb08", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320161, "uuid": "1f9957ce-6285-40dc-9824-471f9a8b4975", "comment": "Malware payload (STRRAT)", "value": "616f800f4ed411bf17150ed4acbff693cb7c980593d87234db63d95444e99280", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320161, "uuid": "87ddbc83-20ae-4431-b3bd-ddd9a616d7a0", "comment": "Malware payload (STRRAT)", "value": "fed1d38bdf96d21a5f33f8533c4264bde90eccba", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320161, "uuid": "525516e8-cb39-49a1-bc49-f5670550a7d1", "comment": "Malware payload (STRRAT)", "value": "768bf8efb4047655c4e880bb983207663edc1cabf57be467ee875e0d804c53a32fe0da43a901cea7db85cd2068729063", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320161, "uuid": "cc5fce1d-a195-4526-b618-a4cb3a37531d", "value": "T1420423888066941FA8AFF8BD26FD35D961F88D347BEFD809EB42742F41E080591DD3A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320161, "uuid": "61a637cb-34a4-4099-8d3e-78963c9f2c6a", "value": "3072:DSf5ZkQvmIM+IljMJb9HyPb9X+SYut7BoX7Oek/NZtIpQFSsM5wR/KnckYKpF:KZVrMT5UC7B0iRZtPZRru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320161, "uuid": "6d0e73ae-8274-4460-b9e8-9145299ee450", "value": 182678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320161, "uuid": "f9f0c205-0479-4f73-ae75-7e039fbd55cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320161, "uuid": "79487a46-fa2f-4770-b6da-14f3a39acf90", "value": "PRE-ALERTXMAWBX057-05763984XXAWBX057-04914954.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b9b5d6-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647363325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363325, "uuid": "38c997a6-b636-478c-8908-2295474c84e4", "comment": "Malware payload (Heodo)", "value": "1a35448ac39394302da2bbef99977874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363325, "uuid": "4743f977-7f91-44a7-a11f-3c2180902fba", "comment": "Malware payload (Heodo)", "value": "622a40eb01fb29ee6b2e7ac7dcd594f3555f9a082938aa5cb31ecc66d22033f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363325, "uuid": "da80d83e-fad5-4a28-bc6a-b6b4cc507275", "comment": "Malware payload (Heodo)", "value": "12f60e944e3f7516074b211b17040587cb92a425", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363325, "uuid": "78f00c7c-8588-4c62-8e7f-3c1584ff8d6b", "comment": "Malware payload (Heodo)", "value": "c2f51e687cac4be2fbbe2140c51bb860a2f964eb18d5bfc3da3ec61371e2a32cba713ac1a051a0e7f8f1d1357891622f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363325, "uuid": "7d1bf2cb-8088-4ee5-af2a-6483f629bd71", "value": "T174257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363325, "uuid": "3cbabc30-cca3-4fc0-84b1-e03545cc10e6", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363325, "uuid": "57e234a8-ffa3-46ae-870a-6cde473ad8f8", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlTOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Pl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363325, "uuid": "c423f51d-a7b2-4919-84c6-2393cc07fbfb", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363325, "uuid": "3af374df-a528-473b-90e7-6916003761ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363325, "uuid": "64e97bed-d500-4e3a-906a-9dd4854876f5", "value": "1a35448ac39394302da2bbef99977874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ab0af4-a466-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647352029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352029, "uuid": "9fd99d68-2885-4cca-a8b8-a1a48c704448", "comment": "Malware payload (Heodo)", "value": "2029fa7c72043ef187f6bc8a6b4ecb1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352029, "uuid": "5381ac91-9ecb-48f8-9a11-a5ce87b3975a", "comment": "Malware payload (Heodo)", "value": "62784e7dd30695c7232a4680f3dbf739dfcdbd0f962722b502b376036ba7cb0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352029, "uuid": "60b2a997-38e4-4921-9cb3-45dbfb6db4fc", "comment": "Malware payload (Heodo)", "value": "9ea0b3f37d3259680b497bfd195ea3160e319712", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352029, "uuid": "fe3ac378-f475-4b97-9eae-daf08eb04305", "comment": "Malware payload (Heodo)", "value": "28be0e712887a7d1a22faaa447f73b1fa46164de1a052d388990bc1e996b92a40e561e7270172237fb493e9604feada9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352029, "uuid": "f6216efb-922a-4fa1-b81c-04ac04f33e99", "value": "T1C3257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352029, "uuid": "cf3f4ac4-3531-43af-94e6-f4ddf7670e07", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352029, "uuid": "dd0c4b5c-8b20-48b4-902a-91c080aace8e", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKl7OlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8vl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352029, "uuid": "73c08529-8712-47c8-bed0-73d1f4d37e60", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352029, "uuid": "efe6c236-c506-437c-8a1f-79c2f72ac293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352029, "uuid": "cb168056-0809-4f9e-816b-3fbef7a3407a", "value": "2029fa7c72043ef187f6bc8a6b4ecb1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9c0ae3-a430-11ec-9275-42010a9c0029", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1647328785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328785, "uuid": "0e8ebfc1-ebdb-4a57-8b66-021c0036ae28", "comment": "Malware payload (Downloader.Upatre)", "value": "e651891d0eac7f268643d7dfd62b6de2", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328785, "uuid": "f505403e-7513-4969-b2bc-a7d7709173cd", "comment": "Malware payload (Downloader.Upatre)", "value": "63648f8b06c84b6ca4fabeca17995c1f1cc0d3e68badd775ebe3cfd9327c2d97", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328785, "uuid": "6fa77527-fb63-4ed7-ad9c-dfb42b5a4001", "comment": "Malware payload (Downloader.Upatre)", "value": "db70655a05d47d78fc9b36c9448fab0226904c77", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328785, "uuid": "15b2c569-1b7e-4e94-9a49-5f6566dd66d6", "comment": "Malware payload (Downloader.Upatre)", "value": "7dda9196d1b063b590592639e9e43b0cb925824c062e15e5087ea90d8508ea1e93b0e42a42090464a6a0cad64f729127", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328785, "uuid": "fc9b460d-99de-4ec4-9170-e4030d222ac3", "value": "T10ED247786AE95672E3BBCE7589F591C6F975B4233D02D80D00DB03840C63F66EDA1A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328785, "uuid": "5b92379f-46cb-4c4b-95af-12a857597eb6", "value": "dbedbd02d04be04f074d5cec09129e32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328785, "uuid": "5fb26373-4dd5-4890-8897-87371d5960e8", "value": "192:HymTSrQWRIcSvK0OmoarauG+k7v1dlD/W8brAvgigbNPXgt1yUgYxfil7IYpedYi:HxTsQWRIcS1forPBnDDKPSXZU6p8xma3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647328785, "uuid": "e9fe0430-9012-4182-b2aa-e2f359a4c19f", "value": 28954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647328785, "uuid": "09fb64f5-89c8-4e56-9f14-dcbe9c7d85a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328785, "uuid": "105cb08a-b071-4177-a139-5afc87773189", "value": "gds.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aac529c-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647352730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352730, "uuid": "a5de462b-c27f-4ddd-9f01-03490afedc03", "comment": "Malware payload (Smoke Loader)", "value": "dd5d9233243615880d176a798cd520b0", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352730, "uuid": "5e5d222b-d49f-4164-b488-7baed2d654cf", "comment": "Malware payload (Smoke Loader)", "value": "63ee1526eb71b0de98c9cb03a0ba85607d67985db61fafd227a996bd3adb9c10", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352730, "uuid": "175dcd4a-1748-44a4-afcf-6f0d22a275ed", "comment": "Malware payload (Smoke Loader)", "value": "5ca15439d0af0612ddbf0952833cbce058fa636e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352730, "uuid": "e3d9f8fd-3de7-489c-b6d3-4d05d5f72c21", "comment": "Malware payload (Smoke Loader)", "value": "3c5aa4efc5ea5ff11a0e1b45bc99c9052d989677421194c6c76ecffbf1fd43d9b785bf73ca4378ef45e3c0d5e77db5aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352730, "uuid": "3da91c8f-fbd3-4878-91ba-8ba4f68a5ac0", "value": "T127548D00BA90D035F0B716F8497A9769A93E7EE19B3051CB62D57AEE57346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352730, "uuid": "94b346c9-bb48-4286-90e0-8d1d4608e2ba", "value": "7cff2e062748d0c7179f1e085cf45fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352730, "uuid": "0297792a-465c-47bf-b6ff-970bc8a60de4", "value": "6144:VrQbVsIx/cF8Xu8tacRMk5YZcL9TwKoPyjAFe6SHok:VkbVsecF8Xu8tac2k5HpmPysg6Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352730, "uuid": "84d25372-26d8-4d3f-afd1-741ca817f418", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352730, "uuid": "2396c1ab-dd1d-4f83-8865-e26f6730b354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352730, "uuid": "b9207b31-5373-41c9-b755-de8bee108cdb", "value": "dd5d9233243615880d176a798cd520b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e061ac27-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "1575dedb-2e60-432c-a7b4-560f088405f8", "comment": "Malware payload (Heodo)", "value": "7adf81187c3586d35b2a375f521162f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "eb677298-82d2-49aa-8613-7960dbb43f48", "comment": "Malware payload (Heodo)", "value": "662c3c6cbccf84fb562666211d0062f3a6957f13bb7b3a57cae48d80f4add152", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "99d54476-3b33-426a-a063-f02258517a95", "comment": "Malware payload (Heodo)", "value": "6575b444eccb45d9e77c2e0854bdf6b5d0f6bc0a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "4dd9405a-979b-4e48-9f66-dd7589bbef3c", "comment": "Malware payload (Heodo)", "value": "da7ffef04e8785956e70afa9027c692e3299c3c1570dd0af2161ef44d116a4230274d5d37c5d49fa264d3122c25ceb1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "c000f32e-74e4-4258-a215-27032cfc308d", "value": "T1C7256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "fba164b9-8334-4afd-b6c9-459c6d079c8a", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "22b615d8-a21d-4e57-b9a2-9e71ec184312", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1PWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg61WeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302837, "uuid": "e6b0b21a-ae8a-4483-b1ab-9f5d8d054c9b", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302837, "uuid": "4d6f4549-c9d6-44f5-b86c-5d860025ec76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "9a0b36cd-d2ae-47dd-aaa3-369ef3f21d9e", "value": "emotet_exe_e5_662c3c6cbccf84fb562666211d0062f3a6957f13bb7b3a57cae48d80f4add152_2022-03-15__000708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff98f41e-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333813, "uuid": "d0486757-f78c-4536-90d3-73b6fab18b61", "comment": "Malware payload (Heodo)", "value": "542786ef45d4701e724b9dfe52f12d79", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333813, "uuid": "9b142289-7de6-46d2-a9fd-0b95f16de58d", "comment": "Malware payload (Heodo)", "value": "66710895db044e1252f89299ea3b9578bcd5f5f344a820930d3afc3becb82510", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333813, "uuid": "47b9069b-675b-4540-9946-6fe300420dca", "comment": "Malware payload (Heodo)", "value": "41f47aec8dc4e53eeedbeda569abad5a79ef137e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333813, "uuid": "841cf682-0496-4e3d-a217-55bcf4a67acc", "comment": "Malware payload (Heodo)", "value": "547abed9aeba98f1bc962543cef1e27911c392ab46647d909c4457f31fc2f501051f52ce360cec88904c4ba46d6a8a1e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333813, "uuid": "e5d83792-3653-4917-863a-be0e03748969", "value": "T10573E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333813, "uuid": "1c396e35-01d2-47dd-9890-ada4f904ad9f", "value": "1536:yuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:MtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333813, "uuid": "5644c157-1cca-4fac-b828-4d23c6e261e2", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333813, "uuid": "1281275b-8739-4c20-9328-86a15e10d8db", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333813, "uuid": "dd150e53-a486-4b45-81a3-0de4463c012d", "value": "OMICS Group.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d1170a-a47d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647362085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362085, "uuid": "27e7173a-2f41-40df-9ea8-b9006c00a14b", "comment": "Malware payload (AgentTesla)", "value": "a779c3bd64720553b1ca27e25e444ab7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362085, "uuid": "ef9d45a6-92df-4d04-b158-5621802c8093", "comment": "Malware payload (AgentTesla)", "value": "679d1f6452399799e2bb70cdccef8605660c92ac0f0be8380b57223caf1a7e51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362085, "uuid": "5be48c7b-e59c-49f4-a81f-6d815b4e733d", "comment": "Malware payload (AgentTesla)", "value": "38f6516a26b28bd045e249fe0821cc1e98cd2cca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647362085, "uuid": "3bf1383b-794b-44f2-ae89-8555d33684d9", "comment": "Malware payload (AgentTesla)", "value": "6d1d3183cd0d0791b5a9709297f9b0a3f9d6409701171adaccd5836394ce0737e34cba08f8aada1092ab2357d35b8094", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647362085, "uuid": "76f760c4-3874-49cd-91d6-785035b001cb", "value": "T17CD423D8542371A992BC5B3AA55C1DD1B1BFF8EF3F9A021310F3082646F10996EAFD84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647362085, "uuid": "4a8e62c9-a79a-419f-a301-b4a775e30a3d", "value": "12288:+EVi4mYGN66aiHgBYG6X2tz4P+qUJIQgGXasy2u/fM0aUhkN7ayX:+8iLYY66Rotzlna2K07X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647362085, "uuid": "774de587-2645-491b-b918-d1f388867cb5", "value": 644455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647362085, "uuid": "8f7d37bc-3343-4ea7-a67f-484a8fa0faf2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647362085, "uuid": "f61d1d64-16e7-47ba-adc8-9f195547af89", "value": "MO PC30UD69V350TF.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67d6433-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349260, "uuid": "314b22ca-6169-450c-bf2f-a4d096e69a26", "comment": "Malware payload (Heodo)", "value": "1224961ea88aee6decb7c6756f911b52", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349260, "uuid": "81c10003-b86a-499d-9849-a9f01c1d09b0", "comment": "Malware payload (Heodo)", "value": "67a4e8ea4395ccef5e9aae7249aaf6cc61e092b8109bc00076717c14dabc0282", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349260, "uuid": "5fe1a73c-7276-4629-b052-4bdea9b6f4b0", "comment": "Malware payload (Heodo)", "value": "cbf132d56970ae97ff3edac437c1c04b66d32f4b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349260, "uuid": "42a69cf2-3183-4d6b-9d26-f3d7b0409f66", "comment": "Malware payload (Heodo)", "value": "14eeca7b091302ca23313da200fe9f3ae072f86a126ff53cc9587dada67fc30df56f8bbc3507d63fa0b1726ec095cf2c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349260, "uuid": "e1c162f8-55b3-4977-8a8f-ed46cbf07084", "value": "T1C333D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349260, "uuid": "1ae6292b-2063-475d-be43-6ca2abd3c868", "value": "1536:oAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:RcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349260, "uuid": "a33eac82-e352-49a5-a47c-825e78b0603a", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349260, "uuid": "d2a19924-57f5-4e18-a81d-8e96c22f7e28", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349260, "uuid": "5a629578-44c4-4c7b-881e-2dbf60001270", "value": "gescanntes-Dokument.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e275714d-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1647333765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333765, "uuid": "cf84df22-5adb-4c28-9133-55e6ceba7821", "comment": "Malware payload (AZORult)", "value": "a8c8c9f845755c28d970990ac073386d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333765, "uuid": "2ea33a98-de89-4c7e-bd47-8ac8fc06197a", "comment": "Malware payload (AZORult)", "value": "67ea2153cfc1a94642fa7f08b5e8c40c2497106687b6d9d6fa938eec1d659126", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333765, "uuid": "2113d1cb-7145-4fcc-b129-b3fd5ef9b543", "comment": "Malware payload (AZORult)", "value": "ff23867b93b68d1feefcbea5fb5a96fc2b5870d1", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333765, "uuid": "4d47fcd6-08dd-4055-8821-821a6008de7e", "comment": "Malware payload (AZORult)", "value": "cc0577b24d5e724f9f2a9ccb33f7b664a480e70443b8bd20cf85486c643c6caaffb629117760c62ec1df226592b40924", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333765, "uuid": "346724dd-746b-4aa3-a524-c88cdeca03fa", "value": "T18874220302904EF7DDF29E741C73BBC9ABBDAE664A519D870FA07FBE98762A14504107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333765, "uuid": "2a76edb4-d725-41fa-9ecd-ce23b64d04b8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333765, "uuid": "1b77563a-a2df-4a68-9d18-03ff342d5fc9", "value": "6144:FGiPMSrQAtFSnzkLT1/ELKYwV8v5IMdlVSiEFitM8cI0b9p:jEAvUzk/N8gS1lVS1FitKZbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333765, "uuid": "88e92608-f588-40d9-89e0-15dc5782bb18", "value": 349956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333765, "uuid": "f45c1005-51d1-4e8c-bf16-5da1a24cfc39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333765, "uuid": "b8da02d8-c158-40f0-85c8-29d41945977f", "value": "0962-RQ-000511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740835a5-a402-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647309098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647309098, "uuid": "cc278ddb-dff0-4628-869a-9863fe850acf", "comment": "Malware payload (DCRat)", "value": "a2f82e24c03a2d4ac67f57ded0b23a24", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647309098, "uuid": "40588fb8-d2e9-4afc-8886-d561278dcab0", "comment": "Malware payload (DCRat)", "value": "6848dcf8332859d322ab6c3330c6bc1a3af2696f363bb4b3fb8744eef50a999e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647309098, "uuid": "be062908-76d2-4809-b626-38815a625e0b", "comment": "Malware payload (DCRat)", "value": "9601b73fd636d9f4feec2594fb2d28d42c81cad7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647309098, "uuid": "46554b24-29cf-49f8-917d-d5314f36ceb4", "comment": "Malware payload (DCRat)", "value": "bfb5f8208f8b44497f671168ea4c920300f461bb2d05f99d6925fca670794489de7c163c69aaa72c6d9bb8ff3958c2b6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647309098, "uuid": "5c2957d2-e0cb-4ab0-89f2-94edd549d143", "value": "T136458C077955CE02D06917B2C4EFD01843BCAD422A66D75A7E8A339CA5223EB1F4E5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647309098, "uuid": "6d28ebbe-1279-44c3-bebd-5af6505bcd66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647309098, "uuid": "7aea385c-5a1c-445b-ae7a-932e5f3c7338", "value": "24576:/BY5/VFmDhBqm+4P0fIBfNoAwWaokZFegZD:ogvq83ToKZkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647309098, "uuid": "a69380d2-1076-467c-9fab-4631f5a9929b", "value": 1239552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647309098, "uuid": "2a209e50-4f7c-4025-856e-152d5fc7ea6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647309098, "uuid": "66b6c6b3-d946-4371-9b00-95b408334ac8", "value": "a2f82e24c03a2d4ac67f57ded0b23a24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759dc596-a492-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647370948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370948, "uuid": "79fdbc9d-5299-4f6c-8f1b-c588ab0b896d", "comment": "Malware payload (AgentTesla)", "value": "a65d80e67c7083f008fb808ed3f006b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370948, "uuid": "1b9d7b13-ba1b-408e-b96d-c81b9f0391a7", "comment": "Malware payload (AgentTesla)", "value": "68898a365e783a7f7c2c77693f84ac49aae7b2e2fa3e503cc85adfccb968a6ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370948, "uuid": "a114e999-be25-4c39-9e11-2c00125aba09", "comment": "Malware payload (AgentTesla)", "value": "be335a6f65e5c8041fe47acb220540a49b7f51fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370948, "uuid": "a1ef5917-0384-47cd-9ca7-14edbceec2fc", "comment": "Malware payload (AgentTesla)", "value": "4a8866130e563311483b28030f88b6e3cf65e74d5c7b157fbcb8ea7316202af3e4b90408326bbbcb2dad0d9224124d8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370948, "uuid": "359c9fe8-3dde-4192-93e3-cd9a9af0f12c", "value": "T10C0539ACB16071DEC817C476CA502D74EE927A7B830F5217906761AD8A3E983DF24DB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370948, "uuid": "944ee761-d624-4f95-8b0a-f699edc26cf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370948, "uuid": "2d883973-ce58-4ade-a12c-01a1f0deae16", "value": "12288:7fLyETmowDtCXFMaz/McZ19CHrHjxeMoZnBvy4DtkGTCNPU/XEyqqCZvIXq1LuRh:LxGDtMMaz/McM5eZUyY/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647370948, "uuid": "e48220a5-5ecd-49d3-8202-7d0f09d852bf", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647370948, "uuid": "b854fc08-6311-4cf5-bf04-931b5fbd4807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370948, "uuid": "ff407f2f-6717-49b8-89a3-c4374dac23dd", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f32d49-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333775, "uuid": "e216fa43-8ae3-494d-a05a-ae1fd847d143", "comment": "Malware payload (Heodo)", "value": "3e827c5f78db4db28c9097ea09ea1245", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333775, "uuid": "823606a3-4914-482d-8fe0-03263dfebdd6", "comment": "Malware payload (Heodo)", "value": "68f9e5f4f102dc04c76a055b371dd3d0bd594ac65eba2469e20401877acca86b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333775, "uuid": "c06575b1-97e4-4d33-8ff8-b5054cdcd988", "comment": "Malware payload (Heodo)", "value": "49bfea4ddd69be03e8c94a3477027ec3109c7685", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333775, "uuid": "50f53e20-4456-4d7d-9025-4b2983c1a29b", "comment": "Malware payload (Heodo)", "value": "67a4a2834205f16f4bc4c4cad7d7732deae3a95a22b294c875d0ec529c497eddc82ff0b2bac8f07e9c37937811f62e02", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333775, "uuid": "8f4cc143-2af4-428a-93d1-da915e5c8fd6", "value": "T16473E11EC522E19DCB2700BDD2CF4FEB948F75153AC0E47A93C0E94D2B4895AA74E64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333775, "uuid": "4e385143-c8ff-4f7a-908f-c669191c56ca", "value": "1536:eS3FXUcSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM7VI0E:9310tzSmICpH7OZuvZGsMnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333775, "uuid": "a53c87ad-7905-46c6-aa50-96203992610b", "value": 76170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333775, "uuid": "c7ba8dac-eb14-4720-ab3b-b013676abecb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333775, "uuid": "242240ce-b550-4cfc-8b6c-d3b77cb68b6a", "value": "Details_1403.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa4c203-a454-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647344247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344247, "uuid": "31424f3f-4cc8-45e5-bb4a-97f358346c7d", "comment": "Malware payload", "value": "fed087def4e34714f0e25106e0673462", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344247, "uuid": "e2cf4789-7e0a-4aa4-9787-3a9a709eb819", "comment": "Malware payload", "value": "6927e5f91d22a9e16b9429095e9427eaa0b3efc2baf843d1f318446d6db75092", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344247, "uuid": "b5acc908-8bb5-4362-a9e0-519698b3c8b6", "comment": "Malware payload", "value": "ba11e20664e63196b4b5aaef6566ed63e2eb76ab", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344247, "uuid": "ac4deff7-2801-49fa-bfc9-841f51b099aa", "comment": "Malware payload", "value": "ef12148fc3eeb816a9cc0025a95ac4ccf13865557ea921d0aeda39c02e4b54e20b131e772f4826b1837ce3579ea9a5b3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344247, "uuid": "13c3a345-63b0-44a2-98ff-5510ab098bff", "value": "T1DD362386F786B82FD8F3C6354B76865A850A4C5AC783E3574955B13C0CBBAD44E82FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344247, "uuid": "4c5673a8-3e5f-4915-8149-8b87ea4dbdca", "value": "98304:Edc0YPNvUmbiRdW7DvxKLbpns1l2Qi1fwOCGwVpRqDTwM4Uq:wcTvUmyW7DvxK5s1+evHVeAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344247, "uuid": "cd49b854-fa68-4ca6-8734-9201a27d0266", "value": 5257059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344247, "uuid": "39052eb4-7220-4ba8-86f8-3fceed1b5563", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344247, "uuid": "fbb0f9ae-6b35-4f53-ab1d-4826f7752de9", "value": "bawag.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb0b214-a453-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647344036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344036, "uuid": "32b3ea86-26da-4f5c-928d-20b051b5c38c", "comment": "Malware payload", "value": "f84c66af29dfbc23a164ff375d810514", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344036, "uuid": "7b8ad064-b296-45a9-8c8c-d42c00dc135c", "comment": "Malware payload", "value": "69a58c0d89506e5274030904f995dc9e4acac6162b85cfa18cd4fc478b02138d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344036, "uuid": "d7e5cd79-e4aa-4a84-b7ab-8fbca4d68190", "comment": "Malware payload", "value": "afec064f40cf04a50ad5c5eacbd749c545d23a3e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344036, "uuid": "0a7c8bc5-0eab-40db-bc96-0e4cfbfb719d", "comment": "Malware payload", "value": "eedd2eaadf9a451a48dcb0be48f1cfeb404248d5e170c6c4a9fc824fb4b9d5580271c6ee87ed49f89f5199891bb1fea2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344036, "uuid": "52835e47-a931-4480-8854-03e7ed05f34d", "value": "T16365F1C6BBC1AC2FCDB384350F9A8326A5558C57C787D7036990793CAABB7D40E48AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344036, "uuid": "ba60fa77-ff56-4d2a-b61c-33021be744f5", "value": "24576:WZyQnmxovdfW323KLdilvyYamPJwJCUVr2Zdg12BbU9OK1gwl7y:WZyJxoN/6JydPJQCmIdg4VsOK1gwlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344036, "uuid": "e660904b-328a-4133-aadd-f356bc72e0ea", "value": 1440764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344036, "uuid": "9eb3fd8d-a825-4aa0-b65c-50930183bbff", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344036, "uuid": "5090f908-e89c-45a0-8dcb-e84d7c722b8b", "value": "postbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d0449a-a491-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647370521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "526c569b-47f8-44b5-889c-a3258b3974ba", "comment": "Malware payload", "value": "ae50a0d4a2c8b4b18e759f532d6a3a84", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "ca213cdd-5882-4fa5-a7e6-e99a74527245", "comment": "Malware payload", "value": "6a3856f291f299666b796f4584eb4c69608facec0ad0501316bb1eeb300ba152", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "c78afc70-5374-4189-875a-33ca9ea7ef2e", "comment": "Malware payload", "value": "ef117e1f8451428f63acfb3b72abf76a3d62391e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370521, "uuid": "79ce30f3-cbd4-48ac-bf00-d272b64ac8f1", "comment": "Malware payload", "value": "207642689020d8c1baa3119526b3a227d7e4926317b2bdd0a75a6b6f07c6948d7931b288f5c4a185ae3705737b80fc68", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "77e19e22-d765-4ed5-9379-668ba5d11fb3", "value": "T168E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "b2a694da-11a5-4280-98f2-02c3289a5cba", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "18a3a6ea-4b79-4094-8e09-6a26f707ee8a", "value": "12288:KFxGsTPy4BHT4Sj1zfFf7ABqDLkWynCsZ:obPy44Y1Jf7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647370521, "uuid": "a5efc35f-b353-4788-bab9-77d5d9656fcd", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647370521, "uuid": "53a42597-9b83-419f-bbaa-6500b8373bbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370521, "uuid": "a00c9ffa-9ef3-480a-a764-03763f9af04a", "value": "emotet_exe_e4_6a3856f291f299666b796f4584eb4c69608facec0ad0501316bb1eeb300ba152_2022-03-15__185514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9c9103-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647353590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353590, "uuid": "46c7f847-46b4-4917-a564-8fc91dcdb488", "comment": "Malware payload", "value": "9097a718c7edc0e05668b95f446c877e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353590, "uuid": "024dbc26-8a60-4bbc-a96d-c2e5ccc5833a", "comment": "Malware payload", "value": "6aab4a3f4ab60ed96c48fe85d96157fd836e62fdc1f4c911951ad70a7b9c4b46", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353590, "uuid": "b1e71b45-8ec7-4c80-8899-58745513b372", "comment": "Malware payload", "value": "bc63528936b177ca5735cfe3471b6e4f6e0bec86", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353590, "uuid": "f1850cb7-c75b-4d7c-900f-909fe03283f5", "comment": "Malware payload", "value": "e9e3cd8cc0f9d5ce68a57aa9407121a42af330a5472d14b1070bac7c1f359799bc5ea34003147faabf11372f3952fcfa", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353590, "uuid": "6d314624-fc72-4be4-86fd-120ed3fa4815", "value": "T1B204128037ECD941D6E97BFB5304CF259951BEECB12B687322D9302A24F2556B072376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353590, "uuid": "52b16b59-7145-43bf-b485-9ceb350bcf28", "value": "3072:nAN5u61HE7JgbtH7EGUNcK/Ao0TJB1xvoKui9RY0ONUo/Ifk5whZhvQShx1373F:A7ud7JgbFEZiK/Ao0TJBnoeEnNt/IM83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353590, "uuid": "4a5f0c74-95e7-4bc0-ab3c-1d39e8a16169", "value": 190296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353590, "uuid": "e1d541ee-397b-4323-8872-2c4cbb725447", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353590, "uuid": "a4ffefb4-7bec-416c-91d5-294e98948da9", "value": "_NewPO_045126.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5980934f-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353292, "uuid": "92187a1c-2525-489e-89e6-d51cf8b41ea7", "comment": "Malware payload (Heodo)", "value": "6569f3f79e45ed9af939732051f756fd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353292, "uuid": "b5b58c4a-cc0d-4990-bb37-6f934acb45e9", "comment": "Malware payload (Heodo)", "value": "6af0f69e04d5b7d24cb80e0dc2512c626df2d66e9de1c42fe6530f4ace243b80", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353292, "uuid": "25332947-2890-4b20-ab73-8f7addaa8d6e", "comment": "Malware payload (Heodo)", "value": "545798861ebddd1ace3ef6a577b5456730f2b40e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353292, "uuid": "f18b1d51-57c0-420f-ba2e-8bf608d1bd2a", "comment": "Malware payload (Heodo)", "value": "03453210709b008b8ff4f1bb808d7e153768344a433c6e3c6d575e66d8c6095caa6310a464a7d57342fa6132723ede34", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353292, "uuid": "e1777175-c58e-4955-8ac2-c286f0f6b7a0", "value": "T17F33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353292, "uuid": "92721821-6b55-49a8-baca-26fc3ac0bc81", "value": "1536:YAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:BcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353292, "uuid": "415e984a-2b2f-475c-b230-88e52d757f85", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353292, "uuid": "b93e2cf5-ddfa-4078-81d3-bc8b9b9aebe1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353292, "uuid": "38b01ef3-8719-4e33-aa79-d4251a9c5ed4", "value": "Omics Journal_6.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48baee5-a49a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647374463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374463, "uuid": "6638a2f7-be81-41ff-b132-b79410183250", "comment": "Malware payload", "value": "aad93454385c10602523c3ad304a9041", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374463, "uuid": "9ce38e71-8f16-4c7f-8a82-e8b5c97b4517", "comment": "Malware payload", "value": "6b24e7827670f51d659bba1d8bebe630cd1a1e8905a3c1007f79d57ddeea3e7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374463, "uuid": "4d17e80d-4f9e-4a09-8a66-c14c3737be80", "comment": "Malware payload", "value": "89345a012463f2a75189f944a383f72339812e0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374463, "uuid": "4d600cf9-b134-4afa-b80a-3f1166c5ab6f", "comment": "Malware payload", "value": "eb91a4852386ea7292f0edbdbc76a391c02082bc0228b4a388d964e7fce62cd02b52ca0c8b24059384541b2278f797c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374463, "uuid": "4eef2b61-61e4-432f-afab-680106a2aff0", "value": "T1F2E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374463, "uuid": "061fba39-0bfd-423f-8525-4c2d4f101c16", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374463, "uuid": "92937b90-07f3-4c2c-8ef1-101d48aaecc9", "value": "12288:E94YBCR2xP7guDo463OP4ehsiSOZjb2woE+MhJT:2kRAguDogP1ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647374463, "uuid": "7d4dd060-aea6-4b27-bcb9-b88c7d50c5c3", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647374463, "uuid": "5df7bfaf-88ab-4635-9bb3-7ea55bb846d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374463, "uuid": "a7dfa948-22de-48e1-a578-1c8b966598d1", "value": "aad93454385c10602523c3ad304a9041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f841d4-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333767, "uuid": "b8449bea-3ea7-4ddb-86c8-766886b63a84", "comment": "Malware payload (Heodo)", "value": "93afd04b2c67eeec9829dcd03d9df062", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333767, "uuid": "082a020d-97f8-44c1-b88d-aa1f2c95cccf", "comment": "Malware payload (Heodo)", "value": "6b3313603305e8e6560ff50924bc45179719088c2bd14c5f80fa14648eb49c51", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333767, "uuid": "a78891b2-87f5-4742-a798-facc105fb9e1", "comment": "Malware payload (Heodo)", "value": "61cbb7b23af1c11d39b1ed458f62688ec38f4768", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333767, "uuid": "c7c8bdee-24d9-4ac6-9cba-40ab2971451d", "comment": "Malware payload (Heodo)", "value": "1f743edfb141140abd10ab3bf2ce1463842bba67e8097016ba8bedfed56ed57ffca97d6788b45235bfc5b3532b427525", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333767, "uuid": "8e8f150c-4a2a-4f2e-820b-c8dd91206b00", "value": "T19C73E11EC522E19DCB2700BDD2CF4FEB948F75153AC0E47A93C0E94D2B4895AA74E64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333767, "uuid": "1ef4a26e-c3f5-47b4-9853-721021239261", "value": "1536:6S3FXUcSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM7VI0E:5310tzSmICpH7OZuvZGsMnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333767, "uuid": "97a5b3cb-6864-4e2e-84a9-afb2cd3d92ff", "value": 76170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333767, "uuid": "74024316-c2ab-4297-9164-4382ee0ec665", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333767, "uuid": "f9e55b80-5f7f-4952-a3cd-8316c6950066", "value": "3850E_1403.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469556c5-a473-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647357555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357555, "uuid": "68cd9382-ecd2-4679-82a8-32692a433de2", "comment": "Malware payload (Formbook)", "value": "96b8ebe29ac8764ed8faeb9894f63be0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357555, "uuid": "a0cba946-5358-411f-98b1-1456d41e204a", "comment": "Malware payload (Formbook)", "value": "6bd24ce0a16599d97686146c6a822023f0f4896fcee914eed9a4e45a7e46b864", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357555, "uuid": "1d0a0d95-dd13-4c56-946c-37ea798f0f2b", "comment": "Malware payload (Formbook)", "value": "f0e430a6af71155b1a6dec7960c32ce5fc3c94c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357555, "uuid": "9abf9fff-dfcb-4989-828f-42e8b67d4be3", "comment": "Malware payload (Formbook)", "value": "6fd55c875cd3353a1d4a93f8519b733df8dc8d86bd0d4479de7980c98bd3579ed6373a97ac92bd3e423042b829a65443", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357555, "uuid": "a84487ed-e3e3-4219-a8f1-a1827c680c3d", "value": "T1D905124A73E94F83E1BBDBF684795A1843B8F4581509E7085DC270DB19F6F0087A4BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357555, "uuid": "2aa229f2-5ad4-4620-b466-a9d2ff34890b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357555, "uuid": "68a817de-2075-411b-8924-a6b631bd0db0", "value": "24576:h+m5wOeEXNu+uTW/cuCsd3FV0u4mLHAxAwc7wUJ:wEflXuTkcuCg1nUxXc7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647357555, "uuid": "7ef58abf-2c66-47ef-90e6-83e077193171", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647357555, "uuid": "36fb192c-8e81-4451-ac6a-fd417aed85a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357555, "uuid": "282e5e0a-ff5d-4c25-8696-be5725e2d50a", "value": "96b8ebe29ac8764ed8faeb9894f63be0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e8d7bf-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647354702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354702, "uuid": "41fb57d6-79a3-4fec-a5bd-a12009b32a28", "comment": "Malware payload (RedLineStealer)", "value": "a9be1f014fda599296cbd15177f5ebe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354702, "uuid": "e03f7d2b-092f-4a73-a86c-f86e21926c15", "comment": "Malware payload (RedLineStealer)", "value": "6be47b4e88113c1a5670018b9e6c81ce5a90677334da72fabed0af3eb4f0361b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354702, "uuid": "4efe1411-848e-47f1-adaf-d3fb23424a2e", "comment": "Malware payload (RedLineStealer)", "value": "9daffd8ec5bb20c823a01a22fc99c326e15132d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354702, "uuid": "81625d08-6318-4b50-b45b-8cddb311d56e", "comment": "Malware payload (RedLineStealer)", "value": "59993e5756f1564b3392d30c5ff28364197b72d8f23e9ef0ed74917122f724b738d8b25257510a87b887ad8a26fd2b5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354702, "uuid": "a370db15-3dcf-4c81-8048-ab5c514e2ffe", "value": "T18184C010BAA0C039F1B716F849799368B93E7EE15B2495CF22D42AEE57346E4DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354702, "uuid": "d10945a0-9041-472b-af3b-eb4586ee9d15", "value": "0bff565af25c1bc5033321ca0bc710a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354702, "uuid": "2ef4ad5b-424e-4dc8-b191-2b5eb0138913", "value": "6144:W9mT6wx6jowIWw9CVzapt34KUBU5DHVkxdErEGQbY+pPpyjH1rlxHqw93:4m+jjoJWw9CVzoPXD1dInpcjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354702, "uuid": "e06281ef-4c16-4fbc-a438-fbf458e885b3", "value": 374292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354702, "uuid": "e593bbed-4a13-4a5e-a7df-e7ace8a17f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354702, "uuid": "923d3065-61a8-4fa0-9cad-4179fe7aee89", "value": "a9be1f014fda599296cbd15177f5ebe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c51314-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353264, "uuid": "c77e2aa7-637d-458e-80b5-050165022a66", "comment": "Malware payload (Heodo)", "value": "7b30a51eeaf1dc531dd36a07e810e9dc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353264, "uuid": "6349139f-35b1-4e27-8719-c89bfbe88441", "comment": "Malware payload (Heodo)", "value": "6bf15f5975800cb9e28a898724342b9151c1b1a051a7a3ac27d55b4cb4242094", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353264, "uuid": "bd945538-49ed-4d36-9ed0-14c035a784a2", "comment": "Malware payload (Heodo)", "value": "49faed9d01470483ea04e477b77a777127c872ac", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353264, "uuid": "5588ea4c-c323-42af-a3ad-abf19ffdcd7b", "comment": "Malware payload (Heodo)", "value": "50fdee5dff494a32601eb9e7f706505d9e112bbff449a52cdcda0cedb7e9dcea7bf841862e4bbbb975fdc9185131a76c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353264, "uuid": "10d5fc55-0d6a-4d29-8cd9-f55ff4ccc84a", "value": "T15233D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353264, "uuid": "d5c319e2-a359-40bc-ab94-87b7e98f20c2", "value": "1536:0AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:dcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353264, "uuid": "6c5230ae-c503-49d6-a636-f0cbe21edcef", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353264, "uuid": "c0f6b753-2401-41da-a146-6b09178c53fe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353264, "uuid": "e10cb9de-947f-432c-aed8-f57f1b458d29", "value": "imedpub_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a65be1-a456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647345078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345078, "uuid": "3db6a3b8-e358-4fab-8293-132b163018c8", "comment": "Malware payload", "value": "26ca30986e5961c109dd6bfb7cf9d8b1", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345078, "uuid": "306d74ff-9c5b-4dba-86fb-b7522674bf03", "comment": "Malware payload", "value": "6c7702754d0d2a9bc9f245ed239cc4bcfe07c830fe2072e1302002eee4614fb0", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345078, "uuid": "1a05d0b5-2a49-4cce-9d73-5f781b7b57c2", "comment": "Malware payload", "value": "4608285889af96e8030d54bd6173fe9f4aa723e1", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345078, "uuid": "2b60cd0b-e2a9-44af-b925-3ed37066ac07", "comment": "Malware payload", "value": "5d0264836e62ad0c102403315877c98bd31c711904444a02f82647c8cabd2b1fd78171a610c7335746a42d70e67312bb", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345078, "uuid": "769b094c-8c08-4514-b16f-5d9b936c03dd", "value": "T1AB917A69074EDAFCA667A8C495D92A57DBB58612862CEBC0CF70BEFB201447C94F0458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345078, "uuid": "80c05189-716c-4aa5-a42a-8aea62d880af", "value": "96:bkJFASEdn2ouesDkV/Z2h1G5U1/7GuXCJSpNCIr3uA2Ffkd8krNtt:bOASEdn2ouesgVB2hY5EGuXC4KYJ2Ffo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345078, "uuid": "ca2182ed-9c65-431e-a147-298019c74f14", "value": 4241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345078, "uuid": "b902cb96-e275-4ba3-80b0-3636e20e233a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345078, "uuid": "9c29b5cb-2f60-4c9f-9e7a-b9913752b841", "value": "accluso_169.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca618df1-a4ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647381828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381828, "uuid": "3e00b957-6eeb-4dfe-ba82-1c4019f4f075", "comment": "Malware payload", "value": "092e5d76bbe1426f7e3ae4882fa59569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381828, "uuid": "73c3b68e-e6f4-4f72-bdf0-6b7b707fe8f6", "comment": "Malware payload", "value": "6d80ed7ad494fb269122297383b7700b92749b224b767f6d68193bb2361c9cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381828, "uuid": "b9c701dd-6acf-4367-a986-8f3ea5d3b8a6", "comment": "Malware payload", "value": "3b07ec2eae0b77c95fb272583b5c723600a1882f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381828, "uuid": "164ea579-16b1-44ad-8acf-874b87e6edca", "comment": "Malware payload", "value": "65b2613e98134d0655da399b37ba0b2cf6a1a8475631e98b3979c7dc1d29d6ef3a40f582fdb4c56a562f7ab02cca062d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381828, "uuid": "aef89c70-b74c-4410-9400-fc4aeb86da52", "value": "T1E95523D7158956B1EAFD003D862A8828B5845E3C9B6A18E3D1443D1FE17DFEBCF38422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381828, "uuid": "27bae709-eeac-40f3-959f-9929733ed895", "value": "12288:1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647381828, "uuid": "9ae84991-2825-4950-aa67-9554410a055f", "value": 1291856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647381828, "uuid": "ff0681ac-11b6-44c2-bca2-acae2ee45b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381828, "uuid": "19b9c811-79af-4cd2-bca7-c87e4d5a10be", "value": "6d80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d14f70-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647354087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354087, "uuid": "1b7ecf58-9417-4377-8ee4-44dc007bc14d", "comment": "Malware payload (RemcosRAT)", "value": "b143042e5f14e958432db47d03ca2270", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354087, "uuid": "3b2874dc-7b4d-40f9-974b-826ee97e7687", "comment": "Malware payload (RemcosRAT)", "value": "6df479c8789824106084deb65d731b8a4185a5ba4cbbf8c136cfef29c01f8c78", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354087, "uuid": "c3d4ad1d-5474-4702-b6b0-f9b61a2f8ad3", "comment": "Malware payload (RemcosRAT)", "value": "2a7592d1789cc1fef2c92ebd6fa485050d6df2d8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354087, "uuid": "75f0d064-3034-4547-8434-32fd6cc2d46c", "comment": "Malware payload (RemcosRAT)", "value": "46fdd4eba38f7e601a32995a71d1194ca85da4925d8471c1298f9ef253775f5939cb8633a7b6f84a86ac609c19ee2f2a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354087, "uuid": "cde40c16-62c6-4f4a-a769-0b8325dbfa6e", "value": "T164510C4A749F782452322EB2BCAF085ED2334787E03546927E09DB9ACE7145CD38986D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354087, "uuid": "d1d643e8-8724-4158-a018-0926805c659b", "value": "48:pCNE1GQ0TwuKDbUEr0SRmbJT/1rSoI0huFjNTyGIQP8fC0BdO:UWaE9cJb1rSoIdFjNZ9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354087, "uuid": "10197fbf-e188-4180-aff2-c84b8ea2b24b", "value": 2481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354087, "uuid": "28ea7b12-ec93-4d25-866d-5cfc056a24a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354087, "uuid": "a9a14570-88b9-4242-94c6-f9327ec602c2", "value": "Protected Client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6142244d-a436-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647331400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331400, "uuid": "9d2baee5-ee4f-4f22-a653-ba8f81095185", "comment": "Malware payload", "value": "bb9872bb18840b7e8a887b3be3b621c6", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331400, "uuid": "1dbf0221-efd4-496b-9183-ae5055503c8b", "comment": "Malware payload", "value": "6e50e65114131d6529e8a799ff660be0fc5e88ec882a116f5a60a2279883e9c4", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331400, "uuid": "a4a6b861-0d8c-4ec5-8a91-b0c49d291e45", "comment": "Malware payload", "value": "4e68e6daf702c6f8f2a7aed3fb23169f331fd47c", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331400, "uuid": "84d6a53f-2f40-4475-a103-8051ccc26100", "comment": "Malware payload", "value": "5eb1b5ebf3a13203484087013561d45550443bc1206917ce20dd851c84746d1d63e8b555d4303bb9412345276a305a88", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331400, "uuid": "ed6a2779-bab9-403a-ae48-f49239eee99c", "value": "T112656FBA41DB2483C74E41F4DCA53BE615F38EF7A7A248981BB825F4E910EBC5DC5902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331400, "uuid": "02b365f2-261b-46ba-9e92-0429c397c99b", "value": "12288:5NVXc+7qgUMVCRRgNAt+UNkNsEPbOXF3CST5Gpn2F/A4THDcKVyQh7qYtcgTd3Qw:5DM+7xFguA8UN7UbOcF2lTjcKYfgZ2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647331400, "uuid": "b49179f5-cb2a-46bb-a9f7-4e15434a6f05", "value": 1548288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647331400, "uuid": "d33d5a48-e7e3-4571-993f-8a2c0eb25347", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331400, "uuid": "01aac55f-740b-4cb3-83a8-1d8ec7483d1d", "value": "icisleri.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b091a695-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647363316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363316, "uuid": "dbb210da-45b8-4106-ab2c-f31ad71ab1c1", "comment": "Malware payload (Heodo)", "value": "350294d5edd13547214b9cae60969490", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363316, "uuid": "76b6e112-ea75-4b53-bc7f-5a13e5e4f4a2", "comment": "Malware payload (Heodo)", "value": "6ef4dd4d32516b7b0e05f85c3ad277ec1d3a5baae421f33f013b615192216302", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363316, "uuid": "54671111-847b-4106-87eb-628972cd03a3", "comment": "Malware payload (Heodo)", "value": "e47ea2bb88e3209e7b5207863db7990fc37559e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363316, "uuid": "ae0c99c8-ca27-44d8-aae7-577765762e88", "comment": "Malware payload (Heodo)", "value": "699126fa64c5b988480e481e3831f75601ee9ada10acb0926f315ed0edd45d740ea5c92cf6404865c5b3e583dceba208", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363316, "uuid": "1c6be6b3-04c2-4e4c-89aa-6d6e426254b4", "value": "T127257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363316, "uuid": "e7a4dbde-ddcd-4765-814c-af701f3e4445", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363316, "uuid": "d82b73fd-e396-44d2-9634-4f6305dce5b2", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKl0OlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Ul65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363316, "uuid": "f7b6798b-db5f-470c-96e6-bca1f161e5ec", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363316, "uuid": "8d26462d-f0a2-4580-954d-dbdd535c9fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363316, "uuid": "6177050d-8ab9-4dc1-9f8f-fd5e40609038", "value": "350294d5edd13547214b9cae60969490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8196e315-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647353359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353359, "uuid": "4f5fa352-f5b4-40da-a455-46284be6aec7", "comment": "Malware payload (AgentTesla)", "value": "080ef112486d73193ede27db1934ceaa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353359, "uuid": "92950bf7-3748-49fe-b410-f63a04f401a8", "comment": "Malware payload (AgentTesla)", "value": "6f0796961cca408d82b8b08b0f39dc118d6678c6c82b667778e5e92034e27ca8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353359, "uuid": "2729843f-f059-43b1-bcf0-a7acc70a29c1", "comment": "Malware payload (AgentTesla)", "value": "c35f25b343800edddaeeb00b7af5eb8d01d40fec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353359, "uuid": "65947937-2c7d-46c4-9c48-04f01c3f40fe", "comment": "Malware payload (AgentTesla)", "value": "874bc8abf810aa009831670476b2ab344fa6c0ca5551c51b454ab211cba68ffc25037c040d2c5b5b6fd48b0c9a571937", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353359, "uuid": "95078c7d-3517-4ba1-82f9-1392c77a20a2", "value": "T114A557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353359, "uuid": "4b38f318-1c26-46b0-a0c8-d3113271d58c", "value": "12288:7D72F5XIAQwP3mhzK/+enAsFRMQTfwJn8x3lgoaRKSl0IjCMzXSQbWm:7D45XIAQwPx/+eAG9fwax1gRdl0IuZFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353359, "uuid": "ca637268-bddb-41cc-9574-ae18d0937059", "value": 2095033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353359, "uuid": "69d9a90a-28a9-4b7c-b051-d0153d3d4007", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353359, "uuid": "52b6ae37-b0da-4139-8fa6-1e9b3b22e8e4", "value": "PO DRAFT-Mt ch.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f0e4c4-a41c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647320072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320072, "uuid": "221bac8c-bbd3-4f96-84cd-ac3833ce7068", "comment": "Malware payload (Mirai)", "value": "af621b92335b606e5759745bc33a58d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320072, "uuid": "bca1926a-1c40-4621-a88d-cd93d67dcdb9", "comment": "Malware payload (Mirai)", "value": "6f4ebd4f0e87fbcae776752594452d9fcf409343be7fea17b5e0b84943272230", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320072, "uuid": "eb974864-2f8c-445b-8e62-7b7d73101fca", "comment": "Malware payload (Mirai)", "value": "091240b9f37ff59301d19fc254ddc814e7d36b08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320072, "uuid": "b03723a4-eaf2-485a-ab13-a8009d441369", "comment": "Malware payload (Mirai)", "value": "5df859cb4acc48981dcb267155e597d4bdcf6c85ee3af2d75d4f9004e5965a0561b822de1d2212b63c6fead7d411609f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320072, "uuid": "0c113a96-e0ea-456d-acda-773b5df4ff05", "value": "T15DE2E0B2505FC74DC25948383A2FED1F0C26A71F2FC5CBF2AB4861668C69F2619542A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320072, "uuid": "51cfa306-d1e7-4093-90c7-76e55f854e78", "value": "768:Zhhi1Ub6L8s4Khg8S/w+EuTCo9juvXUc1nbcuyD7Uryqs:ZhhaUGQs4KC87+EAjUEc1nouy8mqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320072, "uuid": "367d1ecb-389b-4445-a7bf-0636c29ec57d", "value": 31852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320072, "uuid": "bdaa9e24-9f36-4b42-ae86-fe1bfbfcce18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320072, "uuid": "8fe24490-2b9f-4641-bdb6-c3554729a992", "value": "af621b92335b606e5759745bc33a58d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595c70a4-a42b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647326663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326663, "uuid": "289585fb-6c4e-4ce4-b59a-d29dfd0bbaf0", "comment": "Malware payload (Heodo)", "value": "69d79fec27f772a4a17b2eae0a4578e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326663, "uuid": "8e3314de-84ec-4969-bdd0-a593113dc03d", "comment": "Malware payload (Heodo)", "value": "6f9423a08b32086d2c2c8160d62ef1d61a2167aad68071c048e3016e49935369", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326663, "uuid": "a1e19281-dd28-45b0-8bda-235a6b5c7fc7", "comment": "Malware payload (Heodo)", "value": "e824f20e74bc0c34587b9837a6a14025cc519b61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326663, "uuid": "dd4a4164-a613-4768-8824-2862d16da88a", "comment": "Malware payload (Heodo)", "value": "cf1856b22b93721ea5a6a1fa333f9e4f84af1b9328b06a58d95f527c05d7dff128412994339f43da483b7761c6b3b627", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326663, "uuid": "b877a8d4-3587-4143-a741-1b7bad5f6395", "value": "T192256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326663, "uuid": "4a920f0b-3201-4fbb-b59d-b025472d5e91", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326663, "uuid": "861fa4d1-7f08-4abc-a27b-e020861b3c21", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1AWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg62WeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326663, "uuid": "cc8950bd-397b-48be-9751-cd7604e4bfb2", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326663, "uuid": "038c9697-2f02-46a2-90f2-2e9ec586a3c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326663, "uuid": "3ab5a817-7fc1-40b6-9f67-48e4395fdd47", "value": "69d79fec27f772a4a17b2eae0a4578e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc07440-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "2a6e3292-e5de-47db-9852-63de429539b7", "comment": "Malware payload (Heodo)", "value": "e00372334f9f081097a256c171757c3d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "f8e7f9c6-aeaf-45b1-9417-4d4227e1b894", "comment": "Malware payload (Heodo)", "value": "6fa2464e083d28d717b448901ce099134a3c5cb7bc3b2f8bcaf2b9a1e7734039", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "9154abdc-2813-49d4-925d-8d9285ee94f8", "comment": "Malware payload (Heodo)", "value": "b365735e7b8fe3a9558db03d44631c038ab4224a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "77d6d7aa-9ce9-4688-aa8e-af4e10c1f6a2", "comment": "Malware payload (Heodo)", "value": "bdd4b444f16accc719a8364c2bacb5d22513144dcd441b757e35c2c212e1cf4037bd8c4a3389f98cd21ecb31f30e60c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "ca65de58-8041-4164-bd03-8315cd0f1af7", "value": "T144256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "b035df11-50b4-48a9-a70f-456dfb7bd1c8", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "85055a3a-a6d0-47ce-a7c7-47ce7834fb2c", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1qWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg64WeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302836, "uuid": "6b53ce84-52f7-4a26-a8be-2a19b346b806", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302836, "uuid": "56ce35e0-6444-42ed-9f64-edc3645ab65f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "6ba04610-e2d0-4dc7-b8a8-3ba16894b0d2", "value": "emotet_exe_e5_6fa2464e083d28d717b448901ce099134a3c5cb7bc3b2f8bcaf2b9a1e7734039_2022-03-15__000706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53386e6-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647352989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352989, "uuid": "fd688a4c-789d-4824-b6d8-8502a0712f89", "comment": "Malware payload (RedLineStealer)", "value": "16da3e726d6442b090375e12d2d67d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352989, "uuid": "d2bf80b9-a074-4712-81e5-f71908bb561d", "comment": "Malware payload (RedLineStealer)", "value": "6fbb311164a1ca952c97510e878dcfe2da5547e3ffefd3f89372a508697d4cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352989, "uuid": "55bb4216-ed19-4b6e-91d3-65f4878ed475", "comment": "Malware payload (RedLineStealer)", "value": "507bfb9f73c025b41a23bd3bf0d865934b22a07a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352989, "uuid": "5f09d433-37ca-449a-88fc-17e407592be4", "comment": "Malware payload (RedLineStealer)", "value": "26fa4713f28a51787673d2542483f5d9720f27e960f50c7999ef02a25b4101ff20847e6b14709329f6ecb379c474dd83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352989, "uuid": "cc4e7c41-80ca-4390-b8ce-5ea5e538ee14", "value": "T1DC653386BB61740BDEC1AC71CCFA7D74C719B269814A6B2F799C006F8119332CAB3855", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352989, "uuid": "7bef9e68-3cbe-4e54-8bb5-771d93f4f089", "value": "1930dd3ae481fb9e33430cdb0869a85d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352989, "uuid": "e95059a1-ea51-43ca-bfe2-777f6238e709", "value": "24576:xI3ikZ/z7/OiputDuYXRRPDjppXGKJZQYmwyWzEPKIZPimoCUIrpbsp+R1AkE:CykZ/z7GipuMYXRRPrhRyWAPdiZiC6KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352989, "uuid": "e37c6c65-0e5c-4ac8-b1e9-bd2309ac567b", "value": 1506736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352989, "uuid": "a0da5dec-3e72-4858-9744-88da4189a043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352989, "uuid": "3b9455d8-974b-44be-99e6-29a1222fb012", "value": "16da3e726d6442b090375e12d2d67d50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be3dcd3-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353296, "uuid": "2a8f0c6f-3a75-4e1b-abd4-14301ed27a96", "comment": "Malware payload (Heodo)", "value": "70ed9a4f6a4a643e4d61de5a7dd49f48", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353296, "uuid": "fcdaee07-c608-477f-877e-36527587dae6", "comment": "Malware payload (Heodo)", "value": "6ffe406086a7d4ec2670c3eae85a27d767dc7a2ebc203224f1e7338dafad89cd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353296, "uuid": "3e7ffe62-1911-4386-ba75-4d12a87ea9b5", "comment": "Malware payload (Heodo)", "value": "99302113ffe8242eb8d138523c998e5871261b65", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353296, "uuid": "232ac1f8-b028-47e2-8342-35b653749bcf", "comment": "Malware payload (Heodo)", "value": "e4d69e84109db840c7dca897b60d1856a0c323e66c6b08a7013e0b06aeb5731c9a9e20d499f3e48d77c26d3dbc738de0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353296, "uuid": "1f4409eb-994e-4aa3-9677-23a8c2cba834", "value": "T1C333D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353296, "uuid": "dcf2f0cc-bc28-4f54-9b73-0bcfa4d49666", "value": "1536:4AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:hcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353296, "uuid": "3acdd7c9-bde3-4d83-8221-641d9203bb33", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353296, "uuid": "2294d091-2c8e-4bd7-8ef9-7bdcb783c1bd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353296, "uuid": "babf5ef4-0785-4702-91e4-50b22fd52391", "value": "OMICS Publishing Group_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e1480d-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647363303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363303, "uuid": "daebf9d3-c54e-40d1-9cd4-153fcbf88e77", "comment": "Malware payload (Heodo)", "value": "60292b49cda1acf213fd1cdc35f6f745", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363303, "uuid": "e25084d6-0af4-4f38-8ce6-8899a26d0b4c", "comment": "Malware payload (Heodo)", "value": "703d7b363a930e0ccba061d98f8fd4f0ee647e056d03ecd1c59e3e0b9ac885c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363303, "uuid": "78d6aebb-2f4c-42db-8a73-0e8df132a889", "comment": "Malware payload (Heodo)", "value": "505a52a8146d99e7aa322e577b1926ad2d7d8a94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363303, "uuid": "155cdb19-987b-49cb-ad8d-a1557e999855", "comment": "Malware payload (Heodo)", "value": "f410bbc383ae5058325a05ac448c1a1fbd15373cc3d9b513c8b6be6e29eff23dc68c9df1a77da83233ab94326a4a9aa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363303, "uuid": "06fe5073-8cb2-4930-9d7f-52aaab924198", "value": "T19C257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363303, "uuid": "da5dd64e-9617-45cf-aa3d-65f3b5cf96d6", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363303, "uuid": "de6c432f-d7ea-41c2-b7c5-f2fc1d028552", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKleOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8el65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363303, "uuid": "7c5c52aa-7561-4f26-9c93-66e80a91dc2e", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363303, "uuid": "c4b3a06d-0169-4f41-ad4b-8df0c4ea70d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363303, "uuid": "7306d692-c195-43fe-9e56-d79943a0e7f2", "value": "60292b49cda1acf213fd1cdc35f6f745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1b9d4b-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333804, "uuid": "76050cb4-3e16-4a2d-ba00-bcbf6bdfaed7", "comment": "Malware payload (Heodo)", "value": "4a6466ea0a526d19919900cade49ce22", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333804, "uuid": "b28740f1-f5a9-4749-97a4-211932588828", "comment": "Malware payload (Heodo)", "value": "7099cfe41275e6d196dff26723b5f3fcc20f9c0da875f6a8f2e275526ecab538", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333804, "uuid": "b1544647-61f8-49c4-a175-da3fa1919b14", "comment": "Malware payload (Heodo)", "value": "49a01464f046bd2d9b014ce04c4fa22451af2bbe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333804, "uuid": "6fd0be83-5809-49a6-90df-a44fe72e7a69", "comment": "Malware payload (Heodo)", "value": "a0d5471f8af5de725d159b10a6497055d6dcdf8150897fad781f1f964dd23c06f52d7540f633ed8c04f4cd407eb7f8ed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333804, "uuid": "20d0bd87-5429-451f-a65e-0a734465049b", "value": "T13973E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333804, "uuid": "92e79c23-8d1e-4895-9891-6b263b4d71af", "value": "1536:iuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:ctzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333804, "uuid": "cef6b07a-55c4-4497-be1f-0b50ffd0d083", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333804, "uuid": "9d91cdea-a328-479b-ac61-6e4d96b1024b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333804, "uuid": "5dcef880-dbb5-4692-aca5-561a0a056ce2", "value": "innovinc.org.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4135faef-a465-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647351533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351533, "uuid": "c21c844f-1479-472d-bccf-43e6d26935d7", "comment": "Malware payload (Quakbot)", "value": "7c4663dfe3fe09ad963452f94429dc27", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351533, "uuid": "f263998d-c228-4717-a4d6-2e71535bf82d", "comment": "Malware payload (Quakbot)", "value": "71382e72d8fb3728dc8941798ab1c180493fa978fd7eadc1ab6d21dae0d603e2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351533, "uuid": "b03b3865-55c6-4606-a4b8-acb3aaf09fd0", "comment": "Malware payload (Quakbot)", "value": "eef13e23d2c9ab2584a84af69561a2878f27747e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351533, "uuid": "ec566ed7-19cc-40f1-af31-76c6dd5850d8", "comment": "Malware payload (Quakbot)", "value": "0442c3939878c9ebec4595876c9f3c1a7a82f1ae20bf2160583423cf1e3883f1c034157df8551f18d1f266e3f063a754", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351533, "uuid": "90f0fe4e-5f6d-4f93-a2cf-cb5f6c413b7d", "value": "T17A34E116261461B1C2EDB978720B0DC292EF707EE906F9244B5207FA7F423FA8D5D1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351533, "uuid": "42962227-61d6-4f93-933d-a301af16bdae", "value": "3072:brpvZ+51+mCVdcmF/9OZNCsRCbOI59VzmWBgXEnkZtPaq4LwTGPCXVD:vpvY1MzcmfO4bOe5d/OIwTHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647351533, "uuid": "7317a04c-b5bf-4683-8ab4-17afa4d62368", "value": 244127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647351533, "uuid": "dbf00991-e845-46e0-aec5-51003a00ef9c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351533, "uuid": "9c41744d-4ff6-4a1b-a7ed-b92656eb25af", "value": "atmodets.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347d551e-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647354089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354089, "uuid": "2727bcfd-c121-4c7d-9747-b79ee79c9b89", "comment": "Malware payload", "value": "bfcb6ee519eba3e01e6cce66ee311bf2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354089, "uuid": "59cfa2d3-6cf9-4d78-b08a-75afabeb8235", "comment": "Malware payload", "value": "71e1bffa60443f27338480ed011fd2e82c9a03763f7a4ac1c4d13435684a5521", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354089, "uuid": "baac9558-ba3c-4710-a8fb-c91963d478a3", "comment": "Malware payload", "value": "583b57b360611c5043675293daceca77e041af95", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354089, "uuid": "df982e8b-70df-4ec1-bfd8-07ad4bc7de38", "comment": "Malware payload", "value": "8c984f372ea26116511433d656219fbf420a337dca6caaf4eb3da36d5439cdf50958269bef85ea22a56b1f644cdab838", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354089, "uuid": "64a81add-6c99-4377-b1f4-c065600b32cd", "value": "T17851E34E759FB96853315DB2DD2B084DD3B31B87B17A42903D09CACACE3515CE28AC5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354089, "uuid": "56d8d76f-73ea-4057-aea8-c31eda410f2a", "value": "48:uBvSZ8p94E2W8veolOSCJ61rSDm0UWuXse1JcIy0BdO:upqbDyJ61rSKtXv8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354089, "uuid": "3afe3b8e-8c7a-41cf-98c2-a49906ca5287", "value": 2457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354089, "uuid": "32df0c1c-a18a-4fab-921c-e67c7f96cf12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354089, "uuid": "248469a8-c75c-469b-808e-83ff6f94d99c", "value": "potrebna dokumentacija.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bc3200-a3f5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647303361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647303361, "uuid": "70025385-0f2b-41c9-8b14-0ab0b7aa6383", "comment": "Malware payload (RedLineStealer)", "value": "a7bc9d4d515318c74655a0482f1c34f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647303361, "uuid": "81169556-236d-4934-8481-04e4ad42bfd2", "comment": "Malware payload (RedLineStealer)", "value": "71f203f4c3e11a93dcab88f4d288d8758bd584615eacd059baaa08041979bf25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647303361, "uuid": "07989446-35da-4eb5-b12a-21fe737e9506", "comment": "Malware payload (RedLineStealer)", "value": "7e629ddeaa09ac5a009aed13bd451a0ce19efa1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647303361, "uuid": "994c9aa6-7d0a-4b8a-9448-ba590a75c8a1", "comment": "Malware payload (RedLineStealer)", "value": "296f4d3bda4548ca43a9e58a55e5983e0a926d8962a44742668cbd8dc27b616f77169f6195de6298a5f86d42a986c2fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647303361, "uuid": "7fc2041b-6cea-4940-ba01-fadf5a2e997e", "value": "T1BDC4236B95C0FF4ECBCF25386E262E4748B63AB0C6E4B0DB96462460F19C8579F14778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647303361, "uuid": "4f9b479f-df55-4348-b196-d093df8fc827", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647303361, "uuid": "17b9b0de-11b5-4ace-8a81-da91f91a795d", "value": "12288:yTX12FD/w7DL/owJyQS03ULaHNqrxlKIQNoU5qoaaH8WW:UXIFTwXLnykEaHNYK3BqdWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647303361, "uuid": "84faeae1-b3b1-4eb3-a587-e0b52532d736", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647303361, "uuid": "ed9f650e-0869-4aee-9d4e-07309cb854fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647303361, "uuid": "f730b9b1-fa8f-4afa-89fe-98fdfc3bbe89", "value": "a7bc9d4d515318c74655a0482f1c34f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e3a3a3-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647334207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334207, "uuid": "53d4f1b6-a444-4f09-b9b2-4efec963b5c8", "comment": "Malware payload (Mirai)", "value": "646cb018c6fe1261468f701038f6cd4d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334207, "uuid": "3eba7c83-890f-4438-af93-1fb9f87366b9", "comment": "Malware payload (Mirai)", "value": "723dc09ba37b9a74232870d7304729c0181a2722c2ca62933976d033df755868", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334207, "uuid": "f6e5d0ce-06df-4662-9b88-9942c7885c28", "comment": "Malware payload (Mirai)", "value": "79151093f0fa362929cb69ac4336aaea55d674db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334207, "uuid": "7bda2af1-19d6-4b10-92d6-dfc95c53108c", "comment": "Malware payload (Mirai)", "value": "4c3a82b6a1cd58c8009333a03ef48803e838df0e6166411117056fece95311743f762a4696ed71c38a8715faa403e6ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334207, "uuid": "b9eec4c3-90f2-460f-9973-30dc21644af0", "value": "T146530847B44180FDC149D03447AB6A76C8237EBD1B3AF39637D4EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334207, "uuid": "b76bde7d-6363-4b2b-8429-e9f358ac8dea", "value": "1536:anF9U0FferGtOW4/RWo4Uz8kkRqwkhJOlQ5M7WR:0FK0UrUO3JWvJRqwkOlr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647334207, "uuid": "c958f0a3-06ec-424f-84e8-0e312300c8f5", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647334207, "uuid": "d9d9b890-5c00-417c-80e5-5f9eae04acb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334207, "uuid": "c2e6f2e8-aa82-4bcb-b335-7a7bcde22f49", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce226ca-a45b-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1647347499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347499, "uuid": "f48bf176-eb35-4eda-a13f-f33919edc497", "comment": "Malware payload (BitRAT)", "value": "f3ffb223b4bcf20e30bd76a0a10cc853", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347499, "uuid": "365ad087-06fb-41a7-b176-dfdd0b189fba", "comment": "Malware payload (BitRAT)", "value": "72458cc243d77848194d37b59aa4081b974d013163899b639d7de3fc03d70a63", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347499, "uuid": "d4f09fc4-ff5a-4c02-ba66-148a1f6ad9c7", "comment": "Malware payload (BitRAT)", "value": "a4d3faa5b90531a28660f6fd23c455dcd28f05a1", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347499, "uuid": "291fb4de-678c-486f-96e6-c83ec370e77e", "comment": "Malware payload (BitRAT)", "value": "a855e3906c9d136c4974d6f7d2263dfeb6625621abf655a8ca225acbf9fb495f6d9725b9b8678762c5aa1d93c73b6d4b", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647347499, "uuid": "886d9704-8485-4655-be13-903f0185972f", "value": "T115A52300A950E031F6F721F8093A97A83A3E7D91972191CF23D53BEA66356E5DC3138B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647347499, "uuid": "30c1cac2-bbd1-4a74-86bb-8b1e4b050ce1", "value": "7cff2e062748d0c7179f1e085cf45fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647347499, "uuid": "9aa01b9f-7f97-40dc-82b3-f53f5ca056db", "value": "49152:FG96FdkGlOK+sFp4bEfrziiX/FfnHFzFP9Zdv/c+vzyQm8CReVsYEB:EwdzlORsFHTHTPv7z7a8Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647347499, "uuid": "36771a5a-7f56-4e7a-9252-b6c8f74914d6", "value": 2224128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647347499, "uuid": "1a1dd768-d466-45d0-86e5-0f859af7dbe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647347499, "uuid": "eb1380e6-2925-4f8f-b7e3-4af38a0a4dec", "value": "f3ffb223b4bcf20e30bd76a0a10cc853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86304c5-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333801, "uuid": "75d563d8-9f31-4edd-8b50-1c9fb3d4a006", "comment": "Malware payload (Heodo)", "value": "de207bd8eab2f276f97f119554736c11", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333801, "uuid": "bb493bcc-b9b0-470c-917d-cde44d06b8fc", "comment": "Malware payload (Heodo)", "value": "730e169ad419990f61fb748f8455fa594bf4b3969ac7680b6daefc46c742e95e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333801, "uuid": "fc361906-2e2a-4f3d-a217-dc0e4df3d576", "comment": "Malware payload (Heodo)", "value": "7a41ae3bba2192c99be6049a156f95876cc251d8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333801, "uuid": "7ef57d18-ccfa-4703-ae70-647fc5e796ab", "comment": "Malware payload (Heodo)", "value": "d6868e0c26da231aa5e9eed6434443a9f14540cd37da585778fa990eda4bfc1d70f33824cad00d22b71d0962d072806f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333801, "uuid": "208643a0-0e32-42a8-849f-c90a0d4f4656", "value": "T12D23E10E5D13B94CC3369AB983CCA2F6665976221093A91A3040FE5C3FC664BAF5F09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333801, "uuid": "a72c9236-f421-4fc6-ac95-b7374518dcd4", "value": "1536:JlFXmY3B6Y8r7mfqN1+TpCgcgsMA6VIcrW:Jl1mG4YqVN1+TtRrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333801, "uuid": "a18ef302-5927-4514-a8a3-8a7117c29e3b", "value": 50114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333801, "uuid": "2969ab9e-103b-4a42-9677-92ebbdf6d347", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333801, "uuid": "dd8780d9-be27-4528-86d5-c6d4ebb4f90a", "value": "inf_AG3286489922BR.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a6f722-a4a2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647377629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647377629, "uuid": "86ea9404-7013-4eac-8d3e-60507642c54a", "comment": "Malware payload", "value": "1fec72b2715456ebd7c75423c9a50dd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647377629, "uuid": "b1a64a77-768a-4cde-8a9f-6ba849c4ef7c", "comment": "Malware payload", "value": "7331662104133371acf60ecd72a0254e6eaf44a393fd25f075ec69ebf77e91c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647377629, "uuid": "871cc111-0083-47cb-b7a8-bcaf354d2c12", "comment": "Malware payload", "value": "636c99b56057dd8d5c6d06e6e13e1c203e3d9649", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647377629, "uuid": "7b48781d-73ff-47d3-b399-bc3ef90f0661", "comment": "Malware payload", "value": "f51ff9c7a141f27b525e81bc855eb5616d732cc659f32ad25fc3483d4ae2d47b77bf68540361ad5e6db420af07bc4662", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647377629, "uuid": "f6afee34-8056-492f-a9a6-dedb5248de54", "value": "T1E2E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647377629, "uuid": "32da580b-dc9d-4424-bda6-9706767a0cb3", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647377629, "uuid": "31da21ab-b7d8-4a48-a354-84056cc8e80f", "value": "12288:E94YBCR2xP7guDo463OP4efsiSOZjb2woE+MhJT:2kRAguDogP7ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647377629, "uuid": "ef0d5921-1f16-4c2c-97af-2de5a354c63b", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647377629, "uuid": "a9428b3e-2ef2-4542-a7fe-9356bf5ba3f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647377629, "uuid": "fddae548-1ebb-4226-a7cf-85ab0f126a92", "value": "1fec72b2715456ebd7c75423c9a50dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2f2973-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647363359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363359, "uuid": "d6c5c386-82e2-45f4-b30a-9262d4a3a2aa", "comment": "Malware payload (Heodo)", "value": "a49a9fdcba8b1388aabf57b3feaaa288", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363359, "uuid": "ae83b2f0-ed90-42e8-8ef4-c8599dad79ca", "comment": "Malware payload (Heodo)", "value": "739398501eef96789c84a17b59f921e0c5fce604c7a14a1c6b1ad7247b6895b9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363359, "uuid": "42d160b7-320f-4c44-84d5-12ddcbae5350", "comment": "Malware payload (Heodo)", "value": "0fb6da371dffb91c7ff7b8814b689f413b25d907", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363359, "uuid": "d9ce27a9-5fb9-40d1-8190-960e8452ce40", "comment": "Malware payload (Heodo)", "value": "60b5be71bafc61686c05a0c98c7dfd85ca9938f4407b0363a97fb920a00f322f4635aa8127823398b551fabb4b2bf719", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363359, "uuid": "6ae4d2b3-ccb5-4733-97ee-d6516f61eb6b", "value": "T1F673F01EC232E15ECB2710BCD58F0FEBA50F791929C4E5B69780FA4D17049AA634E35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363359, "uuid": "1281ee80-a168-4861-9e64-11eb93d2e2bd", "value": "1536:P1iiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlVzc:P1iiCtzSmICpH7OZuvZGsMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363359, "uuid": "6693725a-7c68-4e3c-aec8-7dfaf54af76c", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363359, "uuid": "a1a89409-a0cc-43b2-b018-3c64c511e5d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363359, "uuid": "65165c30-af58-41ff-a1b8-e6997c47ec7a", "value": "liste 1503.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4741152e-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353261, "uuid": "bd9c0a19-8c21-4569-9196-68f1530524ad", "comment": "Malware payload (Formbook)", "value": "56ec413a811a0c34a34edf1322a954d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353261, "uuid": "106cc2d5-88ab-4baf-b5b6-e3236e99989d", "comment": "Malware payload (Formbook)", "value": "73cbecbb1b1ea2460d93f020a4fd71044e40c6721f48693da10855544dc8da20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353261, "uuid": "ae38cd10-b0c8-46b5-8d44-dccb54a096b2", "comment": "Malware payload (Formbook)", "value": "a04ebd8c4cb2120d960ce712a3be9741fa1250f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353261, "uuid": "3123b01d-de38-462e-8bce-2e6f269595dc", "comment": "Malware payload (Formbook)", "value": "af03285fcc9a61012be1d5b5059d1527bd56dd137e109a38bcfd86d211c971a07df8f32631f431e486e24128a6a37b29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353261, "uuid": "83ef7f01-4d6e-4fc0-9cbe-784f3f47ab5d", "value": "T1D625DFAC328579DEC663CE76CA642C14FA30B07BA707D2079117059D9A5DBEBDE102E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353261, "uuid": "7c5b44a6-8acd-4f52-b3c9-01f614d9c28c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353261, "uuid": "36351b11-ef10-47f8-91c2-13b084ef3e72", "value": "24576:qRzjwOd0p5Z29kzcn8+rhOLzklyhdC5c4yo:2/f+pakYwMghdCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353261, "uuid": "9b5327d0-f62b-4f0a-903d-c8359590034f", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353261, "uuid": "6cac4058-0401-459d-b585-d3b12e171111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353261, "uuid": "8bcada98-ef4c-44d2-8664-9605bda742b4", "value": "Bestellung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b8c715-a45a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647346848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346848, "uuid": "058a9289-7c06-4e32-825e-96d4899a6a45", "comment": "Malware payload", "value": "183764fe45b8035c133753dd7ee6f57d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346848, "uuid": "7717b3e3-9e50-47ee-8955-824db09c1eb0", "comment": "Malware payload", "value": "746f678c60f4673efadda92d819466cc102cbeafe3b39dbddd165bb552779541", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346848, "uuid": "b709217f-bc20-4bd5-a2b3-5c1bcc14c255", "comment": "Malware payload", "value": "d1eba956562611dca3e3d91170afd682893ac30e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346848, "uuid": "081b50f2-2f01-4601-82db-3141e0730da8", "comment": "Malware payload", "value": "9e8a31efb3a32502b7204f0ad62f377d77e4e9fab540881f65f24f3566810025a54078a721776e88f2034483759da2f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346848, "uuid": "59c5d733-a8f7-4611-8b58-392dd3304393", "value": "T1C0456C07759240B0C23FB639496BAB39FA7956270604CA477B3CDCD85F3245093B6FAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346848, "uuid": "b1880113-3f7c-4bb8-86d6-1962d8d2b41c", "value": "c7afa7e20fb91e016b2dc109aa3e9938", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346848, "uuid": "360b7c4e-8264-4299-9f7f-6b4ae724b95c", "value": "12288:pUc8O8Q/DaTTTfCqCTf4i26ev9RXRCNHfahKofB6o1KDUg5xdLErlCQmb7xSaw1f:ppl/GTfCvTfDO9yUg7ClN7oYhe2G5X2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647346848, "uuid": "b1f59ba0-2ba6-4bda-a22e-62eb15a20f52", "value": 1204448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647346848, "uuid": "14e3f9cd-2d11-40d0-84b3-59e5173aa0af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346848, "uuid": "e06c8758-6607-40d1-a454-38d00aedfe0e", "value": "746f678c60f4673efadda92d819466cc102cbeafe3b39dbddd165bb552779541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c6d1e6-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647352940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352940, "uuid": "68717203-a12e-4a0a-87a2-2ea8aaf28e4b", "comment": "Malware payload (RedLineStealer)", "value": "4e859b9361b486930038342a29507754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352940, "uuid": "8345acf3-1e7e-4c91-ac7d-45f3de53038f", "comment": "Malware payload (RedLineStealer)", "value": "74708b4dc7e134346a87f019262f80f6ffaae10bcc3ea82df48e72924be0fd74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352940, "uuid": "ce4f499b-56ca-4c8d-b422-e95c494a2672", "comment": "Malware payload (RedLineStealer)", "value": "653e75c42a1e55bd40122b2f0291dc0b9a34b13e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352940, "uuid": "54f77a07-ce1d-4719-9cdd-b77e3ade4820", "comment": "Malware payload (RedLineStealer)", "value": "b105395d046fc0965b53acc222f75811d93bfb49fa015edc6ec891cbdf9f296c17629c620f76c064897943eaea9891df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352940, "uuid": "444cbc7c-5ed1-45be-8783-0dbdc31fb0de", "value": "T1D994BE11BA90C035F1F712F859799268B93E7EE19B3050CF62D52AEA57346E4EC3230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352940, "uuid": "5ed5e1d1-0d79-4001-86de-f228edb9b2fa", "value": "6728da03e60bbe718ffacc65d5c92de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352940, "uuid": "0e244593-be7b-438c-a3b3-45cce3c45460", "value": "12288:ERZdBcxEbpzn2iUd2HgmM7LO4qlY6R1tTWFm:+bpjHqi9R3TWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352940, "uuid": "6c976a31-f7f7-47a5-b02d-cda44002fbcf", "value": 416797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352940, "uuid": "43e5d3dd-8717-4830-b3d7-e75ead51b15f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352940, "uuid": "8b1175be-825e-4cae-b4d7-9f59c692b028", "value": "4e859b9361b486930038342a29507754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08717925-a455-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647344566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344566, "uuid": "93b8f6c5-96de-451b-b95d-dd45b5b43589", "comment": "Malware payload", "value": "0c90646c61faa9b00616b6cf98aae5c5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344566, "uuid": "04739efa-5928-482f-9a18-90f85d74d420", "comment": "Malware payload", "value": "748b7be5414a87efa427759221bfa22ae8c4c1caf2b0006f286e9530c9467e91", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344566, "uuid": "3b682d90-356f-4856-9fc9-14cef2ce096d", "comment": "Malware payload", "value": "b8c6fc59d3c07c01baef51afaf39d9bbafce2862", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344566, "uuid": "cda20541-a7b0-4b3f-a539-df4aafc60e39", "comment": "Malware payload", "value": "39d746761ba644e9b450c356a567105544c305b9a46acf30d629496997a38ca78f56e5e69bcdae25fff0e9e7877de643", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344566, "uuid": "411145d3-05e9-4f51-b9c9-b346a9d49340", "value": "T1E8F43314D52DB494B779EFE9217858F03D4A5FA4EFB3BE310A274F0D58203E790AA291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344566, "uuid": "2eb0ae0d-820f-453a-bacd-c915b1af9921", "value": "12288:JgH/yZ6zwKjkdeKVLA/NguaE2YO9g1U+2oAxDVI9Dg+VNjYEUr3uXFOAvGXd73Q:qtsKEW/CuI2obI9Dg+VJYr3uQAuN73Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344566, "uuid": "2c605ab5-7f04-4fd6-8609-c82b508f47b3", "value": 757334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344566, "uuid": "3dfc0420-934a-4f18-806e-2e335ac52125", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344566, "uuid": "9e65ddca-3cfb-4678-9d90-ba554a388c76", "value": "Crypter.Win32.Abstract.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f135e6-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647354034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354034, "uuid": "1da59edd-2678-4825-9559-256249bff6cc", "comment": "Malware payload (SnakeKeylogger)", "value": "dced9aa82e265e1479c21918c7a61096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354034, "uuid": "9869c398-4a11-4bda-874b-079e17cb97b9", "comment": "Malware payload (SnakeKeylogger)", "value": "74f37108902ae791061858dc05edde043881b99ff8875b3ac49a5663f36a14cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354034, "uuid": "4ffc6e9f-844f-4a9f-8248-16e7280e0c49", "comment": "Malware payload (SnakeKeylogger)", "value": "eed275c30d38df9b8731ac4348d21c84aac8500c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354034, "uuid": "b8b2a7e7-edb0-466b-bb8e-a65c63644312", "comment": "Malware payload (SnakeKeylogger)", "value": "13543700b2104a2cec5cf2579787d4ac84e5188917fa3fd8d4c4b44405e2ed857ba8f9e2f564b0dd07d3d8f34ec1c288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354034, "uuid": "a979aeae-1eaa-4a14-8810-af53837c75ac", "value": "T1E1F40146B2F89F83F0BBCBFA8461184093B9B07A290DE3495CD630CB59A3F5147A5B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354034, "uuid": "b703eee8-389e-4be3-94e4-9cdb11f29611", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354034, "uuid": "7a92252b-4046-463a-b363-f969a3df3b50", "value": "12288:LgqmskwOEocEjcKXwhR6Dayjw99PQEIpDcKFF/CGE90OdVJEEbG8+gb5R2vxgWqr:rmHwOaznymPQEIpDjPKoOxq8+IKx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354034, "uuid": "81fba59d-02f1-41ce-b1e8-e69358d3029e", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354034, "uuid": "11bdda0b-13e5-4035-ac06-c73ab0d587c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354034, "uuid": "e09e7d2b-1566-4355-8e15-44dffd9f3449", "value": "Halkbank_Ekstre_20222-1503_ 073653_270424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51120d97-a444-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647337386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337386, "uuid": "8d0d2483-65de-42d1-a027-182febb938e6", "comment": "Malware payload (Heodo)", "value": "a4cfedda6e3f35629cf1268c9380777a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337386, "uuid": "1f6e37d1-1012-4afe-80d2-3d0cf01c0772", "comment": "Malware payload (Heodo)", "value": "751139bb85cc42dd4ae6a2468d970e33c5914d5b575a44a0cc7c4c0eeb88302d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337386, "uuid": "172d6d18-9e4e-45f0-99ab-3e1df4398a90", "comment": "Malware payload (Heodo)", "value": "70de40a89dc883b323614a68aa3cdaecea8d4338", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337386, "uuid": "d31baad8-82d3-405f-8f54-508ed2f3e661", "comment": "Malware payload (Heodo)", "value": "8b0d427aad0faffbba05c516113139126baf00dd9c2cc85de1550aee609c46013e40a408e48dfc04645fb2be50d790c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337386, "uuid": "b3819092-3a92-4d52-9b1b-833766a7bf90", "value": "T152257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337386, "uuid": "8d4a0162-7869-4740-9ebf-5ec7e218f13d", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337386, "uuid": "3f52fc4e-4291-43ae-a643-1ac3b6b7114a", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYCVP6FuR6shQLj88F+Krf6:v6oycln8cACiNP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647337386, "uuid": "30073caf-42fd-42c7-ba65-7ac3220372a4", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647337386, "uuid": "e282621a-2825-4d36-9c8e-a01e8963c57a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337386, "uuid": "20afed0f-350b-4cbc-a7fb-e1b407a2c439", "value": "a4cfedda6e3f35629cf1268c9380777a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48315ae-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333795, "uuid": "b9254517-e279-4062-a435-a7f6c990ec0d", "comment": "Malware payload (Heodo)", "value": "34c7e2dcd3bae1ec7624429a86100dd3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333795, "uuid": "01f305f8-6d15-4a66-b511-6a7f3152da7a", "comment": "Malware payload (Heodo)", "value": "752b361a7bd2c00b5fec3931253779e9ed284f0c0cb3c3097f8843bdbad7a073", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333795, "uuid": "777f4a16-2717-4cd4-9f56-fb7f947cb324", "comment": "Malware payload (Heodo)", "value": "e3bf927884dc4eee7fbd2f7c137f9a5e1e9d758b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333795, "uuid": "69baf81d-bfc3-4848-aa3b-6159b6b22b9d", "comment": "Malware payload (Heodo)", "value": "af6bc2ec7136db497cae902332866c75d87d4f82e0a02f496cc2d2fad07afb373784ac0c4b1aaa7a0d0bdbd1879c7078", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333795, "uuid": "3fb7890c-cc47-4f23-bf6d-c3c8aba5a747", "value": "T1D073E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333795, "uuid": "17887e50-b7a2-4c65-b5c7-518be36f567a", "value": "1536:GuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:AtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333795, "uuid": "3ad73ea9-c9db-46de-8915-ba2afe7204db", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333795, "uuid": "73786108-2e90-4bc0-9f8a-4a41bd13c1be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333795, "uuid": "bc2cab84-2da7-4535-9d9e-f2b7de62c013", "value": "iMedPub LTD_3.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5133537a-a467-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647352419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352419, "uuid": "3ce24f6b-b923-4759-8b01-bbc0f98a9945", "comment": "Malware payload (SnakeKeylogger)", "value": "0a65c53ee3fdf1a94a32d04d27b38357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352419, "uuid": "08531db5-3e3c-41f1-b85f-676f46e4cc2c", "comment": "Malware payload (SnakeKeylogger)", "value": "75ce9fe3ae72d83e5fba218b40688fd74c87ecf9fd79d02b609c51c96c65f46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352419, "uuid": "99b72423-1675-4501-9a63-35a1e56951ee", "comment": "Malware payload (SnakeKeylogger)", "value": "3af77964fa5384d1d5216a84b2b6fa90fa86d7a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352419, "uuid": "5112175e-26bf-4e6d-8268-414a4f9de34c", "comment": "Malware payload (SnakeKeylogger)", "value": "f038b01123667782d5cc2321cc12c11dabe30f36219811922ac5b3365e9b2aa8499249f832e5772fa9c13175075348f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352419, "uuid": "1aba57f4-e82e-4693-a13d-3a21d22d3b66", "value": "T1991548E936207ADED827C271C9150D66EF817C7A930F8157A003796DAE7D9838F990E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352419, "uuid": "f74fcaf2-2e10-492c-ad2a-0c81ea998ba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352419, "uuid": "0f9b5e1f-0b7c-4f80-9bec-5efaae63690b", "value": "24576:TQV7EEEEEEEEEEEEEEEEEO2U0c6mo1nZZYUU3yd2OluON4fA9uC:w7EEEEEEEEEEEEEEEEEO2mu1XhU3yd2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352419, "uuid": "e40e86a6-2c4f-4a46-9077-5863b62f5511", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352419, "uuid": "43a218d5-e82f-489a-a179-34d04cbce7db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352419, "uuid": "4f93ad24-92d7-465e-8d2f-b49b4a61abf2", "value": "0a65c53ee3fdf1a94a32d04d27b38357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8927775b-a466-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352083, "uuid": "eef15a2f-2971-41da-bef3-cb24fbe8409a", "comment": "Malware payload", "value": "e77516a64c27f1d54cf89bcbdb07ac37", "object_relation": "md5", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352083, "uuid": "e3af9181-9a73-4924-b7ee-129e4d40b156", "comment": "Malware payload", "value": "77081771d71513e95bc57b3a656db24077a4ce2a5a2aa8eda23216bb9d5bb8b4", "object_relation": "sha256", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352083, "uuid": "3a3ceb38-de61-4824-96d9-ea261515df16", "comment": "Malware payload", "value": "9d662cf004a0d77b9fdf5fbe5faeb864c624ef3d", "object_relation": "sha1", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352083, "uuid": "96b5e05e-80e6-43ef-9b40-eeccb3ec1a94", "comment": "Malware payload", "value": "f3e77c42efd1b0627d3cf232be58e58e4af741faa0d128be47ee00632134ee6a4f7b24283a6c0979d1489900584d176f", "object_relation": "sha3-384", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352083, "uuid": "59e0073a-cd53-46a7-9e62-0cc67cac5634", "value": "T1EB429F69C99B6823E27372B8557578C1F08C0EC39581E7CD300DBBC662853E4AB53F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352083, "uuid": "d5e95b4e-47b1-4bb8-9ed6-b55a965bba70", "value": "192:Q86oNmlOJ2wc3rMKkTPukcx118H111M05AgPekKiD2h0vSPYoaasWU:Q86tlIhTuHgH111/eVuhvSPDDsWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352083, "uuid": "aaaa3558-32d4-44ee-b846-acb2dd4c7ea3", "value": 12301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352083, "uuid": "e8e9a10c-48d6-4647-a08a-44a5646c8b90", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352083, "uuid": "d8f04bfb-ad74-4df0-b00b-fd1c9244c9eb", "value": "docx.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419484d9-a487-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647366136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366136, "uuid": "f8134f92-4f66-494e-ba35-40973b88ab57", "comment": "Malware payload", "value": "3f4699870537a5d1473b2c3e26a03e69", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366136, "uuid": "6fae1699-003e-4ce6-bcf3-0850ee4b8f60", "comment": "Malware payload", "value": "773be6ecaca5fef858e5fe5a6ec3c825f1707b3a238976d83e6f3bf52442a663", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366136, "uuid": "f4878f11-9336-4d74-a47d-a03b29f6e2f3", "comment": "Malware payload", "value": "c5e4e591425eb5467c0172931cacc5b6c410d3c7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366136, "uuid": "7d15819c-a4db-4d62-91bb-8b3eb21062a0", "comment": "Malware payload", "value": "329e0000b575f1fda00f3f2f7959640bf68cb616ae51656074c4e3599a0308f704e310253c922afdb8c3561b18f32605", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366136, "uuid": "d69be65a-b9c1-474c-a7cf-d250e996ee29", "value": "T152B40199BDD5C43EF50705360D1BE0237A8D20DED14FB42B26B44896AC28CAA9F53BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366136, "uuid": "3480d259-1dcd-444a-9135-02e1fa05c382", "value": "12288:7ueZRrt6cDGPZYzQY1iYOk2lbd+vHBAUbfZxc2xpM12e5LDP6GGR:7uefrtNCY1iYOovhxe2xJ2Js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366136, "uuid": "6cf6ecde-4377-47df-ab41-a5fc763a825c", "value": 507790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366136, "uuid": "f4dcb9e3-1e30-4451-b454-d2cc558da001", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366136, "uuid": "d715445f-6c3d-4298-b203-87bb8a727ce2", "value": "java.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834ae649-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647353362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353362, "uuid": "f1e7e312-39d6-436f-89d3-735cacd22487", "comment": "Malware payload (SnakeKeylogger)", "value": "243e173b1bf672894f6eb38cc075514f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353362, "uuid": "42d8318c-16fe-4c17-ba87-a3b1838ebca6", "comment": "Malware payload (SnakeKeylogger)", "value": "77b8a3571b3f1e5165fc691b7cb89079993816609e080859d663344584cef12e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353362, "uuid": "1eaea828-154c-48aa-8e99-d3bfd08d4185", "comment": "Malware payload (SnakeKeylogger)", "value": "4d4a39e9cf892e6247fe358ea53e04ed9394fa82", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353362, "uuid": "66b3a865-d221-4ea8-9689-7455b94d0855", "comment": "Malware payload (SnakeKeylogger)", "value": "ef4c35f97dc4ab5a98e19a453545e32272edeb0c67b5eadf8f2e8f9cc90b59304410636b371bf4596c9984579b2b3432", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353362, "uuid": "ad2ae7dc-694f-4e61-a79f-1ade498bcce2", "value": "T1E991E77115BC184BDD998973EA3AFD9301D7F2A285CA6C4436CFE6520F7E7601A2AD04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353362, "uuid": "50215f7e-93be-44e1-8995-66c00310c95b", "value": "96:IZLsj5gvQ+FxdYk4BxVfqGEtLjZla7b6Db/V+gM:IZLqR+FxdT4ViGEtvZUUtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353362, "uuid": "6c3fec81-1c48-4195-a74d-810193c47162", "value": 4292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353362, "uuid": "55a54b6c-9b22-420f-af6a-0c97712a20bc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353362, "uuid": "32fce169-4ac2-47d4-be03-c118b886eeed", "value": "PAYMENT FORM.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08e5b1b-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "083ccac0-eec8-4814-979a-0f193dcd18ab", "comment": "Malware payload (Heodo)", "value": "460221e46c9a5070408754555268c371", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "f5e61740-eff6-42e3-be05-de7fafd9d54e", "comment": "Malware payload (Heodo)", "value": "77c8023e68719bb5f2b4e8f847d662649496071c0f30b661095d4228cd31474a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "cf98564e-695a-4215-b227-448750ddc834", "comment": "Malware payload (Heodo)", "value": "cc0e539ad5bb596bf5cf66bf351a562e60c74e80", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "44f9bb25-e019-416e-a6bd-c9ed12085284", "comment": "Malware payload (Heodo)", "value": "610d3b1c8077cdbc81f4d6f69290772ead8652c5c37e6f1ccd175758ab002d16bdfb9af584eb0aca88f89ae68c8c64c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "e0fe242b-a049-4bbd-a11e-52f7f5a47021", "value": "T1D8256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "f333f537-799b-4443-9a73-ecd3c739b385", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "f2a0ae5e-428d-4b71-8042-d40e2b080f28", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1BWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6bWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302838, "uuid": "19d77266-1885-477b-9e60-a1146bcffe6d", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302838, "uuid": "518260b0-77e7-4a4f-ae0c-59c51c51598b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "5e36568e-ba51-489f-b430-638a64486369", "value": "emotet_exe_e5_77c8023e68719bb5f2b4e8f847d662649496071c0f30b661095d4228cd31474a_2022-03-15__000708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fb5ced-a456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647345070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345070, "uuid": "818d5457-9e85-473d-b76c-39cb45314179", "comment": "Malware payload", "value": "6644d16d1df1f0051831fcdc5ba99cae", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345070, "uuid": "0bf09024-b9e7-439f-9a7c-a2b04b24d1eb", "comment": "Malware payload", "value": "780445bd53564a92190756586458d953c6a681588d79cf654cff4f59fbbeb6d1", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345070, "uuid": "79ea2105-0af5-4e80-9120-180114db2982", "comment": "Malware payload", "value": "224ba53ee028466b2a7effaddd97b5ae8c2e0782", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345070, "uuid": "669816e9-2df4-4249-9e88-765b376187a9", "comment": "Malware payload", "value": "a434dc4b8307355f3174a481664d46846623484849d0244a1a3a8ae5c3274e1b009006e9ee2aed31f99d4651395f49bd", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345070, "uuid": "22a1f282-fcba-4030-a5c8-1679eec90506", "value": "T190412AB7223A35CCDDD25D7C8BE0B03246C28FD49CAC0E4335D6E522DC0565A8CAAEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345070, "uuid": "57f5399b-0262-416a-b666-1d17881b5a94", "value": "48:9VH0xchJXmzR0M7n9e4x0Ko/gicmISk7qDXG5:fvJWCMzGKotQSk7qDX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345070, "uuid": "63b48ef4-5d88-4490-842d-4f118e7f047c", "value": 1983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345070, "uuid": "bc8415c8-da69-4648-98ab-df8df4475255", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345070, "uuid": "7eff10f1-2898-40d1-843f-c77e2bb1a14d", "value": "comun_175.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2974b297-a432-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647329589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329589, "uuid": "4650e04b-f741-45ff-8233-3355f34c1011", "comment": "Malware payload (Formbook)", "value": "459f8638ec35e81f5508b01f51813fa8", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329589, "uuid": "08edcf1b-75b7-41c8-ae6a-85fe515a0d07", "comment": "Malware payload (Formbook)", "value": "7931ef1d0676e9a184567d543e2b72033b1cf76116385fa883cc61c8a95d9eff", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329589, "uuid": "808b2571-a963-4b29-8734-9548b8b1f5d9", "comment": "Malware payload (Formbook)", "value": "cf7953630bf5014d388b4d2207a8666ba0a6c878", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329589, "uuid": "d1d8c71d-b77c-43ef-acda-67d1d96785f2", "comment": "Malware payload (Formbook)", "value": "f1c120a93d5afe2dec545473ad97eea904e8b5d95044c065e9b0399b97f858feda114d57fbfb5405931028e9b54a74cc", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329589, "uuid": "eff6e2d5-ad91-4312-afa7-eb424295bca5", "value": "T1FB0533AD7D3496B930F9A0FE89D7BC2E4C2153A77440A7960BF3D905E24D631224CBE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329589, "uuid": "0f1414ab-ab4f-4a41-8f74-0a1f62a5d5c1", "value": "24576:+iUeY/aQvuM676AhyPKCtDFjhpeWLlyk+:+J/a0i76LZDFjSWoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329589, "uuid": "0add0679-24f3-44e7-93f4-9994b2bd0952", "value": 823740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329589, "uuid": "2ef3b9c2-c9fd-4a17-b59a-cc7d4fffcf6f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329589, "uuid": "e41d75f5-bf51-4b74-905b-791f340fff6e", "value": "PAYMENT COPY.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bf5afd-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326202, "uuid": "cfd46b9f-6e88-4066-ace5-70d7fcc95049", "comment": "Malware payload (Mirai)", "value": "d4a3e0d0c3da9aff180a0f59bcb6dda9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326202, "uuid": "64503ef4-e675-49a9-80ee-97395968ab75", "comment": "Malware payload (Mirai)", "value": "7996e62ebfe8314cdb93daea3d3d30173efad14fa726b418d3a8d76569af8f75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326202, "uuid": "db2dca71-002e-4670-a465-569c54bad87c", "comment": "Malware payload (Mirai)", "value": "76bc0191b229527402c49c1b1167fcd778d2357f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326202, "uuid": "8b69a6eb-045d-4c41-bf8a-16f7e7dffe33", "comment": "Malware payload (Mirai)", "value": "fc2c9bec59d623f273c342f526fdd992148f3f227a894b52a611495c55f6cad9c8029f8569266983d99d252959e008d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326202, "uuid": "f3fa3133-1a79-494b-8b7c-ed5e57620f46", "value": "T10EF34C46EA418B13C1D71776FA9F414A33229794E3DB73068D286BF43F87A5E0E17A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326202, "uuid": "7c02c2a8-8ceb-476b-b204-462bb71041d8", "value": "3072:bdpV9IXtNthM4dlr7aWGLKWqlfpjKiYElPJslaM/9KKVM:bdr+Xt2+x7aWGLKWCflDlPJs0M/9KKVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326202, "uuid": "b217cf8c-7557-41cc-aea1-f25fe3c8534f", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326202, "uuid": "37ec94be-1589-4525-93fa-7241dafea980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326202, "uuid": "92d459a4-6052-4820-aa84-db43dc995372", "value": "d4a3e0d0c3da9aff180a0f59bcb6dda9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4dcca8-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "f5da6957-2b8a-4911-9a84-fd85a75b025c", "comment": "Malware payload (Heodo)", "value": "6197f590f96b12eb7e186f86dba2d98c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "97ddd1cb-2767-4cac-b557-4f935ede9832", "comment": "Malware payload (Heodo)", "value": "799af1f0a4925bbee3ae88f89617125b2acb9ae275867d20677683a5ceba1c6a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "b6db6001-0f83-452b-b1eb-a6c8d19c52a8", "comment": "Malware payload (Heodo)", "value": "208cb5d7fb2aa924621447e91c264c8d37313287", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "9411c92b-ba69-4d07-9199-179b8c52b5a6", "comment": "Malware payload (Heodo)", "value": "60f8fe895cbd32222c41991850f41b21401c751ab453b98b4911a5c116686443168188d221e98612b96712e5fd680097", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "2ea0ec39-e659-464c-9a90-fc94a4f66705", "value": "T114256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "39f79058-9e74-470a-af4b-b495bca27355", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "d2fffe45-6596-4f7f-a861-205b20d71c63", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1pWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6vWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302836, "uuid": "b0aa045e-a89d-4e04-817a-8de0dced57c8", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302836, "uuid": "0b6bf441-5f55-42a1-b71b-82d4392dc099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "edcbe2d5-f2a0-4519-a1c7-7a5bd1b80442", "value": "emotet_exe_e5_799af1f0a4925bbee3ae88f89617125b2acb9ae275867d20677683a5ceba1c6a_2022-03-15__000706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a444b0-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647353802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353802, "uuid": "78d93005-b152-4f29-86b6-a973b5b3ab30", "comment": "Malware payload (Loki)", "value": "e87f1ad870030b33ffad74ccb56f3246", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353802, "uuid": "1c47dd72-bff7-4dc0-9b56-54a79f2d2611", "comment": "Malware payload (Loki)", "value": "79d500b7e3ed5cd36732f4ecc4028a739326bec42e2cc1574b2490d8825f2003", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353802, "uuid": "2514ad16-4029-4fce-8109-495b81c78018", "comment": "Malware payload (Loki)", "value": "fd005bfa079874799d8ab2f9b083976291aab01c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353802, "uuid": "e74e6477-396b-4893-bd7b-9f22ae035705", "comment": "Malware payload (Loki)", "value": "3146337a70d48f9e6c987da29432adf819d0420b0722b185405028d1383ce4f70b803839eca319b5235b4174ba0c87fd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353802, "uuid": "5f3982f6-59b5-4b74-8724-840e37ad45f0", "value": "T17005C698B11031DEC85BC631CA74CC34EA517EBA932F911E50A73D6B7A7E5878E14CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353802, "uuid": "bfd46668-e8e8-49a6-aa2b-eeec6c805f0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353802, "uuid": "b120c200-6c97-4cff-a2ea-3accabf3b959", "value": "12288:cMENd4pbI120m85uuRc8NThRGoDUiJyID5gweR0lLO86z8yzUDKQDw5i7YO67ncT:MU90JkuSKTJU91q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353802, "uuid": "62846fee-2ed4-4056-bca6-9fde86d4c1b6", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353802, "uuid": "d15e4189-30b6-45b3-a3e8-b65cd9267058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353802, "uuid": "14de0e05-168c-4830-8a5a-167fb79bf05c", "value": "DHL teslimat\u0131 ba\u015far\u0131s\u0131z oldu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a87b9f-a49a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647374445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374445, "uuid": "34daa989-520e-4fda-a54c-ae445a710ea9", "comment": "Malware payload", "value": "992a0e20ddc147e8bffb2a20872c7398", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374445, "uuid": "81e85012-c73d-4b35-a866-983d6b0423aa", "comment": "Malware payload", "value": "7b0050334c8dc6f7e6f9eebbfc6b671fce4719d28a56fc469b49eaced12c71bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374445, "uuid": "00e750df-29c5-4af7-9dcc-ba0566ec20a6", "comment": "Malware payload", "value": "75da33e02e3676de17bc72d48d0edf9863a12b21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374445, "uuid": "853078ef-abc3-4a06-a0e9-d13c108616cb", "comment": "Malware payload", "value": "5be4e217e0b73a20b55aaad0c9cf61abbfd088b1fa17b83daf7835fadb34594871fad2e154728aba17b0dfa0bcc16c0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374445, "uuid": "7f5e9ab0-0bc1-4ab7-a39b-0f43bed52ad9", "value": "T1C2E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374445, "uuid": "e696731f-d54a-451d-95eb-a76632f8fd82", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374445, "uuid": "8fabed78-ade4-4fe5-8925-ea0be1d328c4", "value": "12288:E94YBCR2xP7guDo463OP4e1siSOZjb2woE+MhJT:2kRAguDogPhddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647374445, "uuid": "ca03ad08-5bb8-4e49-a5ec-f8be90a54e5c", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647374445, "uuid": "8b983341-db42-481a-86bd-84924fdbbc5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374445, "uuid": "36649780-2ccb-46df-bed4-2087fe1fca8f", "value": "992a0e20ddc147e8bffb2a20872c7398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00ac418-a495-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647372362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372362, "uuid": "63e4aea2-d642-4944-922c-38e595a88938", "comment": "Malware payload", "value": "52fd0889cc962ed7c3b156e16bf585e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372362, "uuid": "40582522-66ad-4c01-914c-b9e9eb7aefc9", "comment": "Malware payload", "value": "7b298c5c4b7894eff0becd21a22f2ef72c570f267c2c361848cd90cbdfb43077", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372362, "uuid": "21369614-6be3-43b7-9579-1d126dca27a7", "comment": "Malware payload", "value": "27b2e922627c275fcf1b40a96fc8f91e1a8a66e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372362, "uuid": "20c4a6a3-ce96-4faf-a7fb-3bb15e95fef3", "comment": "Malware payload", "value": "38c2392c58f2fca41150c8a6ae5f8b105a399258b90a475bf2c7cf0280a0d1e7f5c12f7e11733f30826114af60b3024e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372362, "uuid": "6f497d2c-b1a9-4a51-b70c-28839b3ba98d", "value": "T1ACE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372362, "uuid": "278b465b-e298-4646-994b-41b7fc578885", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372362, "uuid": "c310e46d-2a7f-4f02-87a7-489094972d8a", "value": "12288:E94YBCR2xP7guDo463OP4ehsiSOZjb2woE+MhJT:2kRAguDogP1ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647372362, "uuid": "11c05755-1890-40fe-9901-c0cb90842dad", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647372362, "uuid": "f39c8857-85db-4710-84cc-8b74a9711ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372362, "uuid": "544d6984-c165-4499-a49c-0f659edb2334", "value": "emotet_exe_e5_7b298c5c4b7894eff0becd21a22f2ef72c570f267c2c361848cd90cbdfb43077_2022-03-15__192553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31599af4-a430-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647328743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328743, "uuid": "610f0ebd-4dba-4225-b1a4-bb1dc7f221bb", "comment": "Malware payload", "value": "40e85d353cc5e15b6c371b113b2e6649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328743, "uuid": "7d3dcc8c-ca14-4988-b7df-ddaeb8fa61c2", "comment": "Malware payload", "value": "7b2e509f3960c08ccd1ade85c8334311f3937c3529294d909386f60a7fe18d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328743, "uuid": "536f9c2b-f63e-4adf-83f7-37ec20310321", "comment": "Malware payload", "value": "69aee7f93a78b39f26de050e97365abf3562db97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328743, "uuid": "323da1e4-2025-4bdc-8df0-8425041810f9", "comment": "Malware payload", "value": "28a6c848c7a0ecc988657ed171d9ec83ac1da9631142040d78dd948b663d16a7fca4e75157d101568121247eb602040c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328743, "uuid": "b8f41c4d-4189-42e3-bea9-5b1660ac76d4", "value": "T1FA538E43A5CCB576CB9B02372A94DA3811E82190D7484B02FBFD397ABFC6AD1358E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328743, "uuid": "716ac486-53df-494f-9699-a1c28e2c8eb2", "value": "4753904c40d638a1bc745c65b88291d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328743, "uuid": "a4255769-0c17-4b8f-9982-c56162b47813", "value": "1536:MpbwpOopbepOopb9pOopbepOopbcpOopbepOopb9pOopbepO:MpMDp6DppDp6DpoDp6DppDp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647328743, "uuid": "1ac78d5d-5439-473c-b36d-f43286353f7c", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647328743, "uuid": "44794dfe-8c2d-4d83-9b6c-09b88471ef38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328743, "uuid": "11a615fa-a3ac-4963-a22f-f7e4c0b4cddf", "value": "7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ebdaf2-a431-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647329506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329506, "uuid": "f8af3365-eb1f-4293-91f5-b13859e1f12b", "comment": "Malware payload (Heodo)", "value": "12fc776cd165f7bc82c48bf313f2339a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329506, "uuid": "28394e9d-974a-4ea8-a498-dccdab3652e6", "comment": "Malware payload (Heodo)", "value": "7b5ef8b1ea6022e4914e54eb980c4f6acac04954af358aea9ddd9ede0af5417f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329506, "uuid": "a1288173-f750-4b87-ac6f-9571e65366b9", "comment": "Malware payload (Heodo)", "value": "89988b6b1d88f0c3dd439185789ba1df90de437f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329506, "uuid": "cebf38b0-aa5e-47b6-9fbb-045dc2b88f9a", "comment": "Malware payload (Heodo)", "value": "3519ac8d2c072612fb92333e9effdd7785d10613e22069dd10056bf4076b2a82f64884074d7cb2dbf21558d507680f6f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329506, "uuid": "f7713306-c538-4711-adcf-081dcff42046", "value": "T15573F11EC532E19ECA2714BDD1CF4FE7A04F79142AC1E4BA9380ED4D2B49E4A674E21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329506, "uuid": "5c095cd4-3604-43ca-ba6d-253fa5e76c90", "value": "1536:UheXF/Sto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMbV6Jr:UhUItzSmICpH7OZuvZGsMwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329506, "uuid": "a43189bb-3b47-4b5a-8baf-d2e285a102c7", "value": 75275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329506, "uuid": "20fb5083-78b5-4e3e-9f4d-6eba286bd5a5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329506, "uuid": "17f904ce-46f1-4562-9224-ab79523a1247", "value": "Daten 1403.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400274ae-a438-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647332204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332204, "uuid": "ef76aed7-c318-4edd-9fcb-cc2f8abf0010", "comment": "Malware payload (Heodo)", "value": "b24d8de2738e15d161a44ca5407953f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332204, "uuid": "c9484c1f-15fe-485e-97eb-b67db8d0d80c", "comment": "Malware payload (Heodo)", "value": "7c14a424f4d33c79ef1541638e65b943856270095023bae71ea9c01493373ae0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332204, "uuid": "60852fa9-6d3d-4b0c-b19f-7449945fe5b4", "comment": "Malware payload (Heodo)", "value": "db6b49210ec82cf9034cd33933e0cdba256c5d66", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332204, "uuid": "2582badd-ca12-4e7e-b5c6-115e9b9ed8e2", "comment": "Malware payload (Heodo)", "value": "ee39a34f729addde3ec89c27e6c4d4ac6840ea21871036eb047b77031860d6735deff28d4733d3dd89aa69f7593712e2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332204, "uuid": "d00ff897-3b93-4d0c-8c28-ca729f2b43b0", "value": "T14EB44C22E151E0B4C21744360607737DE60FADF01B95B277A3B015AFBAB5E71EE26326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332204, "uuid": "b312a8d3-7020-444e-9ac3-754f625e7a63", "value": "c354d2e1bcc359dcb00a22865c038d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332204, "uuid": "4e66c0c6-08d6-4d3f-a8f3-9b5181270cc4", "value": "6144:TMhEi6lq1EvTzbQJqnoibRcJQfTfwZsIhzED5TJycXo3ZqdK/J:hFGibRYQrYkoko3od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647332204, "uuid": "b0d2b9bf-39d5-4c6e-a367-7433d1f75e2e", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647332204, "uuid": "67e83dfd-40b1-4ba5-9840-affe63897787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332204, "uuid": "d684616e-b6e5-4b65-ba8c-18bec196a629", "value": "emotet_exe_e5_7c14a424f4d33c79ef1541638e65b943856270095023bae71ea9c01493373ae0_2022-03-15__081639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b1dc48-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333777, "uuid": "b8ddd964-9bc0-4c5a-b898-7d9d3301a468", "comment": "Malware payload (Heodo)", "value": "4c8a11d15007da6362346e2412ef1400", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333777, "uuid": "3a450ed9-3885-42d6-a677-2cea21da2d5c", "comment": "Malware payload (Heodo)", "value": "7c1bdc0b95fff1048d6d11ac40692f9bcda418c87fc0a0895c2f8201f9891a1e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333777, "uuid": "7131318e-c554-4b9d-a483-c36eafa6eb9b", "comment": "Malware payload (Heodo)", "value": "a35acf97b7866339e6a8be5bc05a258649bba5a4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333777, "uuid": "047332e2-4203-4574-b284-a9eb59f7b133", "comment": "Malware payload (Heodo)", "value": "2a74713a2f238c5f7c77a2520270b211c6bc5039b00bb1c1fa9f545b42f6ee14ed12b0d38ff0c02ffe6a84b19295630a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333777, "uuid": "b59fb221-1608-4559-b1f3-1e3668073197", "value": "T19C73F11EC532E19ECA2714BDD1CF4FE7A04F79142AC1E4BA9380ED4D2B49E4A674E21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333777, "uuid": "de2bf0f2-4bf2-43cd-b831-916ad15884df", "value": "1536:wheXF/Sto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMbV6Jr:whUItzSmICpH7OZuvZGsMwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333777, "uuid": "5309e911-cc29-494f-9ab0-9e69379052ff", "value": 75275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333777, "uuid": "46d13a51-f4d9-467f-b548-0983188dcf35", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333777, "uuid": "a23444fb-c943-4480-a108-565aaa306316", "value": "DETAILS-7429.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38ab43f-a453-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647344101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344101, "uuid": "7861d031-08cd-40a0-ac9d-3d1f40eb323e", "comment": "Malware payload", "value": "f80a0c54056d71f7c9392943c5c06044", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344101, "uuid": "c1890030-e6ef-4337-b630-c1c052e57f22", "comment": "Malware payload", "value": "7c6dafa88b5f1d7eeae5bb699ca85b20beca30fd8e689dd7663327676dcab5cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344101, "uuid": "f5d2fe04-55a6-4d22-bba6-7e2aed00170f", "comment": "Malware payload", "value": "414f2d3877caf74ad5ab6ab7270ea50512d37f31", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344101, "uuid": "d7c10a4a-7c9c-43d7-9ea1-ab0b714fbaab", "comment": "Malware payload", "value": "9af190ef1b173080cb50a639534ab2ad0cfe669630d0c2ad7267b3f3524038e3d0592a938cb97139d1da32b3c5574074", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344101, "uuid": "ac98c2a9-a66e-49d9-820a-b2efebd43c71", "value": "T1D0361286E7D6A86FE9F7C3394B7A866A86028CA6C743D7474915713C0D7BEC04E41EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344101, "uuid": "895ad66e-8d1e-4388-ae3a-ae4bec7f5dc9", "value": "98304:JiPWwrhA9phdlJu+UrmTOUgWicA3mbAyGywvs6zOIU7Byw7LcNvKf3mRAI:uVWlJu+PiUPNKmcywZzOBygLeyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344101, "uuid": "3b0d7894-3c5b-4b9b-8db0-dd1ea133b3c6", "value": 5121905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344101, "uuid": "4fd183a0-feb2-4a30-8a91-430f8516fb50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344101, "uuid": "215b27bd-fe3c-413a-a8d6-83b91d658196", "value": "postbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77821a83-a4b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647387272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387272, "uuid": "86d06308-bccc-4107-86fb-1c45345d7954", "comment": "Malware payload", "value": "3ec3b01cf96e2b3c3b106c3370b83ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387272, "uuid": "c52d3d4a-3d45-4d3b-aae3-e2637734b269", "comment": "Malware payload", "value": "7c8dc5d401238f679c24463c4dc79c89636f41b8b328e0e02d81e7a1ad8442b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387272, "uuid": "2b8bc946-d2f1-441f-ab96-759df8703ab4", "comment": "Malware payload", "value": "a1bad45b542a03f844ecb796d3915f3f7c6ca30f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387272, "uuid": "0c673a7b-58b7-47eb-8103-a39ee56c9667", "comment": "Malware payload", "value": "104e494e08f4de8457b9288cdb717aa7741662dc23ac7615fda7f8fce9128fde8eaa747456369683099c6bcbd6ca87f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387272, "uuid": "7c7a2fa3-00c5-4016-8fdb-26838e90dddc", "value": "T12985C002FB8284B2D4971578A1A7977F8D3AAA205324DED3CBD15D628D312C1A73F3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387272, "uuid": "ef431bd9-fae0-4822-94c5-e51b51ad9552", "value": "3e6bfcede74cd7002b8c110f9ea0e71c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387272, "uuid": "458f8a09-d024-4baf-8ed7-74e937a97d1d", "value": "49152:rCEN3aUcLKbnChDltPaZgeskd4DIxXCj:rCEEtEChJoZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647387272, "uuid": "5065654b-67e2-4d69-b621-a7e8b0ee7126", "value": 1736192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647387272, "uuid": "fb1dd0df-6cec-424b-a1b5-0514c71bd9db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387272, "uuid": "f2ec35d8-768a-4b5c-b330-79e4fd3ceb1e", "value": "user_unit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e2b9d3-a466-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352098, "uuid": "47e26729-2d23-4c85-b611-09a273955c58", "comment": "Malware payload", "value": "75187ff628fed2b8ff3878d3179a5c29", "object_relation": "md5", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352098, "uuid": "202be38c-31c0-406c-979a-91ec3f85ef07", "comment": "Malware payload", "value": "7d0e5c7a011351eabd184ef1c397ebd2444577d28c4e70c15ba908aa8a648b1a", "object_relation": "sha256", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352098, "uuid": "bb672669-8cf2-4437-92d4-ebf6c4b90fa2", "comment": "Malware payload", "value": "b275c0e60cf5025cff0685118f14dd2eceb39db0", "object_relation": "sha1", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352098, "uuid": "6002b23b-fa6c-4854-830f-ea2336ecc331", "comment": "Malware payload", "value": "63d08987dfdc9161d61051741254ca3f20b10e0f981e2f0887cd278c5dc25eb5c3f232fb368fa26437690cbdddaffb6f", "object_relation": "sha3-384", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352098, "uuid": "b1f11054-d766-4e4d-b2ff-e473060c582e", "value": "T13F429E69C55B6873D67376B856B97CC0F08C0EC36540E7CD30097BCA654A3E4AB53E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352098, "uuid": "090d810e-7c21-49ff-b404-ddb68aaddbd0", "value": "192:Q86oNmPOJ2wc3rMKkTPukcx118H111M05AgPekKiD2h0vyJVM5aa6ia:Q86tPIhTuHgH111/eVuhvyJWD6ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352098, "uuid": "bb7af89d-efec-4bf4-a9ad-abf8606f63a0", "value": 12300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352098, "uuid": "68f002a2-2b43-4375-b31d-ece0f9b1660a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352098, "uuid": "9937f74a-fd44-4e75-baa7-977cc3117dc4", "value": "R147En.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae68904-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326155, "uuid": "3c6614b5-fd2d-4039-a7e0-cd7761f0a964", "comment": "Malware payload (Mirai)", "value": "b533d0ea33a4d2e3f0823d70d88496c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326155, "uuid": "7a3896fe-e60e-46c0-a3a0-5af01275c593", "comment": "Malware payload (Mirai)", "value": "7d3262b25460424771a06a145dbd1d9e637ceb6719bff9778cd4e782e4b59ce6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326155, "uuid": "e28cc655-9998-414d-a0a8-2bbb8f7edca9", "comment": "Malware payload (Mirai)", "value": "85359345dbab10895e78d452c6008301df7974a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326155, "uuid": "3134b64f-8ef4-44e0-b85d-9df413cd4ade", "comment": "Malware payload (Mirai)", "value": "a1e92ff117e28449ce04d29c2262b1e4a24d1f9860546d06ed57fc74b70d74a390438e571d2ee1fb5a25c0316bae202f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326155, "uuid": "9b63a8a5-9af3-4ade-b788-1fed9fdee8a8", "value": "T103832981FC41A622C7C11677FE5F018E371553D8E2EA32079C285FA03ADF95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326155, "uuid": "d620e920-316a-4661-9126-61d8872903e6", "value": "1536:5yH82z4XNk3sTWs6FQ33eZt75Jo6QupDln70RVNvL:5yHR4XlWTY3wD3DtIdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326155, "uuid": "e09e0eb7-a224-4869-a56c-cf756ae134e7", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326155, "uuid": "59a010d3-cd6e-49fa-b375-9410f8499110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326155, "uuid": "7e914be2-fe23-4d68-ad0a-4dc1a043602c", "value": "b533d0ea33a4d2e3f0823d70d88496c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7a8100-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302697, "uuid": "01e76eac-96e3-409e-b875-17f1f6204578", "comment": "Malware payload (Heodo)", "value": "b6c0ba466857311826af6e27276a7015", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302697, "uuid": "a7bad7f5-2521-4668-84c1-2a71a1d86cf0", "comment": "Malware payload (Heodo)", "value": "7d6590315c623dc5fd5d0a0e3e2ae31dc374bbdd8acb2266f27f5247499436b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302697, "uuid": "f650536b-461a-4306-96d7-d60e253bd7b3", "comment": "Malware payload (Heodo)", "value": "1fbaacbd70151b76c4060484bfd6a7663c4584e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302697, "uuid": "eeb2f3ff-fecf-4604-932f-694bde7fafb8", "comment": "Malware payload (Heodo)", "value": "bde5636d0ffd9c2145d01572aa59e14a75eff0007e787a55ab9c5619853eda2dc400de94f7fe156a959494b058eeb4ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302697, "uuid": "a031c517-8183-439b-92aa-050a33284dad", "value": "T11C256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302697, "uuid": "b5880586-d506-470e-a487-6066e8a929b8", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302697, "uuid": "05873df5-f3b2-4cb0-a559-c3e2cc8a9392", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkLwLBeUNKsuG31Pt8H:3dlV0EnIThwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302697, "uuid": "38fc44e2-f9d6-428a-b5f8-bb01af5444b9", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302697, "uuid": "9b7d71e8-5fc6-4aa0-acb5-be1926b9ea0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302697, "uuid": "07911ec9-fc40-4f14-8945-3f1cc16c4af5", "value": "emotet_exe_e4_7d6590315c623dc5fd5d0a0e3e2ae31dc374bbdd8acb2266f27f5247499436b5_2022-03-15__000451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9623dc9-a47c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647361613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361613, "uuid": "56e8878d-2b37-47d8-a5e3-494df079327d", "comment": "Malware payload (Heodo)", "value": "646778da45db9c9dc355cadebb197d92", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361613, "uuid": "86d0f3a4-de31-4df4-9b68-8449116cb7a4", "comment": "Malware payload (Heodo)", "value": "7ddd120df029920a9722188e9a89fb1f54d907c458ae2784c8dcb595854e685e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361613, "uuid": "cb0d0104-bb2a-4f16-b82d-d75297720589", "comment": "Malware payload (Heodo)", "value": "c71c5bca95aa9798190e5efda8d8e9a1e29dadff", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361613, "uuid": "904f0cce-3b15-4913-9a07-2b9c3d636471", "comment": "Malware payload (Heodo)", "value": "5857efca6a71d64318134ba59ae9c5a867b22c373ceb4f7fcda946db402f7bf46e4221ac0d9ffcb33e3e35df23091ab6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361613, "uuid": "df14f495-f2b4-423f-9d38-f99a75f19d87", "value": "T14273E01EC231E15ECA2714BCD18E0FE7A54F7A1939C4E57687C0EA4E17049AA638E35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361613, "uuid": "b6a0bf76-03d9-4760-8ab6-a88c9dc9a492", "value": "1536:S41yiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV4XG:x1yiCtzSmICpH7OZuvZGsMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647361613, "uuid": "97af6864-94df-4bef-8a3c-fefbbefa5af2", "value": 74771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647361613, "uuid": "bb9a3932-41ae-4b8b-919f-e24bc40afbd0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361613, "uuid": "3e7c9b6a-497f-4138-bac5-1ed137545410", "value": "A-15032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7f690b-a436-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647331446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331446, "uuid": "7f28bd85-8a6f-49f9-b21d-9827aae15cad", "comment": "Malware payload", "value": "df648ccd3b842ce0128318629b5cbd0d", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331446, "uuid": "fc253a42-59f6-495b-a40e-bcf5810809a7", "comment": "Malware payload", "value": "7de663524b63b865e57ffc3eb4a339e150258583fdee6c2c2ca4dd7b5ed9dfe7", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331446, "uuid": "af97c723-5078-40a4-9644-d8ccfe098526", "comment": "Malware payload", "value": "eae3b67508ac5df766609f1630b615c0110cd6fe", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331446, "uuid": "6316ea3a-96a7-4b7e-9062-72edbbf4a53f", "comment": "Malware payload", "value": "5cc1e245d61e7639b438dce870cb9e9888f91a6c2969a7df34d3c2e8506552907ec5249ef6fa1174b5031304edc0b542", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331446, "uuid": "964ced95-3efb-4c42-9755-ea37ecdc6fa9", "value": "T12765FDF261957CBCEE8CC03295F482AF2411456B6C535FBC1BA925A5AD2BFBE0B01D1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331446, "uuid": "46ac409c-f6ec-47a0-b7d5-71f96febf937", "value": "12288:WNVXcy7qgU8VCRRgNAt+oNkNU0gxBsF/VlDRGZ8OF/wQTXDk6lqIP7SwtUgpZXYu:WDMy7xFguA8oN9LxBiC3NTzk6SHgXf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647331446, "uuid": "6f2b75b9-4f46-4442-8a46-9ded39a35487", "value": 1427456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647331446, "uuid": "9ca8a202-bc1a-4d49-b3cd-236c343056b7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331446, "uuid": "c0ddf5c3-daed-4428-b2fd-43bdcc773a1c", "value": "Report55.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf5c7b0-a41d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647320840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320840, "uuid": "27d46020-ea82-49af-b8fe-ff8f8f035232", "comment": "Malware payload (RedLineStealer)", "value": "44471e94a0873471390f0b0b1f75f6f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320840, "uuid": "5be39759-fe17-47de-a45e-d21f042ef665", "comment": "Malware payload (RedLineStealer)", "value": "7dfd5b1809da980434860b3294a3339dc6a23065d3f9d681fb20cb7c8f6993bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320840, "uuid": "ca4ff62d-bfda-43d3-a7b2-615c25f827a3", "comment": "Malware payload (RedLineStealer)", "value": "6640140e5e8731a257ab7ca039f8a3174088f70b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320840, "uuid": "a9e5405d-7771-4f30-9ad9-1c4211c5e599", "comment": "Malware payload (RedLineStealer)", "value": "408acce328f2251c4c4ff13870fd4062cb18a1bc751a2c3894f8bbb45a00ea0f968501ecd09d4462abceb202125e4256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320840, "uuid": "34e93e36-0ad6-46bd-963b-71642cbc7c91", "value": "T166449DF17690C432D092F530A825C6A15A7EB832DAB485073778272E2F713D5AAE935F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320840, "uuid": "95a89089-3944-418d-984c-87903e5f221e", "value": "30b61c273b1d343ed1b1e7a06292b7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320840, "uuid": "b72c4b6f-391b-4580-948e-646ef3cbfff6", "value": "3072:FHlrH0zN6LwIPBNAd6dDK850tVggjcGkNIVqIHSVCEKfzyH0es:95H0R6LwIPi4Khv7ITsqSSVEmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320840, "uuid": "d7b08bdb-e5fe-4b97-94ad-262547118bf7", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320840, "uuid": "00c5ade9-fff7-480e-9797-b9d05056067e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320840, "uuid": "cc37f879-f26c-4309-bd38-8d2b88e79ac7", "value": "7dfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06eee3ee-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333826, "uuid": "77d854cd-bea5-4295-8bcc-6f5ac8da16a8", "comment": "Malware payload (Heodo)", "value": "9b592d1944345a64f322238abfa93a9f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333826, "uuid": "a91c199e-dd50-479b-9830-f4ef89f126ee", "comment": "Malware payload (Heodo)", "value": "7e0191c55b323f198248c68e6133420eabfefff5661cf0400c8163b452342b1c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333826, "uuid": "03b2af8e-4508-4fcd-97af-2b75aa226295", "comment": "Malware payload (Heodo)", "value": "68f271fb356732e44da5060b2eae2ffe6b68c12d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333826, "uuid": "49587630-bc2d-43ae-a0f9-fbcadeb3afd2", "comment": "Malware payload (Heodo)", "value": "92fd1df123613cdf90c34ae1ed4ad405869a10b90ed64dbddbc2782fc430d930e09d8f28518dbbf866855442ea996c62", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333826, "uuid": "7d679b71-94f9-4b4c-a647-372a209c728b", "value": "T12A23E10E5D13B94CC3369AB983CCA2F6665976221093A91A3040FE5C3FC664BAF5F09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333826, "uuid": "e1fcd5f6-0d17-42ba-9b96-e9c9e695c64e", "value": "1536:FlFXmY3B6Y8r7mfqN1+TpCgcgsMA6VIcrW:Fl1mG4YqVN1+TtRrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333826, "uuid": "065cd4de-f708-4d7f-b54d-69dafa4b37c2", "value": 50114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333826, "uuid": "48a39d12-4c10-4087-b7df-1b3ef5a6643a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333826, "uuid": "50930d57-7e6d-433e-a530-75a724ee3ffe", "value": "Payment Report - 2022-03-14_1524.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7bbaf1-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "87e28632-725b-4684-8938-4a042b6770d8", "comment": "Malware payload (Heodo)", "value": "cde569f4b31b5310038357c8cfb6818b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "8d972bc8-fdb5-41db-a0b8-de758f119316", "comment": "Malware payload (Heodo)", "value": "7e38d10cb8ab8eb9c73fdb8b5f96a2dc10773cef29c6f1013040c6971d900cf6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "0b7bec2c-d799-4be7-a441-69006c694790", "comment": "Malware payload (Heodo)", "value": "0028aa0599e7c983614beff2f53af4c76ee8ae0a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "1f8def74-f9f6-4c77-a9de-b349b223bee0", "comment": "Malware payload (Heodo)", "value": "ed4316d4c2845cd20c410e18bf2d978214804a15b509b5a8cc1db3c85ee5347076c821e5f2d4ac55486bc341b19d9914", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "e4b0860a-d9a9-4a86-9135-772dd8f17e49", "value": "T1F8256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "cbfceb59-ad70-4c74-bf51-d7f7d37fd2e5", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "e841141d-4b43-4e66-b41e-2f9e4e0a4b0f", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkMwLBeUNKsuG31Pt8H:3dlV0EnITKwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302695, "uuid": "d1c1cff5-2dc8-40b7-9886-349aaeab9960", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302695, "uuid": "144865ec-7ace-483d-b481-7faeb939bdb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "3b2f5e8b-e6c5-44a3-9d4f-ef8723be47cb", "value": "emotet_exe_e4_7e38d10cb8ab8eb9c73fdb8b5f96a2dc10773cef29c6f1013040c6971d900cf6_2022-03-15__000447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c6a0ea-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "7bfc5af4-487e-403b-bec6-337d3ff66e18", "comment": "Malware payload (Heodo)", "value": "1f28fc40a995360a5655f289d7c2a019", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "ceffd636-fdc3-46e5-8976-116abb953ef7", "comment": "Malware payload (Heodo)", "value": "7e4d1f30c5889ce54ba7b9ded1bb5bd5caccdea6a77bc8966bafa116ffa853e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "7b98996d-0c16-4dd1-aeb2-25cf21334ed6", "comment": "Malware payload (Heodo)", "value": "f3f1abd1d0b216726895c4c2e88f70adb7347f95", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "de06c79d-0f56-42e2-8a03-1d4dd2549df9", "comment": "Malware payload (Heodo)", "value": "38a008bfdb38f22fe8f19af6d9e396d3f06313045c449f1cb106ae2fa733b4fcb926f9619cf7da884c1a154e26cd0757", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "6f7bbba2-abcd-4901-9475-146596c6da46", "value": "T1FE256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "4a5468e9-bdbf-4cc5-adeb-b6e3c7800a3e", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "f7bec165-9165-45a4-ab8c-ccf4d80f3222", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1XWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6xWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302838, "uuid": "1c857529-9dd1-4385-bef8-a17be896077d", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302838, "uuid": "0fc21a77-698d-4406-8905-aea7f000689b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "d4d2fbbd-ec3d-4034-afcf-7660ded2d10d", "value": "emotet_exe_e5_7e4d1f30c5889ce54ba7b9ded1bb5bd5caccdea6a77bc8966bafa116ffa853e6_2022-03-15__000708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3335467-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647354757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354757, "uuid": "b5426d56-9275-43c6-8a7a-e534952aea52", "comment": "Malware payload (Formbook)", "value": "ca0598e1d55a64bc0c7135d8e5793254", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354757, "uuid": "16be5659-4506-4bfe-ba12-f2224d89396d", "comment": "Malware payload (Formbook)", "value": "7e8b6d0fcec268296d1179fae35ac13072f89d1fb86b708292dbaca5cd2904f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354757, "uuid": "3f8b72a7-5527-4fca-8bf0-3a7f4b5994a3", "comment": "Malware payload (Formbook)", "value": "1a545312e2c671a667f26b7a0cf23e9759dfa8af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354757, "uuid": "2034ec47-c2ac-4018-a4df-9434e6908609", "comment": "Malware payload (Formbook)", "value": "737f8f3e24ffbc16a28cd7a6ac9c0aae2e844527f6e2133606d81079c94e5052b2e887e06d17980d5fb23e0e9c608d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354757, "uuid": "1e5cbe23-87cd-442c-97a9-752166a095b3", "value": "T17D85AF255FF88E4BE9FE1B35A0F30E3846F1E48B97AAB67D18058590689B3D174017B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354757, "uuid": "3552d462-991f-4ed5-b3a0-53af3405a269", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354757, "uuid": "0d7d6637-c65a-415e-b2cd-b80be0d83152", "value": "24576:EWIj4ROxbr4NHtX1J2IecPihkNbYt9NTwf3HxAJwT8Xi2lAAarjVrYK6Q1kv+i3M:Fa4wxqtkOpUooieA/9R6/2prjvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354757, "uuid": "0a1eab5e-f0bb-4fc3-bc40-fa4251319ba6", "value": 1860608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354757, "uuid": "d01b71c0-92ce-47e0-b17d-b685358ae0a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354757, "uuid": "1a1d94eb-73bb-489b-bdeb-12786f0dfdde", "value": "ca0598e1d55a64bc0c7135d8e5793254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64483f45-a452-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647343431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343431, "uuid": "70858e09-f64a-46e2-9e3d-8186f1d4dfec", "comment": "Malware payload (Heodo)", "value": "1331b453b22d75883461811be5fec56b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343431, "uuid": "7947d3b0-b9e1-4ca9-9186-7cded7ecd078", "comment": "Malware payload (Heodo)", "value": "7edbd2767d91dba675241eca210c31f30a2ff53fd3295fceb4e856a44c7a367e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343431, "uuid": "c62747ca-40bf-4523-8e9f-0ffe6bd9773b", "comment": "Malware payload (Heodo)", "value": "500d93b548e1478433f8f2c0a9be66f7c47a9e87", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343431, "uuid": "62cb24ab-dbac-42d0-a511-273b1c544611", "comment": "Malware payload (Heodo)", "value": "29257a81b7ca7237b9c89679ea4f2e407b03c4de269cd8675bc4da3b6e5445f68145f46e39c844592c286d6f798fde47", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343431, "uuid": "2d1bab11-a2a9-485d-97c4-553dc317f156", "value": "T1C273E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343431, "uuid": "fb94b9d6-ab9f-4f62-9825-6cdfbcdedef1", "value": "1536:yuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:MtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647343431, "uuid": "4e24b2db-5892-4b17-9b8f-3694ed8f112b", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647343431, "uuid": "2c38aefa-a7ba-499c-86cc-a4f7779d41bc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343431, "uuid": "746ed7de-fc0b-462a-83e2-2867dd55c0a6", "value": "Documento.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faeee3e4-a4ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647383198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383198, "uuid": "02910335-9634-45ec-b283-d3442ce92958", "comment": "Malware payload", "value": "7641dbe847511b1f155e1f713961ce75", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383198, "uuid": "ca0b6e01-5663-4865-86b4-0eb818f97586", "comment": "Malware payload", "value": "7f596f4ed649c338c5dea040cb87bc02780fd02a32e174f5251bfbf964bb5bc8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383198, "uuid": "65c67e0d-5d29-44b7-accc-a1355cee42cf", "comment": "Malware payload", "value": "8449f136048e1fe3c0f4e54cff5a5de5c9ea2711", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383198, "uuid": "d0faddb8-d9e1-49bf-9a02-230e0e5b896e", "comment": "Malware payload", "value": "6f252d7a51c8736a4899a66f4ef9c8d4e34c35478d3a838308e21aba26f79f031aea7a1096de70b3a4270448327ff0ee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383198, "uuid": "c6c7cf86-8096-4b45-8019-34a591ec3f12", "value": "T1A352A693D86280FDD7FED2BC8296A5694D3374393267B24537E4F526DAEEC116E2D000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383198, "uuid": "f7acd0bb-37ef-45b5-b452-0689f6837709", "value": "192:GWSSyKgAdoVPIt1wd51Quzd7woymq5gPaXZPLLR8l20QcGolWXjcdTvdtRFSlltC:UG3esuzdAmqKiX1LLR88MGoqj2Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647383198, "uuid": "a27129b5-3778-493b-b3a9-1a46e5d2b344", "value": 13576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647383198, "uuid": "30a021bf-e0a0-43b7-b437-550130c6ee0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383198, "uuid": "7c027d2d-da63-4e68-89fa-8f7b70e64fc2", "value": "Ugliest.x86-20220315-2226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0aae1c8-a471-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647356874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356874, "uuid": "c8398c5e-eb0d-4b50-92fe-a7212277f47f", "comment": "Malware payload (Heodo)", "value": "27f52f4d54443a5b2660492dd1a96084", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356874, "uuid": "6473b910-da6f-479f-8a81-4da6fdad9085", "comment": "Malware payload (Heodo)", "value": "7f95a4c189a56ff50841af75f04b416348948f3342484f445f8b4ba21bac634b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356874, "uuid": "8e6dfa37-3797-4d71-ae12-1e26b03c8bbc", "comment": "Malware payload (Heodo)", "value": "6e17d9aedb69d4d5eed19c9a13ef35c96d25c59d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356874, "uuid": "4f23db11-e3ca-4345-ba23-432c67e72cca", "comment": "Malware payload (Heodo)", "value": "4b8bf32fd12795fc979313630ef4bfeae464bb58ad7e88296d6e232a6f5200d92531020472c3f500d6d5f58d6cbc6730", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356874, "uuid": "17310b29-99f1-42b0-bc1a-082f36e3790a", "value": "T195D48D0BADD26133E97E10368D46F3C46DADA9806B1E8573EF85958E0D30DF25C39A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356874, "uuid": "901e409a-8795-47ed-98e1-3c6544241f4c", "value": "bc7513470757b54d42a02554efc208b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356874, "uuid": "a353233e-5cde-4e73-a081-0ad70434f490", "value": "6144:w5uMRBPbeRsaHgEDtHOdtD4zygWdkw6/XkMeFZiGYxorvRZ/J0U7YQzTEPbb3E:w59eDLDtHOzszysvaRWKlFEPbzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647356874, "uuid": "f6138453-e8bc-4ee3-a637-a383948ae844", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647356874, "uuid": "a0648bd9-bcb6-416a-bdaf-c8edab533396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356874, "uuid": "2cbcfb35-e56e-40b5-b64a-41e8761f5757", "value": "27f52f4d54443a5b2660492dd1a96084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa43a7a-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1647363046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363046, "uuid": "710b9899-96a7-4809-964f-7fc99aa58163", "comment": "Malware payload (BitRAT)", "value": "fa53c13ab4d20209a0713d2dc6c27945", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363046, "uuid": "490031e7-c79a-46f4-85ab-27e89c5d5fd3", "comment": "Malware payload (BitRAT)", "value": "7fb90a951ff77f752691909a71a64a003648ea793f2a91c1cc41e3153aa1b7b6", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363046, "uuid": "f81b7c52-6ebe-40b8-bec6-fd611aac05f0", "comment": "Malware payload (BitRAT)", "value": "75b82f05461ad277c92706ee2e7ca79a54ba1503", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363046, "uuid": "cce7cadc-8bd3-4316-9430-ed9486ce0565", "comment": "Malware payload (BitRAT)", "value": "68120daf18dcdfc5088c7f5e52e39acc8b03b743266926f663785f8bfce4baaa6e4c361a5157f54cae9178ee8e4ed1cf", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363046, "uuid": "cc5a7c46-df1c-4edb-a12c-60a504a2d059", "value": "T13C22C117673A4214D370B8BC2249D7895A6D1AC0A1CC297BFC751D594A3036DF76F39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363046, "uuid": "4fc3057b-00d9-46b3-b6b9-2598808f8583", "value": "192:bUps0e3ItSJV/fgM19pFOwRMX05qBKe7QIF/AxUUXs0xNRSz03wYAn:Ipe3IIxF3F5xfWYxU10xNrKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363046, "uuid": "7e454b50-c31d-4d44-8ed3-1bda8f529434", "value": 10120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363046, "uuid": "7e65a664-4abd-40a3-aaaf-1e7821db3d73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363046, "uuid": "30cce6ff-7fd7-47b7-ae98-ae11bb622c89", "value": "Fahrzeugrechnung_DFSK_EC_36.jpg.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5e2eb7-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "e8604b62-f594-4c3c-8cf9-e1a89cdf1362", "comment": "Malware payload (Heodo)", "value": "1f1f7a37ef646147bdb96a201a975374", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "708d89fe-b6fa-429e-9947-8875054c3721", "comment": "Malware payload (Heodo)", "value": "8030bfccb8e0cc042f9b5816c188e41d27b654895a1ab2b530c7aa1547bdd894", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "bf6d23cc-3e45-4f8a-a2ea-edfaff411d67", "comment": "Malware payload (Heodo)", "value": "d93cf7b6efba5932961b42a08d454e6135c209a9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "1d70243f-ac12-4d86-b5fa-7f86a41a0fd3", "comment": "Malware payload (Heodo)", "value": "c058b5d7a350c8869fc74a3fe89f5cb106825615eec9626b6afd2c4c7d58aeb7befecb3486adf57f426be4f5a724c80d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "1c07b779-b048-476a-8c12-34b741647171", "value": "T12B256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "a1e46912-7db0-4878-a7f2-b8fccd4476a2", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "10a0e25c-7e99-4574-8013-dc6dc97ab649", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKknwLBeUNKsuG31Pt8H:3dlV0EnITRwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302695, "uuid": "07954a5a-6f92-44dc-afa5-8aef3e65360b", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302695, "uuid": "e19f8851-1dd0-4aa5-bff4-5562815653e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "3f881e58-d29b-4e39-acea-153112c2c646", "value": "emotet_exe_e4_8030bfccb8e0cc042f9b5816c188e41d27b654895a1ab2b530c7aa1547bdd894_2022-03-15__000446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4819d2c5-a461-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647349827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349827, "uuid": "4f40668a-94a0-4ad6-98d9-16b6e1a18055", "comment": "Malware payload (RedLineStealer)", "value": "a2b42362fc4bdaf4b259e757ebdcbe1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349827, "uuid": "c9cc54d8-627c-4639-91a4-46932c39c45d", "comment": "Malware payload (RedLineStealer)", "value": "8119fad3b28a478680b211052a3af868e09be4cc9fd8af4d5fef720d522e22dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349827, "uuid": "3f634dd7-d178-491e-b43c-c5c5bdc56fcf", "comment": "Malware payload (RedLineStealer)", "value": "bafc33956a5c5cbf797fdf4156bf6f0556c6af9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349827, "uuid": "21f42421-2c08-4df8-99b4-dc014ca158c3", "comment": "Malware payload (RedLineStealer)", "value": "b7f0cb0e8f6665efd78c6a53b4212fe3af6c6158884209dfe9642eac208264016ab410c6e3caeb22380079e4df54548f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349827, "uuid": "47fcb508-2d9c-44bd-80bf-cc4658a3be56", "value": "T1CE34B00576C1C0B2D9A319716860E6B1593EF9300B25DEEB73C45ABE4F312E1BA34E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349827, "uuid": "298bac6e-b77d-4572-9b21-9a16490bf79e", "value": "a09fb7ac37c6846f86e7eae4dcb32d14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349827, "uuid": "b01fa36a-17d1-4b61-ab58-1696055083b4", "value": "6144:fTxLfvl8PmgNJPuir6IgW7ns10anOiABjUhga4:fViPbuirjgn1TnOiWjkV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349827, "uuid": "b8ee96ef-7a11-48aa-a213-fc3da9900408", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349827, "uuid": "20f040a9-0308-41fd-9869-a65d7447d380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349827, "uuid": "82f40421-372f-46e2-a9ea-bd861c889a98", "value": "a2b42362fc4bdaf4b259e757ebdcbe1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77bfdca-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1647354765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354765, "uuid": "83a53c0d-e633-4ca9-a082-5f519314f7c7", "comment": "Malware payload (CryptBot)", "value": "0641a336a19bf28938e8db306cb689d5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354765, "uuid": "235e7ffd-36a5-4505-b9c6-27df6c501ff8", "comment": "Malware payload (CryptBot)", "value": "814d98775286098fbb08c3d5529a37d35c90828de4bd88099fa011e4febd80f3", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354765, "uuid": "e47fdb99-585b-443c-8713-a32c9a0b07ff", "comment": "Malware payload (CryptBot)", "value": "ae670cb76f8b83ef36de8602a5407ea3d284864b", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354765, "uuid": "1a5160d9-74bf-4326-b912-bbd710071367", "comment": "Malware payload (CryptBot)", "value": "bbd1fd11c48d0797d054f0bfde068c25f89a7f68875760431519a2df0731c45a0bbcee0badd954fbea6d6a1a890fb93d", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354765, "uuid": "6330daef-694e-441c-bc1b-d8bee552bd66", "value": "T1B9D5333C29337666D02D9BF2073D274096C0BB4B5D18757F4F56C0AA224A27BB39E8E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354765, "uuid": "033e6fae-63d2-4a9b-bb68-8270bd419112", "value": "6985c05c81106254b2fb2149ec38edcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354765, "uuid": "511c0333-7980-4368-83a8-c20da69dc572", "value": "49152:E3/6jqgPEBlA88J7SbCOD3kXzCVJastOdlv7t9z7RE+5ue95QBerIkFC:E3Cd8Y8s7VOD3FRtOdHVRXraA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354765, "uuid": "4443e509-8247-4c71-aeac-169c80a4154e", "value": 2790400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354765, "uuid": "503d8300-e582-4a04-9c4a-a641badb6e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354765, "uuid": "1efd8d29-ea45-4d30-a99f-a052506e3e7d", "value": "0641a336a19bf28938e8db306cb689d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d37ea30-a454-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647344252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344252, "uuid": "40ee405d-c4b5-4d02-a1bd-b39657ff540a", "comment": "Malware payload", "value": "f79affcc8f7c2fee1c88706f0cafbaaa", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344252, "uuid": "ef80ce89-f6af-4d60-8751-feb3f2b09702", "comment": "Malware payload", "value": "8157189fdccfa3999b4b3d8ad5154e002a4fa5dd0578c0238c82935df6c55dd9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344252, "uuid": "f6706ff0-6c5a-4eb9-94b3-636b00f820ae", "comment": "Malware payload", "value": "4b7cfd903a6f959deebc316b9824fbd13be0a61c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344252, "uuid": "acbc9708-1c22-4907-be91-db9dfd86be78", "comment": "Malware payload", "value": "17b8230cf08bca3255e5919f4fd6ebcd7d33573de9f23f236999de5b06d1ddc90bd1e485ad1b6d7d7f30f57b5e2463cc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344252, "uuid": "3e9070e2-fa7b-434d-a2d6-8a1fe96ff592", "value": "T19365F186BBC56C6FCDB384354F9A8322A2128C1BC687D70769D0793C6E7B6D44E49BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344252, "uuid": "083a1a70-d78a-4055-a71d-6d61eb92383f", "value": "24576:7oO26bjjdZcuqORVNd+f0Wu6M0D+/7GMUjrMUW3g/HCuIyggwxckQ3:7oYjdZcPORVS0WA0D+iMgMxOPIyggwxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344252, "uuid": "bb825852-01d7-41d5-863a-44781347a9ba", "value": 1429613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344252, "uuid": "0abeccc4-553e-436e-afbf-0f46984a6e5f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344252, "uuid": "c57d835a-0de7-4607-8797-5512e118077b", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1686f55-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "254a8d0e-514f-479c-b05f-d03b75c7729b", "comment": "Malware payload (Heodo)", "value": "2610edf4cebb2154fd5a86a07f056cf4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "29d1e2c4-92d3-4919-9a39-cdfb41886217", "comment": "Malware payload (Heodo)", "value": "819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "f7c77077-35c4-4297-a382-9709b1f0d2b2", "comment": "Malware payload (Heodo)", "value": "0cc9a2a4810fe1964ddee1c5f9cde0c8352f0d96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "ddf11c9e-bfa6-4b23-a5f4-7579549f10cf", "comment": "Malware payload (Heodo)", "value": "168ff195fe2c19374f485be836bb2d6b36650be4f5df316dd5925da1680878c822d4629e0d877773939e571cbc504c3b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "cd90331f-765a-4f6c-99d7-0164e03324f6", "value": "T116256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "1d7d4b47-f08d-4a7f-88f7-8dedd14b6f84", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "1cc73e12-b8fe-4ed3-ae9f-1e1c9de58f90", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1FWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6fWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302839, "uuid": "cefa6f78-5431-4cd5-bbce-267a4dbc8ebb", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302839, "uuid": "5d422933-f1ed-4164-bcc3-b3a96489892f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "b4b52bd3-dacb-4826-973f-fdc745a26352", "value": "emotet_exe_e5_819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd_2022-03-15__000713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5a561e-a465-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647351444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351444, "uuid": "80230059-498e-41af-9d37-5ceaf2f28e27", "comment": "Malware payload", "value": "65f0d3cb106084ddadc6c2129f702517", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351444, "uuid": "f85cdcd9-ee92-4f90-933b-a50f16ad6496", "comment": "Malware payload", "value": "81c7eef54c852dd68050147f77f937933cbff1c22722617180ca386ef55918ab", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351444, "uuid": "981579b3-bbd3-4153-b657-194de124073b", "comment": "Malware payload", "value": "4476657d32a55ca0d89d21d2a828a8d8cbc5dbab", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351444, "uuid": "e28a630a-5dae-404f-a831-b358633a7ec3", "comment": "Malware payload", "value": "e2cd2e3d88946d8fde13ededd8799ce930b438bcbe9065c6c4f7d930e7cf931f106ce277c435ecdc59ffcea3431efe4e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351444, "uuid": "1581d5ac-309d-4321-aaf0-97330fe3a58a", "value": "T18306120799898B13D12943F5BE174EA82F163E0DE99179FF11216ECB3E702761C8E52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351444, "uuid": "05542d93-19ea-4cdd-ae8f-e0bba772833d", "value": "98304:3ciK5Q2sGavRHoKOzX1XidmgqyvFo8SoooMU0o/:MfQ2sJpo3hgPvFeyML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647351444, "uuid": "8b2030cb-8ada-4e6a-a559-a9aa21c14818", "value": 3995648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647351444, "uuid": "2dd439fd-2e8d-4c91-add2-e704f209e63b", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351444, "uuid": "7bf14919-2471-40e9-941f-dafac5ae3c34", "value": "Leaked_Kremlin_emails_show_Minsk_protoco.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8943d612-a431-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647329320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329320, "uuid": "01197971-06a5-41db-8035-b764f63b48f2", "comment": "Malware payload (Loki)", "value": "3b257aab7d36ff967a9031acf062c90b", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329320, "uuid": "a5689505-f819-4b04-91af-b9da25aae741", "comment": "Malware payload (Loki)", "value": "82272df86246d56ee7f4ba943bf9026f7ac6a82bd0c7bf4bfc62dc8a33dc67cb", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329320, "uuid": "d88738cd-c299-4f86-aeb5-1eb653f38d3b", "comment": "Malware payload (Loki)", "value": "0b5b795e6cddafc590fc968397281ef395930d76", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329320, "uuid": "a161e65d-44d4-4b6d-9353-f5a78106385c", "comment": "Malware payload (Loki)", "value": "9e63b57ba08dd903c287fe068995203e87647985b1bef67b29be96a64f71729d135937a8cbb9f55412cc2a8b799107bc", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329320, "uuid": "be5345e3-97c3-401b-a625-0af85d24eab6", "value": "T185F4334DEAAB840C1421F48349D531F39269DA0EE156D1EFFF282DEC36EA72856432C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329320, "uuid": "d693d1e1-5850-475e-a02d-5f76b008e923", "value": "12288:2vUFLBosbD6m4RQaYCo1YAzf+jUYjU/3UILFMuVqus3kRgU459g5W+F0cotFlP0S:2eLBoChUoWA6jUYjOkmFMcqP3kR0LaWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329320, "uuid": "b58b5584-7dab-4d70-9228-bfb60efcbe53", "value": 756991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329320, "uuid": "46273c5e-d944-4d53-b179-3c91c36ff9e4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329320, "uuid": "2a206f1c-d608-4d57-95dd-c9c76e9d0efd", "value": "pending payment.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f968dae8-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647353989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353989, "uuid": "4e91b0b0-6542-435a-9f73-2c316c339136", "comment": "Malware payload (AgentTesla)", "value": "65484c83e75c35d950fb7286191ce10c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353989, "uuid": "92375676-4a36-446b-b836-23d92bdae464", "comment": "Malware payload (AgentTesla)", "value": "8244fe4dd2f66435c58d86757e601e159235c529881bd1efefe1bd145fdc0408", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353989, "uuid": "35c3e00c-43a1-498e-a0d3-afab7edd6edf", "comment": "Malware payload (AgentTesla)", "value": "9d0b16f8f26503e2e52bc66c3f0d3ffd0c780ff5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353989, "uuid": "f34b696d-fdd3-42ac-90b4-d6e96bb70fc9", "comment": "Malware payload (AgentTesla)", "value": "a4fc9a9263f40c5836872f78ce314aa93aa4fe6540cb05f6b3398c7cf843ec1693646df1278a50d64285bbaec8f71533", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353989, "uuid": "783ba156-1938-49b2-bcc8-f777a65e51a7", "value": "T14A459D42BDDEAF0DCDD611FFBC214E38CD91B9D51E11A42C78402A9EDC73BA4A5D2826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353989, "uuid": "64990b75-64c7-4820-a31e-5e6364f51dcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353989, "uuid": "bb15e39b-ce38-4168-a65f-2358040d1078", "value": "24576:hHXE+3oLs+UNHRUXwGiajDbCr8gGZWRKgaVpxkiAB:5iLs+UNHuwGiaPe8HZjVGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353989, "uuid": "2c111060-674f-41e1-9dfe-50055a02600e", "value": 1215792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353989, "uuid": "8d035105-1e70-4d36-becc-7d3c00b401e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353989, "uuid": "23f7f3ff-d0d7-4684-bcb6-751d0c391d3a", "value": "New Order_15032022_autecpower_Co.,Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce212452-a42b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326859, "uuid": "c424d735-7c8a-45d4-9134-1c136baaf2e9", "comment": "Malware payload (Mirai)", "value": "39bff96470956f6d6f293083dd6ebded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326859, "uuid": "ecfe8f5b-b8cb-4031-aa87-54d84385c130", "comment": "Malware payload (Mirai)", "value": "82bb25dc0816c7ae82d9e8e637db2fa73d9e1b4c3bf926fb03f8d2251d7d6271", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326859, "uuid": "280211cb-ed00-4796-bb52-857623a7fa4f", "comment": "Malware payload (Mirai)", "value": "27a2591764952f9b4f7fe71131975f40c8956508", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326859, "uuid": "5bdd960b-f322-45c2-ac67-be83a8eb2aaa", "comment": "Malware payload (Mirai)", "value": "a2579b0e05817ff28ffe2e08058bafaec102f7cc194769125643a04cefb60f0e4f2f3765ed163486ed68e9f5045bcd22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326859, "uuid": "83823afe-46ad-4bbc-bd84-1464cd832879", "value": "T116B2D0E5F0F38D27E1549335A93135512E118610B7AB2787AB85D503BB33B01B7E1BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326859, "uuid": "2c109ab9-7c6c-4b58-af5d-da2f77aabab5", "value": "384:MSLdCTmq1yE5Avy2TUophi95D0O8Y+O2uGbID9m6uNmXkCceJPvJfW6QAmolssA4:dpZmX512wopS5D0OZ+OhGbvcUCdvJuXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326859, "uuid": "f4ba93e2-7870-48b4-bf16-4795cd69c742", "value": 23844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326859, "uuid": "87ece363-f1cb-41fc-9b2e-99ebdafdb84a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326859, "uuid": "e15f0abf-5e2b-4138-a558-fb15bc6e2d8d", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.12187.7008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763566d2-a491-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647370520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370520, "uuid": "100d53cb-168d-4050-80b4-45a27f4a4c7c", "comment": "Malware payload", "value": "f8f52accae5d0e292ce3227b49fe196d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370520, "uuid": "7bb085a5-55e4-4e5b-94ae-44ba285de7ed", "comment": "Malware payload", "value": "82ea67bf34ff50959503c526b97b4c0a02af242dc7423297827dd51f5a4c7ff2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370520, "uuid": "98cf9512-9caf-4df3-861b-6359dcb5c1cd", "comment": "Malware payload", "value": "970c96f62a9fd2626ae08701d4fd6813cad7a9bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370520, "uuid": "4ab80ebb-bc6e-4bb6-b9e2-6a8103978aaf", "comment": "Malware payload", "value": "c941f4494640602a19ff5cf542d88f966167d5cefa0fc01610f217ecde13f12604aaf5bb3524f6dd5f5c0885635a852e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370520, "uuid": "9f985aa2-1bea-4ede-b087-efe60d665ef0", "value": "T106E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370520, "uuid": "413a3816-d729-4e61-951d-e475efd5be72", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370520, "uuid": "f09478cf-52d9-49bb-959f-6797aee971b4", "value": "12288:KFxGsTPy4BHT4Sj1zfzf7ABqDLkWynCsZ:obPy44Y1ff7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647370520, "uuid": "bf65a57d-2d66-4614-825b-5f0861a00733", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647370520, "uuid": "19bd6650-b694-4a68-9792-998685149718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370520, "uuid": "02ba0cff-f1f0-4652-b96a-a63ce157bc80", "value": "emotet_exe_e4_82ea67bf34ff50959503c526b97b4c0a02af242dc7423297827dd51f5a4c7ff2_2022-03-15__185514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740f53e7-a43e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647334868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334868, "uuid": "ad7d2828-7d8c-4fb4-a216-e9c3c36a27e4", "comment": "Malware payload (AgentTesla)", "value": "af8ddadf0fd4190a3f23d202e4d1dd99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334868, "uuid": "e63cb604-d684-4312-a248-ec96065e743b", "comment": "Malware payload (AgentTesla)", "value": "82ee704e5f697d8a380d4cd571e7d48a5ea13b426653e508fec415ff9807b197", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334868, "uuid": "d358d2b2-4eeb-4885-82f0-b853ef9c02d4", "comment": "Malware payload (AgentTesla)", "value": "cf27fad9d92913112080c33702aefae367c8df0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334868, "uuid": "a6e41af8-e38e-4ea3-9158-095a6da9f4a7", "comment": "Malware payload (AgentTesla)", "value": "3749c5748e07bcba3f1f69835035633bbcbeff27286f001145aac0a8c6f25911766084d2c0561f927b2c3568e3d19701", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334868, "uuid": "f4f2f033-ce62-47be-8e99-4c4b5d325161", "value": "T17A057C1039E4C617E7BB5B31DBE02653977BAA927723A35625D033291D37B81CC092FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334868, "uuid": "0623fd6f-3d8d-42ca-a572-3bb0899c5efe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334868, "uuid": "8cd1db71-83cb-4f87-94d3-f6aaa4462bd5", "value": "12288:GZyXV731GFnTdxtvD7qxYp9buL+sfxaVuVq1vDrApXjxb+Lsl+Y9+LDot9jBG:IDtSkqCdprY1yLM+YiDo9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647334868, "uuid": "a8c376d1-d695-426f-a398-5ad8e074bfea", "value": 838864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647334868, "uuid": "ffc62a87-c1a7-4e6e-a548-9ed7bfd8c23a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334868, "uuid": "567e14d4-df1c-475c-bc8f-c0cc89cef7b6", "value": "MV SPAR HYDRA - VESSEL DETAILS.xll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5733779d-a464-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647351140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351140, "uuid": "f3fcbd4b-aa6c-434a-9eb9-514a3ff8f8e2", "comment": "Malware payload (Heodo)", "value": "4cc641c1d7a2c307f68233606bf76933", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351140, "uuid": "141aaec4-0a00-4d1e-8b28-aa53e33a0f61", "comment": "Malware payload (Heodo)", "value": "839becc487c717530806f5a01f232b7516202ce6b35c441a89a71b0012635ee0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351140, "uuid": "af0938d9-8c92-4368-a6ff-ed4dba2c1bc5", "comment": "Malware payload (Heodo)", "value": "f49cc5276faa4c18bbd7c310b0627b314ac37241", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351140, "uuid": "a5fd7177-4d1b-4480-b244-86ecef3a5787", "comment": "Malware payload (Heodo)", "value": "bf75ebea72b062bd5939e9efa69b504398a40a1d939a876c2a85ee229a1842357560bbfb1429fd83fa72f17353eea842", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351140, "uuid": "5285db0e-ce1e-4ac7-a932-2750aa858bb5", "value": "T1C333D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351140, "uuid": "477c435b-6ee3-48e0-9e56-9b89eac4f777", "value": "1536:EAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:tcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647351140, "uuid": "f19edfb0-a4dc-4f5d-8f29-f21340c549e3", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647351140, "uuid": "64d98b14-2ff0-4e93-8634-273f14850059", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351140, "uuid": "d3b0fca6-468c-430d-ac37-eda214046665", "value": "RechnungScan 2022.15.03_1428.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063bd1ff-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333825, "uuid": "935d43ad-1061-4e74-abcc-538da123b419", "comment": "Malware payload (Heodo)", "value": "c31592ec3d03218f41700fee94f56162", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333825, "uuid": "76a067fc-fac6-43b5-a956-be955b53d29f", "comment": "Malware payload (Heodo)", "value": "83c0bfd68429eabeda2ca77822037d623505b74db931acd9d0525512cee69be1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333825, "uuid": "cd363ef1-a144-4713-94c0-b764026eef0d", "comment": "Malware payload (Heodo)", "value": "03e8f06f227ba672c6a5980e6f0d09525af39f2c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333825, "uuid": "bf0b7198-3ec7-4132-9b1f-42a4946030ef", "comment": "Malware payload (Heodo)", "value": "5cf545afda6aa97290a50256460f65fd07d731357958bd54344db9d57d2b027c809ca5a31c3d66a2f2eb48d5d14c39c9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333825, "uuid": "82908572-6fa4-4300-9cd8-32c55ef310a4", "value": "T15033D00F9A22B5ACC3136C3CCA8C55F9650E5592A0C9F72B08857B9C7B1B1E7179F282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333825, "uuid": "7b25c104-9d75-4e5a-8a7e-4e6004ee467f", "value": "1536:kkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:9cEe2Kd3zdtdEwo/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333825, "uuid": "f56155e0-be70-45f3-bb98-55b205c3db00", "value": 50643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333825, "uuid": "556aecdd-ce81-486b-b5b0-e26a5db17958", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333825, "uuid": "a97c50f3-0ea8-405e-a11d-fc080f9f5656", "value": "payment_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c1dc7e-a48d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647368959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368959, "uuid": "d5dd31a7-248e-453a-b5ba-9e9e40ac4dca", "comment": "Malware payload (Heodo)", "value": "d852ea69ab7655ef0ee419cbf407ba54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368959, "uuid": "52ee020b-0b7e-454e-976b-fdab11ced881", "comment": "Malware payload (Heodo)", "value": "83fe50c660989d256db7a74a198a5b301972d1ba617e538c1b437fc9890179fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368959, "uuid": "523cf116-9c94-4406-b055-4de2421c7e04", "comment": "Malware payload (Heodo)", "value": "f5a4f41c8a4eaf0d1727ed53315f026c3983bb3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368959, "uuid": "0e4ce0ad-765b-4601-8ffa-f84bd295dbdf", "comment": "Malware payload (Heodo)", "value": "b939b01f8c5ec8de7e39283ef4dccefe1fdcbf443527c2b58282cd2bb4214d0bd046d72ce1a378b869a2956ed44c2a8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368959, "uuid": "4f39ff5f-4ee2-43a2-aa98-7d56f21a762e", "value": "T118257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368959, "uuid": "0f68be9f-7320-414e-a40e-2a965d3e2aff", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368959, "uuid": "df97b707-582d-4b64-bd23-db9aa9736d7b", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYAVP6FuR6shQLj88F+Krf6:v6oycln8cACiDP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647368959, "uuid": "3121a1d9-20ab-4b2b-bca2-4b3ed6e6b667", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647368959, "uuid": "2d0ffc2c-9433-4121-9226-02a863d37db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368959, "uuid": "420ce5f6-f7f6-448b-895c-943095bab04f", "value": "d852ea69ab7655ef0ee419cbf407ba54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9812d52-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353533, "uuid": "828ff67d-71a1-4370-96ac-725d3f68efbe", "comment": "Malware payload (Formbook)", "value": "c9d8de2b8cc0fd1def78a50318319007", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353533, "uuid": "81f3f894-e947-45cc-bf1f-874860d4afc7", "comment": "Malware payload (Formbook)", "value": "84f19070b339b168c49f5b811858a2f24730aa52395fe0a1fb3427752ee38c81", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353533, "uuid": "a01458b8-fa6d-4b05-929e-4b3cf0d70e07", "comment": "Malware payload (Formbook)", "value": "140665729f481fefc3565fb80d3432c0c77b1e20", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353533, "uuid": "dac4b847-adeb-4eef-81b4-764070647405", "comment": "Malware payload (Formbook)", "value": "b289ce2ebaa7684a6ad1ebba75d398292c729a33d880333fbbcb0e459d621207c6d30c1b00a8a2d849805bb6abd8e9d2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353533, "uuid": "70824967-7c5e-455a-9aac-da5830ab321a", "value": "T129140239A9D18715E5E20F370A78684CD257EE26C66D5D1BB3923EB700F0C788C6A6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353533, "uuid": "4c3eaca0-c21b-40e5-9e97-259aff288e1e", "value": "3072:3veCNHvMysTEBkcPsYQZKtvYe1ZrPMnv9hzMiDv5pLPKHD3/L+iJhBogxOsJW424:/eCNHRsEGYxtpdMv9hzMiznLPKrDTv9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353533, "uuid": "99f23c6e-34f5-4a1e-9ad7-c423cbd303a2", "value": 190408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353533, "uuid": "dcc4ec02-9727-4352-b6a1-cea23937ff32", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353533, "uuid": "09a22710-1c7a-4f2a-87d1-853b032c00df", "value": "Payment Copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4686ca-a495-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647372360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372360, "uuid": "8634f173-c0d7-42be-bd26-2807f37239d8", "comment": "Malware payload", "value": "c6441e8d5b8fcf7fac65f4c0bb7fdf63", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372360, "uuid": "3239b5f3-cffe-4d6c-a87e-4220fa00cda4", "comment": "Malware payload", "value": "852b30bf78880e4cc9278c71575d65808041d3856f42db27bbde65ba9451fcc7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372360, "uuid": "a75587be-1e33-4e53-81e1-92c23761f7c1", "comment": "Malware payload", "value": "3f17ff5a18be8fe48b75a1e460f6019948f8d6dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372360, "uuid": "5c61e5c4-7dd6-4f63-897f-7a06f49b56b0", "comment": "Malware payload", "value": "0cd0557e00a4fd79f8e99d6edfad6db1c5199f21fa02d4397742c08ba4b954230ef327fc193f4b642522364c75e05770", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372360, "uuid": "f854b239-dfbb-4286-a068-575e5b33b546", "value": "T1BFE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372360, "uuid": "f1a501c7-74fe-4ba1-ab07-e0f5f60d2f42", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372360, "uuid": "e2a24452-6436-4702-849a-ef30317c9cdf", "value": "12288:E94YBCR2xP7guDo463OP4eXsiSOZjb2woE+MhJT:2kRAguDogPzddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647372360, "uuid": "a4758da6-bbeb-476b-ad81-93beb36a9caa", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647372360, "uuid": "d5aaf4d8-8991-4c7f-b55a-ff76824b5df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372360, "uuid": "98362af4-3586-4971-bb14-a09c5a2b1e3b", "value": "emotet_exe_e5_852b30bf78880e4cc9278c71575d65808041d3856f42db27bbde65ba9451fcc7_2022-03-15__192553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5f02a1-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "fb506701-0692-459c-8259-0488aa2f0ddb", "comment": "Malware payload (Heodo)", "value": "be3851807859853fa4b0654ea22b1e19", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "ae59d156-5190-4e3f-93d0-96589ffe4016", "comment": "Malware payload (Heodo)", "value": "85ea308278e11132c9681e841cb70386dcc72b8860712fe27430a5ed1a5c3352", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "794d2b7a-e8c3-4b48-83f1-2585d4e99794", "comment": "Malware payload (Heodo)", "value": "397160e09c9de00bdd7f60297aef6768c08135dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "afb455f3-73b5-4e7e-8b02-aec2d68e9ca0", "comment": "Malware payload (Heodo)", "value": "cf3cbd3f8f788e76902c01cd607c44530519ed41e61d489f680f12e882be32eba6e02142bb29684a6031601d3e26be8e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "152c347b-3df1-4290-935c-9b6f25aa241b", "value": "T13B256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "27c766ee-3c05-4da5-b48e-51c68a7ae49a", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "9387c607-2a0b-4e56-9628-4001234e58b1", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkewLBeUNKsuG31Pt8H:3dlV0EnIT0wgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302693, "uuid": "6d9276fc-b661-4bd2-a8e9-a36fab10a009", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302693, "uuid": "3fb6b376-f02b-4f96-98c9-3241f3bfbea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "fb444c64-48ca-4c7e-bc88-81eec37cb4e7", "value": "emotet_exe_e4_85ea308278e11132c9681e841cb70386dcc72b8860712fe27430a5ed1a5c3352_2022-03-15__000446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7b4743-a464-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647351126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351126, "uuid": "022ad8e8-a70d-4d3f-89a1-eed375f32b49", "comment": "Malware payload (AgentTesla)", "value": "88659786988b6f25c7c8167baa5c6e73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351126, "uuid": "37ad6a9a-ef27-4dc7-9330-7ed5d6b75adb", "comment": "Malware payload (AgentTesla)", "value": "85f5f77c1446f266dbac22d6ff0a1dc6cdf2c9496abfaa2638de7c196e596ef1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351126, "uuid": "20bcb6c9-3948-43f9-96fe-1be574fc71e0", "comment": "Malware payload (AgentTesla)", "value": "d2c2d662ef88166025be3c2b3218a76661116301", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351126, "uuid": "fc980a3c-9e66-45da-917b-36b3293cdb2e", "comment": "Malware payload (AgentTesla)", "value": "9a4fbd3ba7f0c73edf446de60c0cb1fccb7ec2db7b11ad540087ebe51b1cb927cb0313e1a027f0cad934a79bff038884", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351126, "uuid": "34013c47-4f98-45ae-b70f-125cd1786e5d", "value": "T19313E6567892A61DC5D47BF869B0519366367CE10124C18FECF97F2AAD33223DCC226D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351126, "uuid": "09120b2a-fe24-4cc7-b145-6f14aed3b0e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351126, "uuid": "cef35776-21ac-4fa4-b57f-c774f040e148", "value": "384:DPhNvxQ4UsQQ6ulaiJMwCKTH2S3dd0hUADka72a:lNsml7MwCKt3deVD1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647351126, "uuid": "40f41bbf-6e1f-44e1-9a2d-cbb9251df6b5", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647351126, "uuid": "6a0fea7a-a76e-4727-9a5d-9505b4045ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351126, "uuid": "8c0e19e8-ccb3-46e2-9602-93f8dafc7e2f", "value": "7890321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1293738-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "df6b5cb4-86c8-42f3-b759-e5994a2ef1b1", "comment": "Malware payload (Heodo)", "value": "712237c1934efec93572fd5409302e96", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "7017fc35-091d-463b-a40f-c92d7ca091f3", "comment": "Malware payload (Heodo)", "value": "860257955eba0f5e7d75369ac5d33f9d0df1c7d55a77f7fb4ffd14930b9ea74f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "0beae30d-d03d-4850-a651-43529d3476b6", "comment": "Malware payload (Heodo)", "value": "5befa04724273eaf999604671ce1eb55baf230f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "7aac4e9d-73a5-4c93-8b47-b7a212d57788", "comment": "Malware payload (Heodo)", "value": "1ec4d9e349b4aeac81e46921b18639fba7c5716c07d0606d74163eae49b176980d32d47150d06b6c6f7bd39d3a558750", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "1912a4ee-12bd-4a9c-9d87-927950cb5453", "value": "T19E256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "4b6301dd-4d71-48c9-8131-988726204b03", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "b08f8535-df3d-45ca-b3ff-a7db93e2409b", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1tWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6DWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302839, "uuid": "e5adb7eb-52f7-4b32-bcec-c05bcb9ba347", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302839, "uuid": "27448a27-b7b1-4bc7-97c0-11cfce832380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "e4b2c027-3eb2-4253-9fd8-8b98888b39be", "value": "emotet_exe_e5_860257955eba0f5e7d75369ac5d33f9d0df1c7d55a77f7fb4ffd14930b9ea74f_2022-03-15__000707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0e3de2-a43e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647334913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334913, "uuid": "06edff4f-d096-4b99-a2c0-42978c0a15ba", "comment": "Malware payload (Heodo)", "value": "3f47e8b610fb92134c45f99bce574f5f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334913, "uuid": "85c72aed-6381-4892-833b-b3b6ea27a554", "comment": "Malware payload (Heodo)", "value": "860d2d287e3b03b43882abeedb15f25ae24f93700ef887e76557c6bde790914b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334913, "uuid": "22e346ac-39cf-4383-a2b8-e5f53a36ddd1", "comment": "Malware payload (Heodo)", "value": "cc05a3ba6674caf0c26c9e3ffda9c96a425962f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334913, "uuid": "04d571f1-ab6d-47d2-b886-0fd73c7b1570", "comment": "Malware payload (Heodo)", "value": "dca4665fc6fbb0c8b18e14e9c204b2c1bc3f049e23c6cc50e5b6cf185e404a39dca7e5ef29c26a1d8ab8a8d98612e343", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334913, "uuid": "3a4e0e8e-2c4a-4696-a0a4-8a015a51d38c", "value": "T1BB257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334913, "uuid": "07c1f463-a4b6-48a7-8f87-f34c6835bf1b", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334913, "uuid": "db29bad5-2a4c-40f4-bfff-3403db086ade", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKleOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8ul65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647334913, "uuid": "5fc5f86e-96ab-4bf7-8404-ff3e6175bd5c", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647334913, "uuid": "c1dbd384-dabc-4f85-aedf-49cb33c2157d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334913, "uuid": "f2267cb8-d93c-4d8c-a497-f1f2935a93c3", "value": "T3KrGT.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638c77b5-a3f8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647304775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304775, "uuid": "a7fce346-5c2c-4cd4-9a4a-bd47957f20ca", "comment": "Malware payload", "value": "3ae6503e836b295955a828a76ce2efa7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304775, "uuid": "0ae7dea9-da4a-4bb6-96af-318e521edcd9", "comment": "Malware payload", "value": "8672acfb06258f5b6dec3700cd7f91a0c013a70a9664dbc6cf33a4c6406756ed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304775, "uuid": "d0801fa8-d844-476c-bba2-496f80272d19", "comment": "Malware payload", "value": "d08315c8c93aca7816875c11583b1147878ab8ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647304775, "uuid": "3df91c94-e5be-473e-8955-e978a5c1c1ef", "comment": "Malware payload", "value": "f4b495fd2eee5c38c33e6e57f75b33a43b75a19eb2a8c5a7d0e66038592ffcc457bb2d88c0889dfb2882491cd6bdcfe3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647304775, "uuid": "4d323222-55b9-4dc6-bfcf-401c3515c865", "value": "T19853F16547058821E1B2423B43608FF824EEFF678A7FE2145DA53EDEB470B496A0943E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647304775, "uuid": "ff7d32a7-ce16-462d-8307-1f7d93a8ae2c", "value": "1536:zmXZjlQTMI50WQ6PkPmFzLt2DNq9nP2PEKgbA5ABwU+cs:6TQgI5H1Qut2DNMs5AB1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647304775, "uuid": "bb9bc489-f2e4-4c45-a8a3-8e3afa1f6302", "value": 63733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647304775, "uuid": "8a547c01-c760-484b-b197-5d3632bba0f0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647304775, "uuid": "2636601d-d149-496d-a466-746369194179", "value": "Guide.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3418a7-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353293, "uuid": "ddc50291-3afd-4ce0-a286-8e8d908e957c", "comment": "Malware payload (Heodo)", "value": "e35e0e81aeeccb6089dc529c48f89ec1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353293, "uuid": "6b0881b0-4d01-49a2-b8ba-bc06b1cfe05d", "comment": "Malware payload (Heodo)", "value": "87487314d98be4c6097c85494fc5ab0fb83b63a2a90edf51919070759ec03755", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353293, "uuid": "8d2a9a50-2f8d-4d62-a33e-1e34931d20b9", "comment": "Malware payload (Heodo)", "value": "7541f3a52eeb5ea37b168c5720dde22a75c8ed8a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353293, "uuid": "c1d7d7a1-6dee-4dbd-a327-c07d21fbcad4", "comment": "Malware payload (Heodo)", "value": "a08473144a402dcf4306ac2ce704a51c08bb5c007586f7e55ae0cc295dde1eaa40241bc3a96fb67beef6d15a8601ec61", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353293, "uuid": "eac9665c-4bae-47e8-b267-a01614fcebac", "value": "T18233D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353293, "uuid": "368a96b5-0ea7-421f-8bbc-c01bde37ae8b", "value": "1536:oAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:RcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353293, "uuid": "89d0898f-ee70-4088-abe3-ab326a0549f1", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353293, "uuid": "e70745a8-3d10-4901-b1e7-c73ef69c758f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353293, "uuid": "71a227ee-9181-4383-a137-c91359316d60", "value": "Omics Journal.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d581f4d-a466-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352063, "uuid": "d559d4d6-4536-4e23-a5d1-0ccf533df0d0", "comment": "Malware payload", "value": "8061528a98049e8a448337941c780e8b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352063, "uuid": "29c9a7cd-126d-402c-b845-0b561eeb56a6", "comment": "Malware payload", "value": "875f1d08d1150d36f95b862b326e35d72765ba4fc3c62f0e7c96b41467fc2a67", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352063, "uuid": "047a3c0b-07af-4673-b44f-df29ecfed116", "comment": "Malware payload", "value": "201872adf54e953fed22f435e2cebdc9c8a0bc06", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352063, "uuid": "6c3d2b75-5e11-4a74-b084-08c9c47fe6b7", "comment": "Malware payload", "value": "6e9f1c0b06d466cf7b58b911ab27fed82b7babd2f102801c64732406b848155c2e1aa56fa5e7251a8b4451ca1daad08a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352063, "uuid": "e5c2bd1e-4bb8-4076-9005-4fe999778812", "value": "T146F423AFA70358C8F366137A5829AD54F0F70542C9DBCF8975F3622C1AE129EDB2518C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352063, "uuid": "6aff476c-3488-45ef-994b-ba74f249f6e1", "value": "24576:j5HHiRoSGm+CKZvXkfWLzRLPobmds0PobmdJ+eJ:1HHiRpGm5QfQQzRcCdECdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352063, "uuid": "a29f1b5e-30ab-4d4d-82f3-7a24fad4c408", "value": 787155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352063, "uuid": "32c48842-87c1-4879-aec6-43976b5cc2fc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352063, "uuid": "16cad13c-ec99-422f-8a3f-642d4044e34e", "value": "facon_defense_ukrainienne_ru_2022.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae09213-a450-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647342530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342530, "uuid": "87c5e969-9357-41cc-a1c0-78a72e03f5ab", "comment": "Malware payload (Heodo)", "value": "9bd6b7f399c9f0a8548f60e63a834176", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342530, "uuid": "c8446014-9669-459c-9d3d-98f4e3f2deec", "comment": "Malware payload (Heodo)", "value": "89c68c89661c0bdf68ea436d6f1b8b3cb604adae72239b7b82bfd3e92866f2bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342530, "uuid": "de9072a6-2980-4e8e-8cd7-45981db9d0de", "comment": "Malware payload (Heodo)", "value": "a6fdd10c035e7cacdf0b80a15b7061771d84b656", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342530, "uuid": "ef79542b-17eb-492e-be31-351c08308dfc", "comment": "Malware payload (Heodo)", "value": "067e8cae376904fe586ed724741ab75325075a680ac247672e03b300517361a9859841fbcdd845853c70345f4ab438fe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342530, "uuid": "1e7d7dd7-d765-4411-870d-49401784184b", "value": "T152257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342530, "uuid": "040d383f-09de-4e58-aac2-e657e8154a22", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342530, "uuid": "49332e6d-ec51-4336-8013-77fa974de959", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKl3OlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8zl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342530, "uuid": "f542ef01-e5ad-400f-8dca-c10c9ecb757f", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342530, "uuid": "11b5ae87-bf78-47dd-b8ec-a97fe8a04695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342530, "uuid": "073a8148-4183-46aa-bb7d-daee258bafce", "value": "QKfZIIRiuotf6yEFg2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d84defd-a467-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647352332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352332, "uuid": "5e8994ff-4b25-47bc-82f8-0b1af9e97a7e", "comment": "Malware payload (SnakeKeylogger)", "value": "6724ce682f35a9006530ea5c67a64af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352332, "uuid": "181dfd8a-1dd8-4175-8ce4-3df66b7dc495", "comment": "Malware payload (SnakeKeylogger)", "value": "8a4bcfea7faecc6f2bcafd7b6377fff78864e02cb85e048a9172adc881c47010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352332, "uuid": "d309b608-8156-4ccb-ad74-97c3294b0822", "comment": "Malware payload (SnakeKeylogger)", "value": "10de75a200e3071e357a229505cafb5fc6a400f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352332, "uuid": "09efe971-015e-476d-815d-833656a41944", "comment": "Malware payload (SnakeKeylogger)", "value": "4145bc09884b5ed096d1090b8d8e236b6edfb102e79795c4f111f67e518676807a75bf106b724d7c3e4adae3e503133e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352332, "uuid": "11581297-0a5d-4f39-9364-5c76ad7e0477", "value": "T1A6833A867BCC5316D918593A9AF74D100B37BF767E06F60EA984B61E0FB33D06A02B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352332, "uuid": "eed4d0e3-ba66-455d-b56a-2b32d1d0e170", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352332, "uuid": "b85e7d1b-c427-4f6b-82ef-0958c7c0f582", "value": "1536:Yuog6SCIViH5SEmtkNhx9ER1tDMeF7Ci71T:YACIVOckfx9ERjF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352332, "uuid": "c7b7302a-272d-427e-9f06-81b7894cdeec", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352332, "uuid": "b4c84306-bc14-413c-be95-1bc1202a80c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352332, "uuid": "d9cde90f-e605-4981-83d0-32990c4cb01e", "value": "Swift Bilgilendirmeni.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfab7dc-a42a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326130, "uuid": "9ea62b18-4e8f-483a-907f-612b4444c8f3", "comment": "Malware payload (Mirai)", "value": "9c399efbdecc06984a33c3ee557ac74b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326130, "uuid": "52264d0b-354c-46a3-bba8-ca82b2fcc24e", "comment": "Malware payload (Mirai)", "value": "8a510bb0ccdac2fec5f13fae389b6900624329303d8ec85190ebf594b60d94e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326130, "uuid": "46a2fcc1-17c6-4a9a-bb16-244649e50eec", "comment": "Malware payload (Mirai)", "value": "076d01402e70eecbfbeb4e29de85f5aeab7d4af2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326130, "uuid": "7e609fab-2fa9-4f34-b211-ecfdbb189139", "comment": "Malware payload (Mirai)", "value": "94e8546acbc4a79bfedcec777a390172535ea3e127741ee3d80488aeb45befdac15c4fa054c1dca48ecaee2880b828e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326130, "uuid": "c0514cbb-c298-4aab-b39f-d5c2bb6b47ae", "value": "T161833A81F9C780F5C917493850F7F37FCB32E57940709A6DEF99AE32DA27A01521225A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326130, "uuid": "9363f2f4-2778-4aad-8a3b-b2d6aa976aca", "value": "1536:khJifCOkUOMzuPrMIhy96iF80DOy7YIfmYP+VMFh2kWOa3sJsZBY6lbZ:khJi4UOMzKXhy9ZYe5LP+VMFwJ3sJsXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326130, "uuid": "e303bf42-70dd-4307-82aa-0c91e46d5f29", "value": 82832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326130, "uuid": "c0a19031-a5c7-40c0-b6a9-614052bb5c10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326130, "uuid": "41ef6d0b-5562-45c2-bf14-03f4a8dfe150", "value": "9c399efbdecc06984a33c3ee557ac74b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88c351f-a46f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647356001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356001, "uuid": "472977ac-7657-4dab-a31e-342db6078ae4", "comment": "Malware payload (AgentTesla)", "value": "79fd0bc0addc8bbf3777cd09f1b9fd28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356001, "uuid": "af95a74b-9adb-4431-b593-7e3783579e92", "comment": "Malware payload (AgentTesla)", "value": "8adaf28ed843026453bae72e1334c5de7b66f0af5c34f46a1ca771b133b9c844", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356001, "uuid": "415c7281-7f41-4857-8be9-9d100190176f", "comment": "Malware payload (AgentTesla)", "value": "e5bf5bf028be64d2d3c724ce537e118f4d1905ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356001, "uuid": "85658c38-17d5-42e3-9c52-7ccfcb6472a2", "comment": "Malware payload (AgentTesla)", "value": "cef470ca88b86f224d74f7c0977689ef3e8f89edb4dd00235509b27856c6cc9e48d44bc389b723f855e1b69b5c66ab0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356001, "uuid": "5fafd4ad-8a5c-4406-80d0-e56089aef97b", "value": "T14915199CB11071DEC81BC631CA74CC34EE517E7A932F511E50A739AAAA7D9838E15CB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356001, "uuid": "ac2aff87-bcf3-48e8-847f-549f40a126bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356001, "uuid": "2d913733-1007-453c-aba8-76ae51c6844b", "value": "12288:QQ6UEvY0Y2DtqT1A/3p4w3zfCVVggwk4unSjiI/p0W/Iayc83l1uwETP5NCdrRUP:Gb901A/Z53zOggAuSOIKUQPjUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647356001, "uuid": "483ffab8-6880-4927-b2fb-abe06ed86a8f", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647356001, "uuid": "49291f32-c8df-444c-afc9-8aa0d599ef64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356001, "uuid": "e453396d-ffa5-4894-aea5-192da994f6b6", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedd0797-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647354401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354401, "uuid": "a358ed1c-4932-4d30-90fc-14b9be812503", "comment": "Malware payload (Smoke Loader)", "value": "0f0841f0c1fa4e6f67f5e1ab18de0943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354401, "uuid": "88f7f33b-03f3-4b0e-9a23-61769c466b2a", "comment": "Malware payload (Smoke Loader)", "value": "8b9d5dccf5768c3dc966965bc1c95064ab8b4322921fe3fe8a2286b68928ca88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354401, "uuid": "32ea4ebb-b537-4127-9e98-4a12592ee4a5", "comment": "Malware payload (Smoke Loader)", "value": "08cbbc58a465229659b78c71ebf6736b0f3fd3c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354401, "uuid": "993f3d13-f413-4971-b204-92ab49f1cae0", "comment": "Malware payload (Smoke Loader)", "value": "6de28beab327187e97add5ad9c4dfa0430505b304d5b087178f29b70ae8ad016788381688c207c0ef366015593994739", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354401, "uuid": "1d20965a-b72a-49b2-b94c-45bee0a55379", "value": "T197F47D22F1A28837D1332A3D9D6B5265982BBE013D38698A3BF51E4C0F3965179353F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354401, "uuid": "1635c19a-fe47-4cd4-bb5a-f55a854f8c66", "value": "fe8fe697a2113c9983ebb64a3ad85165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354401, "uuid": "619dc505-a7bd-4f0a-9b73-7d668f44d60d", "value": "12288:2S1PtiVzhCYsLMsmHZDkEIsyHzf80+uAZmi1mfxvv2PQKVUnTLvO+S63:h1i3CMsmHZDq5joZmIm5GPQKmnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354401, "uuid": "1b84d9ef-9f5a-42ca-934b-934c86c75b8a", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354401, "uuid": "0888a8b0-8ac4-4c9f-b025-124a10ce30b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354401, "uuid": "4850f9e4-1087-4ff3-8e32-1f81fac3da3d", "value": "0f0841f0c1fa4e6f67f5e1ab18de0943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3cb6c1-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647363285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363285, "uuid": "9937e3b9-8e2a-4a89-8a5c-d51708e826ae", "comment": "Malware payload (Heodo)", "value": "59845edc09e359d3a4598568cbe21744", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363285, "uuid": "edbc7c6a-c922-42a9-9fb9-f5a1d4ae1ccb", "comment": "Malware payload (Heodo)", "value": "8bbacc9b2081c881e0f5ae0fbc604449fc2b25fed5b21c1843c94cf2058fd37a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363285, "uuid": "20d2e55a-1a31-4171-a9ce-a410772d749a", "comment": "Malware payload (Heodo)", "value": "58c3136309872a68ca0f8f6c2097f411e22fb3e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363285, "uuid": "c6d1b640-1ea7-4ced-894d-9e0fb9a3a236", "comment": "Malware payload (Heodo)", "value": "372f6712414eba6fd59e4bcecd7df9b1919e11d64a129a53b55dc7f85e1cfcdcc1a4ffcd655a653947d58a4f5d970323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363285, "uuid": "f98b6258-5e8d-416e-81dd-da393c3ed895", "value": "T166257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363285, "uuid": "dbc48258-d8aa-476f-ab11-6195db110b05", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363285, "uuid": "37060973-142d-4d56-9ab2-8125374123f4", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlMOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8El65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363285, "uuid": "1424b568-72f1-4248-b2db-e48cf2fc6170", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363285, "uuid": "4d229ad2-ff4c-4573-9e2a-e9f28ec5038c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363285, "uuid": "baed07a8-ae89-446e-8ac7-a5ab08b07e87", "value": "59845edc09e359d3a4598568cbe21744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04174bc1-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333821, "uuid": "d0818b9f-5ff4-4124-8abf-07f889ea4300", "comment": "Malware payload (Heodo)", "value": "da407ec6d230f35e4ec3130e08d8f7a1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333821, "uuid": "832ced18-f1bd-4fbe-ab2b-8b11f038b63a", "comment": "Malware payload (Heodo)", "value": "8be4d4c2d99ea45ac17e4046066a7c20a1b1dd7ab40524535d298e0fdd52f36f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333821, "uuid": "bd3db103-9dfd-4fb1-8d37-658e33671a53", "comment": "Malware payload (Heodo)", "value": "7ab5c934787996020405c0eb6dd99fdfc45200f2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333821, "uuid": "439a03e5-0c4a-4348-a13f-babaf5c6fc2c", "comment": "Malware payload (Heodo)", "value": "29fcc4b4a46feb8a8e9639b32b6c854e856beabf385d47ef947687caaf6f7f77a7297b18341cb45420149ae981851769", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333821, "uuid": "d141d4e0-f60a-443f-8aa5-c80da46012d9", "value": "T11373E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333821, "uuid": "8b875699-c113-4323-9c96-d87793be2544", "value": "1536:WuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:wtzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333821, "uuid": "fdb91024-dd8c-4dc9-a518-18cfd355e721", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333821, "uuid": "2b696bd3-45e9-4f98-b309-e5b2e046bacd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333821, "uuid": "b652a965-df0d-4f92-8739-4a0b2312c2cd", "value": "OMICS.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb90582b-a4a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647380192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380192, "uuid": "4edf5040-573a-4a60-8a48-f102d2668c63", "comment": "Malware payload", "value": "32ce28d81b8306538a23bfc22ac9f364", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380192, "uuid": "57c27f32-fcbc-4e94-8272-8d57ab64f74d", "comment": "Malware payload", "value": "8c21d7c5ec206cdac6ccab14a31cfc457837322e38ea2072bea0e5264f55290f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380192, "uuid": "95350949-362c-42b2-a695-d609c763ad3c", "comment": "Malware payload", "value": "41e46544e7633d67d550b967771b42d7acde9c1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380192, "uuid": "163172fb-c5f0-4d90-8a24-eeb878470906", "comment": "Malware payload", "value": "e21e71b969352d27436e26739a278ddfe662dffbb5f8b5ba4cc61b4f02a41a346c0e55a2ce3b4f40cea949cc6303dc02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380192, "uuid": "ac386685-94ac-44bc-8379-b8efba5d82b3", "value": "T101E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380192, "uuid": "8e42ea22-8f68-4c66-99ce-9a2729382d07", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380192, "uuid": "4dd3af55-c988-4810-bb02-b6bd91373b7c", "value": "12288:E94YBCR2xP7guDo463OP4e/siSOZjb2woE+MhJT:2kRAguDogPbddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647380192, "uuid": "90803131-a9e2-4e40-8292-193ffd3349db", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647380192, "uuid": "b69e796a-07ab-4eea-80dc-98e4f77c1435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380192, "uuid": "700382e3-5e53-4c74-b48b-5e6f0a9a6231", "value": "32ce28d81b8306538a23bfc22ac9f364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85db8773-a494-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647371834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371834, "uuid": "5b6996df-d4a7-4550-a161-e0e5eae4beef", "comment": "Malware payload", "value": "05c537c176169677d9551ae8fdd2fab5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371834, "uuid": "ba48bdfa-cc7f-441e-b209-87a48983efc2", "comment": "Malware payload", "value": "8c3c21d0efdafd677d7299ae33e7baa85178e2887095d647b4e549bbc31a2126", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371834, "uuid": "0ab0ca5c-b3b4-407f-9559-5b03b1ca48ea", "comment": "Malware payload", "value": "99b4901572d98db8613c05b12db8a0cec7ab9731", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371834, "uuid": "2a9b4b53-047f-430c-a57e-2f3365e1db91", "comment": "Malware payload", "value": "c705d8d702e1ebad34a014678326108d8906814951788ed95f99f4eb1cbb8e9d419ec348bdf7d5c56af10cbc5047626b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371834, "uuid": "6390d046-7f86-4f83-9e3e-0a6b91892025", "value": "T184E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371834, "uuid": "8bb3640d-0194-4fd2-bcb2-c9c643c5afe6", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371834, "uuid": "94363b5a-542e-4178-82c9-af8b0372d4ac", "value": "12288:KFxGsTPy4BHT4Sj1zfJf7ABqDLkWynCsZ:obPy44Y19f7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647371834, "uuid": "eacb4f16-bb05-4fae-b5d7-38cb9f8ead55", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647371834, "uuid": "0a09e353-5521-4a8a-9c34-f47e9121e61c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371834, "uuid": "ab23af9e-d452-4f0a-a37b-e33b4961632c", "value": "05c537c176169677d9551ae8fdd2fab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cc40a6-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349237, "uuid": "cdf16ec4-e98e-4f0d-a481-1e97cdd40635", "comment": "Malware payload (Heodo)", "value": "f7841607ba664f3f2edaff172cad5c64", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349237, "uuid": "2db099f0-513b-482d-a529-1dc8fbee4fd9", "comment": "Malware payload (Heodo)", "value": "8c9aaa34e7fa77ac74a6af01d35aee8e607098af733f351e7b0183c8f8607c77", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349237, "uuid": "19fd695d-febf-4e90-aecf-583e3a2406b4", "comment": "Malware payload (Heodo)", "value": "dd1a9efac23d060f866984695ac2f1d53dc0a4a0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349237, "uuid": "bedf5b6c-27dd-480d-945b-43a7a7dac269", "comment": "Malware payload (Heodo)", "value": "7e9b319b0c2cb0836e920774dc2404272197fea36d0fef8fe93d2d711591c3ede3f9eef33c117db3dfe13de610d7651c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349237, "uuid": "c2b1d843-aa15-493b-95ac-f7ccaff9d751", "value": "T12033D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349237, "uuid": "ea13fbdc-bcfd-4d71-bf97-e8b16e3cb9ef", "value": "1536:oAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:RcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349237, "uuid": "619fdd0e-d982-42b6-ad3f-494802db8553", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349237, "uuid": "7e008f78-4498-4235-b90e-81c342b065aa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349237, "uuid": "bbc576b1-5f3b-4016-a981-26839b6616dd", "value": "2022GJ000027337.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b2daa0-a456-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647345360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345360, "uuid": "10f4a70a-d726-418a-aec7-99bc8726ee3f", "comment": "Malware payload (Formbook)", "value": "b52385c57e9435c61f5839c1255d5a1c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345360, "uuid": "21cd9be4-2220-4835-b2a2-ec2955e4299a", "comment": "Malware payload (Formbook)", "value": "8cc01b61c186ff7f761b6a27ce318e34d963a88d9e156d4f8906172cba0a3140", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345360, "uuid": "1004db1b-c175-458c-8064-6375ba337ed5", "comment": "Malware payload (Formbook)", "value": "411c5bc2de4195f0203e56d159fab107967df12c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345360, "uuid": "8189f5d9-7aa4-485b-a63f-3c5724ec6ba9", "comment": "Malware payload (Formbook)", "value": "c6ce975823d8c373e2d2befa840a86582ee49b4016e31ce8c4a2a604b2b3c66b82afca4e5fa7fb75ee357b54e289897e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345360, "uuid": "86644c27-99a5-4d60-9216-ac0037463384", "value": "T15125AFE96EB555F2F26F16BD08A79A78C291EF51D671611E3C2C825087FFA00C0FB606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345360, "uuid": "5c5abb26-bd97-4210-aa53-235b3365ab6a", "value": "24576:xK+zGJm7It0lB/ni3jEE6zpeZp0nxpxkih:Y+KJm7y03/Ae4ynx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345360, "uuid": "ff075f63-4604-4c6c-ba61-fe1dd6dd86a5", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345360, "uuid": "12177872-9abf-4d89-ac73-998e3177b1ef", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345360, "uuid": "43056c45-c1aa-41e1-829b-de5ac0852cbd", "value": "TekT_0136205,pdf.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0730273f-a480-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647363032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363032, "uuid": "f91f81ad-80b1-4fe1-a1e4-9b7f5d56c58d", "comment": "Malware payload", "value": "e9133a533614dafee5780d50b29484c3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363032, "uuid": "f32ef4d6-9557-47af-b961-d5fb78e00f8f", "comment": "Malware payload", "value": "8cd27abdeaf021e73b1c3428c4b378286875061a7429de3e9c7560882e0bf290", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363032, "uuid": "9650f822-f647-4b52-839b-9e224f50674c", "comment": "Malware payload", "value": "a73e8cb46ebb365ae876bd03b2e529cd514ddd48", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363032, "uuid": "30a03df2-17a3-4160-b397-567d405e465d", "comment": "Malware payload", "value": "54028037d5de0da10bf2b1bbe29c2e98c664557a3f670be3f0a264089f8653859e6a4f1b03c8fb969656e2d0a8ffbf74", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363032, "uuid": "4734c4c6-2332-4754-b4b0-69dcc44c9517", "value": "T184D6F0AAE798D85AC4F64331C87A42A2F0574E1707439EA77A7CB2781F735C10E85ACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363032, "uuid": "7805a53b-b999-40f8-b046-7ad0533b686e", "value": "196608:PqPxY6TQxsOsorOJqdDYeIwlAAFskZXvYWgwJVoahs8BFglA5KH6Ivi:P6x3QCtomHwq0xQWHpng+EaCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363032, "uuid": "09e8b159-0336-41c6-886b-0d29a3e41a42", "value": 12726177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363032, "uuid": "a4574f19-1d5d-45ba-90ed-12d3faea6691", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363032, "uuid": "543a1998-aadf-4a55-a064-d471873cb651", "value": "Pdf Reader Scan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae188e5-a45e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647348570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348570, "uuid": "858cf374-3979-4f69-8668-80cc3ed211e3", "comment": "Malware payload (Formbook)", "value": "394cde03d33896c3b9fff7cbdbee31bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348570, "uuid": "5bca1d47-d3a9-4421-a382-48a516bbbf96", "comment": "Malware payload (Formbook)", "value": "8d4069f952ab15494c3be7c5cdf0fa161641dcc5fe3a1aab978726ea585f0076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348570, "uuid": "941977c1-0852-4993-97cb-320c7bc6b24d", "comment": "Malware payload (Formbook)", "value": "d4ffa84e9da0a9aa1d13fa3e2b7746e8c3a7d5bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348570, "uuid": "b8a2f1ea-0290-4e40-8565-5ebdfdb37770", "comment": "Malware payload (Formbook)", "value": "cfa964ab009e6d9ce6233e63baf4dfa6330bb7f4b273a23b10a7603febca8285429ebb05d95f698bab9028d9f56d591b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348570, "uuid": "aaf6e7b1-2219-4de7-967c-c4686cd6e4c4", "value": "T1E1050256B3A89F82F0BADBF69531160443B6F12A151DF3485DC630CB29E7F8043A9B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348570, "uuid": "8cc35ab3-6479-4a07-80e4-3833f5522639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348570, "uuid": "822c92a6-7a99-4d76-a984-0c14c965e917", "value": "24576:/miwO8uaSGKlvU3x6g4++8Pg1RNv1fNTv:/PfpFpsMv1f5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647348570, "uuid": "7f603beb-0b5a-427e-953c-24b9ccbd1ece", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647348570, "uuid": "0eb89a09-7ff6-4c17-868a-fa224e6d6308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348570, "uuid": "2a8f5e29-d623-4555-81b3-dac82fb69fb4", "value": "PLFzAzux0IVF142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5814e133-a431-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647329237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329237, "uuid": "29b93f13-3cfe-4681-a786-0eeed999fc1f", "comment": "Malware payload", "value": "6592bb2800857663efe5d1326f1b90ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329237, "uuid": "03183cde-8e7b-4023-a2e7-d1f57f96fe40", "comment": "Malware payload", "value": "8d88a09f19309134bcab258aa8d8403a43dceeeaa4aaa5ad7caabe9c3ca44508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329237, "uuid": "8926c2e1-ba3d-4688-ac2a-a3f0c81a81de", "comment": "Malware payload", "value": "8ee21f8df841b113445d16e0e61676327f0af6e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329237, "uuid": "854188ed-606a-4cc2-ac53-40bac0de1806", "comment": "Malware payload", "value": "6e8529662928e0073aedbb41a405ac782f2e373c9c9789c52a1faea711c039af18ceadd92df29d789718dc1b2a68c43f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329237, "uuid": "4eef7dcd-b9ec-403e-b7b2-43b70b7c4080", "value": "T137F32486EA804184DC3D6B74243E8D25561BBEFAE8B8E54D2F8E723577F31E3143254A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329237, "uuid": "0051a4d3-294f-4081-be6b-4247a44f5b9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329237, "uuid": "82a16f14-5caa-45fb-974c-58fdeae3c65b", "value": "1536:XADB4kXHMMExvklgolWmlm9z4sB6t1IKMl26vlSndlgnKNUl5mG0wRBRrFPmM+qB:sXaxr0nujh53Qewa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329237, "uuid": "15eeb708-779b-4a17-893c-a0554a886935", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329237, "uuid": "43105aba-3c41-441e-af92-bd4c911628b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329237, "uuid": "f548c476-0af5-4e5a-8b75-e55595952566", "value": "Purchase Order Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7663de-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647333812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333812, "uuid": "a5503ebc-aea5-49ce-83f7-d7228978ff16", "comment": "Malware payload (Formbook)", "value": "a6a337c21917d2d2331a8ea9991322fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333812, "uuid": "41d22ca4-7c36-4968-b0b7-f66612395e74", "comment": "Malware payload (Formbook)", "value": "8db76bfdd2666649dc2be8ef188d9548971f1edbe4d45c0d689a4700f7ff8169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333812, "uuid": "5a207289-e9e0-467e-91f3-52adea6e45cd", "comment": "Malware payload (Formbook)", "value": "2e5ec60b7499b4af71df8f0d15101b90b3a36ddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333812, "uuid": "4a269910-7c26-4cde-8cde-d134932833da", "comment": "Malware payload (Formbook)", "value": "345affbefa1531f1f501294b266a29b9517a93fd1cedbd150edfa053e19b935bc4f69e9bb4204597514e2dfb81781386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333812, "uuid": "33bb6120-03cc-4fec-a896-56d751beb242", "value": "T1F7E49022F3D1C437C1335A748D0F56A8682DFE21AD1868867BEDAD4C7F76391782A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333812, "uuid": "a669ddc7-4940-44ca-bb7a-01f8c91d4442", "value": "f411b7c64ae0f16bd14a751e9077781d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333812, "uuid": "64444ecb-25b9-461b-9696-3d84e4d50d9d", "value": "12288:/5VHItCEqofo3cOS0aYcdexwGN94Y9/rIPR4KeBIQCN1+ZAzl/JRIlRfkK:zopqofo3cOSpYcdexwGN39TIPR4KeBy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333812, "uuid": "88d383e6-c7f8-423c-86e1-7c2429eba29a", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333812, "uuid": "ddaf2447-fd09-461d-9a7a-9dde593482f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333812, "uuid": "0080119d-d285-4867-8c6b-c8e2ac50831b", "value": "New_PO_#YIBHC3892900114-03-2022_Evaluated Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe5c29a-a469-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647353302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353302, "uuid": "a7ef9063-8229-47b9-889b-2515075369b3", "comment": "Malware payload", "value": "1fb44e47e124b1a0b30dad000047985f", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353302, "uuid": "a4efe1ec-75f6-479c-a252-5417a160d280", "comment": "Malware payload", "value": "8dd7dc473bd0d0d669bb865096565530fa2ea927ec04b8e8db3fa9294f9a55d9", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353302, "uuid": "80fcc55b-fd12-49d1-92d9-12856e7945ed", "comment": "Malware payload", "value": "956fa807b39de477ca8fbddd0c61396b4b713b27", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353302, "uuid": "e3aee2cf-48db-414b-bde6-21fb58d966f6", "comment": "Malware payload", "value": "cb1ba2819f3e47829647021bb5e127f6d70a1a0965603c3c0927d406207683e6f8e46823405d3170a8ae027d2ca7db1c", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353302, "uuid": "88aff253-5198-472a-b2df-949dbc22be04", "value": "T1BF01B1B12479C2648EB0C337F52B69D3D330C1A650F2D3EC644E814EA1E5188CF607E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353302, "uuid": "7f39ce48-f52a-4d7d-983c-f40ef0eceb33", "value": "12:x3voQByxH5QwMO76JohgesFskSX7KtnGyhnGQnG2nGmSRrF7BA4qkz6gt3I:x3QUyt5QwMI6ChgeKFk7KwnBL9hBF63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353302, "uuid": "9f759ce0-94dd-406f-b8ce-955eb7ec60ca", "value": 780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353302, "uuid": "cf0781e0-627d-490c-9af3-0f6d6ba0d3e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353302, "uuid": "1bdd5093-8af6-45a7-bf2c-ddca2eb558df", "value": "cgnEU8wU.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1e458f-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (N-W0rm)", "timestamp": 1647354749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354749, "uuid": "37b038da-3ec0-4dd2-81d7-b468110e99ee", "comment": "Malware payload (N-W0rm)", "value": "932a854f4253148f36d54b60e46e31cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354749, "uuid": "cb841f5c-f1a7-435d-955f-fbeb947a8dff", "comment": "Malware payload (N-W0rm)", "value": "8e374814e8a39220a6d448f44d4c21f6a6a7fe8ef26f0890a834adbe5589d92d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354749, "uuid": "aa21bfd9-9cd5-433b-8102-e5e28f2a4974", "comment": "Malware payload (N-W0rm)", "value": "a6506ecd5f46682b25fa37a050de12f217611629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354749, "uuid": "0f523cff-d587-4dbd-a6e4-64c85687b9b2", "comment": "Malware payload (N-W0rm)", "value": "8384056b3f6dd65ec05e6ceba9aaf91aeb459b40fde9b2d72490d23260ed4ac7b690604a6d3a1890fd55388e7daab35e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354749, "uuid": "a9ec93a7-03a1-4880-97b0-11f95b3a6e9a", "value": "T19994BF10BA90D035F5F716F859B99369B93E7EA19B3064CF23D426EA56346E0EC32307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354749, "uuid": "57dd1034-689a-4d5f-aeee-c058a8df2852", "value": "6728da03e60bbe718ffacc65d5c92de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354749, "uuid": "67791d9d-691c-47a4-85ba-dd98aa2cd514", "value": "12288:H6fHT+f/70At9a/p08MFVS+vzvzJABPBlVepEW7drL+XelR2UkAEEChKKqusmsyi:sPoVbPc6/s+7dG0SHdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354749, "uuid": "4b13b1b5-952d-4883-8b79-6e668a0c2ab1", "value": 417816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354749, "uuid": "62110dbb-5b3c-4f25-9768-e4e0fdc24ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354749, "uuid": "b17d62fd-87a7-4f67-986a-33715afc4de1", "value": "932a854f4253148f36d54b60e46e31cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9695e7-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353297, "uuid": "1439b280-963a-4281-8f1a-87732c7ab114", "comment": "Malware payload (Heodo)", "value": "160771fbacb96ea884b9d6b8490fe9a2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353297, "uuid": "0663b93a-b899-4279-b728-d758397d1367", "comment": "Malware payload (Heodo)", "value": "8e65f990c1260817739b4e62d6c9a97a2a1d2a8583ca2383b1e82c62805a9803", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353297, "uuid": "5e3ebbfd-8417-493b-bdb7-c1bf5ae41421", "comment": "Malware payload (Heodo)", "value": "e3de95bc166ddb5beafe04f2f634ac7139764024", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353297, "uuid": "4b61c397-5824-468d-9e48-05a37333c14a", "comment": "Malware payload (Heodo)", "value": "25177517fa4b2d5f07f268a85330098821bd010fd22efeeec8f23cae5ab95c90ad245f332c52a581d9a9acb621db0a95", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353297, "uuid": "c4434c92-9a67-461b-9a7c-60294c534ea9", "value": "T11133E01F9522F5ACC3136C7DCA4C59F5650D5893E089F62B08857B8CBB1B2E7178F286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353297, "uuid": "4c7b8710-e0a3-4c44-9bb8-f616ba374786", "value": "1536:3FmPpcEglt24xZdRBzH9hJBrdEwwNXekVIc07:14cEk2Kd3zdtdEwoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353297, "uuid": "30de3818-f4da-466f-a403-3c5963905c43", "value": 50551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353297, "uuid": "a0f73ce7-5d7c-4c3a-b1df-12ce88b2090f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353297, "uuid": "e18a9b6f-0ddf-44e1-b68c-c4fed999d849", "value": "OMICS Publishing Group.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab46d378-a43a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647333243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333243, "uuid": "a2d4a660-2069-4623-9a45-6162d8fc6966", "comment": "Malware payload (AgentTesla)", "value": "b4367770a66c36570fa86ca96d5564cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333243, "uuid": "4405534b-35a1-4083-af3d-f55602441a8d", "comment": "Malware payload (AgentTesla)", "value": "8e8285e5557b4caf94910864e7d833b4057e1eba91b10ab2fb5ffcc830782934", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333243, "uuid": "88c4e8d0-c7b4-46ba-a7dd-3b01a83cd149", "comment": "Malware payload (AgentTesla)", "value": "ac44714316d50c36195a1e8ca048600460fd2862", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333243, "uuid": "16d24236-36d9-4579-a74e-09a7895798f0", "comment": "Malware payload (AgentTesla)", "value": "c0047a71be14404bee13ece949fdb15a2abbf94d285cdcb36f7061935af0e7b26bb46fe2775781e2afa30eb5d27a8fff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333243, "uuid": "137d70e4-95a8-4615-9532-bbd12607661e", "value": "T11C14122136D0D9C1F4A9303A4C76EF1B9637EFB169A1E132684279CC2772B915D22D3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333243, "uuid": "eb581a5e-b722-4aa8-8633-0209657a7afc", "value": "3072:c4ICxeL1VGys5YgO7On/ExZ/X94aQaBU0mIW7TxYYEMSqOPTZeliRw5iWHRlujm:dqLTFs5YgOAExZ/X9JPmIqTxYYZKQMmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333243, "uuid": "d5e9005b-5558-4934-8410-e9a2b85b2f8d", "value": 191176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333243, "uuid": "d636d916-a60b-4b43-a8ba-69515585fe4c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333243, "uuid": "a5735ace-67a3-4329-883e-fb9eeab37df7", "value": "PO DRAFT- Mt ch.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cf8787-a488-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647366607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366607, "uuid": "8154bccc-a600-4c30-b346-b39fb64dd462", "comment": "Malware payload", "value": "b2a0345a6fdf51122f86d511ce4f241d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366607, "uuid": "34148903-4e25-4c34-a3a7-edcfa0bbb6df", "comment": "Malware payload", "value": "8eaaf5bdcb2f0f66be48920347939a8bb7d77400a3477397d5bf078f6c232304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366607, "uuid": "a5231297-7009-4104-b678-0f517132721d", "comment": "Malware payload", "value": "77763ff0c06bfb5b3b8ff7fa0251768fe2b7acd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366607, "uuid": "45547e33-9fb1-44bc-8a05-fc4578b4fa9c", "comment": "Malware payload", "value": "ab553bb980d94898168cf23e7d2c996fdc20a19c14a7ceec7f7d28ece0401a67ec05819f4f51c00d5cd24e9fcd15213e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366607, "uuid": "f7bfcdd0-36c5-4064-bc5f-9a111a7d5023", "value": "T168364CF09348C6E8E546857C862BF5B6635D3DA717C0B8CB02F4AF0F3B235992B5A560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366607, "uuid": "f36daa06-f0eb-478d-8e05-9038e348e987", "value": "48f43f46477c73813572d86df2fc4dfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366607, "uuid": "69af4c98-d3fd-4726-8445-a194fe7622e7", "value": "49152:V8PIv9DPw8wb1nnE+WmjC/A8gpaduWkTXDoR:VRofCXgp9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366607, "uuid": "d8103e70-b376-4e3a-899e-d6d02f84a8ed", "value": 4964864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366607, "uuid": "ffa0702a-f72d-48b4-9ad2-904fa4dcc5ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366607, "uuid": "54a413af-896d-4e89-ab02-45d68ad66633", "value": "8eaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5137a2f-a430-11ec-9275-42010a9c0029", "comment": "Malware payload (Cambot)", "timestamp": 1647329018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329018, "uuid": "4441d91e-6b13-476a-a3ce-5fa3b098f99c", "comment": "Malware payload (Cambot)", "value": "8fbc5cf1cb21e0d4852311a90e38f9fe", "object_relation": "md5", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329018, "uuid": "7c418718-5ae0-4e44-992d-05fc82ca46da", "comment": "Malware payload (Cambot)", "value": "8eb91c20f5f5dd0878a5bca1fdead8a5d860f0842b2f7123c062db73ba36b2ff", "object_relation": "sha256", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329018, "uuid": "23c4e3f8-796e-4d18-a122-039c4fd3389d", "comment": "Malware payload (Cambot)", "value": "e7b51e584b4c0edba161ed718c9cd936d849bc05", "object_relation": "sha1", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329018, "uuid": "60bae538-28cb-4451-bcd6-f030703c3d7f", "comment": "Malware payload (Cambot)", "value": "e222d15dd1f7da1956337da7a06a8cdec63e5ca75390fc3b770d710ab1a255261f894fb34c62f806d5e92abe6fbc0a58", "object_relation": "sha3-384", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329018, "uuid": "8f91d2cf-623a-4510-ae2b-a957326810dd", "value": "T1C534AE33B3D40A85E9EEDB753BA9C6F9622375087F23618A2108677D7C15E214C19B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329018, "uuid": "2edbd8e3-61f8-40ca-a584-d6f67f59b737", "value": "3e8ae3bc85823ef9afa9731fe8e9fda0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329018, "uuid": "6818e257-93c1-49c8-a32e-05c43955afcc", "value": "3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1:Xo/BHng5HaVG4G/1z+QVMbg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329018, "uuid": "3c76dcc7-a9de-4b93-ba71-5f9f9be1e351", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329018, "uuid": "18cfff18-9d06-4059-a7f7-010c33d67df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329018, "uuid": "1cb7b81f-c6d5-47b2-9598-8615f7a2a076", "value": "helper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc44ecce-a474-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647358289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358289, "uuid": "e2d8e1e1-baaf-4c50-8e88-c3ab13dbbc4b", "comment": "Malware payload (Formbook)", "value": "deda8f4b1e2045d935f11a10c5b5c23a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358289, "uuid": "f38a5007-db15-4059-8974-b6b1c05b2e5d", "comment": "Malware payload (Formbook)", "value": "8ed149b28450780d3bac8e24c2141cc4da895a651f765e59a7d5652e2eb1f574", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358289, "uuid": "c0bbcc53-bce2-4f0f-b736-3b401a2ca8cd", "comment": "Malware payload (Formbook)", "value": "fb4a853817ebbcb4e024f31fda77e334b0f3944c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358289, "uuid": "fa975418-2ebf-418d-aad9-f44b2eda55fc", "comment": "Malware payload (Formbook)", "value": "23f8be592bcf7960f51736233cc69945caffed13f1f8502b53a90f501f80b34ca6311e28963c39ef64408e6705b9231d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358289, "uuid": "22fff587-2b26-4c05-9af9-3001efdc7f64", "value": "T14D859E1427EE691FE6FED33CA669841443BFF912E3D0E50D6E4496A659233E0C84362F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358289, "uuid": "37c0d601-d9b4-4ac4-a27e-f21c0df565ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358289, "uuid": "0539d883-3ff2-4d21-86fc-f56a4f1ba645", "value": "49152:Ib/XL/udqgTgamxdAPDJRFFXUCefaZOhQi:ImMMmxdmX1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647358289, "uuid": "d6b14687-09b5-4acc-a37e-2c22bce32d09", "value": 1809408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647358289, "uuid": "33b4e08e-3878-4d9d-98be-80db7966e846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358289, "uuid": "cf1ad25d-748e-498c-8fd7-fce6d890cd26", "value": "deda8f4b1e2045d935f11a10c5b5c23a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c1e18a-a482-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647364259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364259, "uuid": "424f2d15-4e37-4b00-8af1-f2c27b507963", "comment": "Malware payload (Heodo)", "value": "e36526625a91e2883df0f8211223a89a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364259, "uuid": "cbc2c4c4-3142-4b1d-8107-716dacc49aaf", "comment": "Malware payload (Heodo)", "value": "8f0b7c2542c498b0f1030974ff4cb25231461290605a3314efd3d24fac01cdd8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364259, "uuid": "8b373e0c-db8f-4a01-b8e5-c31668f27a7f", "comment": "Malware payload (Heodo)", "value": "ee57d3cd784cc85f2e00e81747cc5858906cb4b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364259, "uuid": "6ac6762e-333e-4fd2-9756-c5424b3e86fb", "comment": "Malware payload (Heodo)", "value": "511892e4929e546641ce62b92306ecc7519a6df249c96c705761442647f451ced0e2beab6c916d206ad011301571985b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647364259, "uuid": "685eab11-7e69-481c-8694-bf996dda479f", "value": "T1A5257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647364259, "uuid": "f7c0a0a5-1525-401f-996d-34187c849905", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647364259, "uuid": "f79f2af3-7c2b-4b7b-8c88-5e2d459ea4cd", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHY0VP6FuR6shQLj88F+Krf6:v6oycln8cACiLP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647364259, "uuid": "aa4f72de-0ad2-416f-b2f7-7eecedd37146", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647364259, "uuid": "f677fd1a-8982-474d-9acc-c56b5f79a1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647364259, "uuid": "dc84d618-4b32-41a5-86c2-84cb4cdef49c", "value": "ujg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21488440-a442-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647336447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336447, "uuid": "35f40967-2fd5-4d04-87b7-eedee4379d2a", "comment": "Malware payload (Heodo)", "value": "c913627b1b2f139f66d66cf5044c32b9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336447, "uuid": "0befb789-22be-4310-a802-ad65f2b7116a", "comment": "Malware payload (Heodo)", "value": "8fbc12816beeabc547e49abc668d772f1771498ad6a3739f4cd417c2aa55ebfe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336447, "uuid": "5f29abd4-91ac-4a31-a7a5-144a748d346c", "comment": "Malware payload (Heodo)", "value": "ebde005bfd0e8abddf9976add6ae925d465e70c3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336447, "uuid": "0b7c4b70-05e5-413c-8434-0c29ec77975f", "comment": "Malware payload (Heodo)", "value": "13a1cf52c91d8eee5e2079f97afbf208c0a97c0c91b7bd6dd27bdbb290e34e1152ffd5a9f883465344992a761c24f2e9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647336447, "uuid": "f4b7afe7-7225-4efb-aa72-a7325dd683c1", "value": "T18773F11EC222E15ECB2714BCD48F0FE7A54F761929C4E87687D0FA4D17049AA638E71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647336447, "uuid": "f4f26d7d-3533-4cb9-9b41-65c70f19569f", "value": "1536:aLgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:d1WiCtzSmICpH7OZuvZGsM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647336447, "uuid": "9dd4c980-e807-47b3-ad92-07358747d5e5", "value": 74757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647336447, "uuid": "130230eb-f2bb-411d-8908-41ef6314de87", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647336447, "uuid": "71170698-5bca-4c8c-b20d-54c3dc5316f5", "value": "documento_2742416.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0622a2d-a430-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647329010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329010, "uuid": "744f71e2-b9fa-4dd9-85b1-3995a646f924", "comment": "Malware payload", "value": "3125f65a5be9ba5f53dc3238d3d454ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329010, "uuid": "e788c5ee-3f87-4363-9107-0472bbe08150", "comment": "Malware payload", "value": "906b863d08bef47b55a7f6b6fb873b8534e2eff2ce18956698e15bfe6ffc8b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329010, "uuid": "9a55fe60-1a6a-43be-9cd6-af65eefa078f", "comment": "Malware payload", "value": "8f154d4e80b7d5c4e0d66be87484846785037fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329010, "uuid": "da49ce3c-d94d-4e62-bac7-deda9faa62a2", "comment": "Malware payload", "value": "e14c7f4597d9a2f75cdc71d28c4f1103164a226d6256a6fba53ad1bcc74721cbd07e07a0d2f3362d0275f0cc56cefd7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329010, "uuid": "51b1b6f4-cb32-46a7-a02e-1f30b80cfd43", "value": "T13725BE456FD494B2D06686F049FE8361DE75BC136B2083CF3E81729EAE327D09A35726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329010, "uuid": "95920343-4487-4af4-bca6-98dae8ef4bb8", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329010, "uuid": "ab81dcf6-6c81-42b3-a0ac-3a7a3412e589", "value": "12288:KINUjD5xxSjNCWCACm/UblEpVLAINUjD5xxIvUawjNCWCACm/UblEpN:6IjNCWH8blEpVLo2MawjNCWH8blEpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329010, "uuid": "0295e7ad-8792-4a0f-acaa-9a030b2ee369", "value": 974160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329010, "uuid": "1162fe3f-3e6c-45a8-8674-304a45e36b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329010, "uuid": "e608fa01-06f6-43ef-ac78-8e01e5a4cd2a", "value": "bday.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f931ae83-a41d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647320918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320918, "uuid": "1131def4-4948-4dcd-820a-fd8df7d06cf7", "comment": "Malware payload (AgentTesla)", "value": "18bc3af383bc36b6ee63fc48d5128a69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320918, "uuid": "df17db0b-1bcb-4068-a6cf-22d6dab31892", "comment": "Malware payload (AgentTesla)", "value": "907d84382681042f0b00f47e618546c797f0d5073dabb0869100fa0b93575e0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320918, "uuid": "a5e0b512-85d8-41ed-ab7b-0be7563b2576", "comment": "Malware payload (AgentTesla)", "value": "a6b93ca1d3188a8d5002f1fc28d1e768ce9b8564", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320918, "uuid": "bae880b6-8d10-4a7d-a4e9-52b78e5ac784", "comment": "Malware payload (AgentTesla)", "value": "7cfc2064c170d3136aa73eda17d270b87c0f31ee2bb86a28665a54a158f141a1e565a8cb63cfd1542b0dfc47c9227b4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320918, "uuid": "0b3875ed-d1f5-4133-a9fa-b60ea8658358", "value": "T1243506AB721071DEF517D832C99C1DE4AA60FC7A430B8207A01736B99B3D597DF24CA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320918, "uuid": "b2f002e6-628a-4b58-baf2-f677ecb622b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320918, "uuid": "2a615d28-ef4a-441a-9cc5-c6b17506bc00", "value": "12288:qLY7Tf32iNxn55F7hQio4o9nuPYRvJFwYKbjCLbNm5ZBKCBVBDTe/cQGDeBFrs:qc7Tf31DTF7iio71uPSvgYKb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320918, "uuid": "00ef38b5-a03b-4938-9fc5-d54c614ee54c", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320918, "uuid": "b98fe809-1bdf-4db2-b577-a0c8253f766c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320918, "uuid": "474b8ade-1ad4-4558-bfcf-22bf2cbe9e48", "value": "VSHaZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29115054-a455-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647344620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344620, "uuid": "a43fe8bf-19f7-44e8-91f4-9426e3749de2", "comment": "Malware payload (Heodo)", "value": "1914a0ef363e013b09bf0265db261a0a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344620, "uuid": "1195d1a6-5072-4593-9370-54d234f3005c", "comment": "Malware payload (Heodo)", "value": "909787e8d4fe3f1774a0efc578cdd11b1bdaf93f675d2d7f956fe22859234bdd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344620, "uuid": "709488fa-f5a5-4245-b6c9-1567e0bef5e6", "comment": "Malware payload (Heodo)", "value": "f06450216c9ab4fd375be4c5c4fd55c9c21c91e4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344620, "uuid": "048889c9-e06d-4983-8ff8-f954794aae64", "comment": "Malware payload (Heodo)", "value": "1d18ace09ac66f1ede0e55d8bf2bf04414e9b0ea04904acfdae9d737ac154fdd2beb01326dc661a9cc55ed1d4dcd4b18", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344620, "uuid": "0b99351d-a7df-4f49-94bb-f4e458ab4149", "value": "T1B533D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344620, "uuid": "53079bd3-d6f6-4d5f-a6c7-de0534d1e54b", "value": "1536:4AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:hcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344620, "uuid": "a42b1b0c-67f1-4a4c-986c-83d02413d7bb", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344620, "uuid": "bf104c00-16b7-41e0-ae74-872ccf4d2d9d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344620, "uuid": "84b9828e-367e-4238-a7f5-e3125ec17db0", "value": "Rechnungs-Details.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d208773-a486-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647365753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365753, "uuid": "792df016-8ea8-4c67-8cfe-3de549ff86a1", "comment": "Malware payload (Heodo)", "value": "263c8f9bd3c57d9856b6055b0af6aad3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365753, "uuid": "a8ace284-a0b3-4df5-b242-1237247aae31", "comment": "Malware payload (Heodo)", "value": "90ed239313099b74327237fa194d91241d0579a50f4be1b43f11e0392674ee2f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365753, "uuid": "904f83af-db80-4c56-9fa1-979b6a71e7fa", "comment": "Malware payload (Heodo)", "value": "6c123e91c7917acc5bf95129e6fdcd3feff777e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365753, "uuid": "3b725351-17ac-4527-8880-c3f95ad07237", "comment": "Malware payload (Heodo)", "value": "7ced84de1c00a2e46428e0f9d2ce91f300a49cb82f751b7e2b17c981b9d767163c2c802c0ea96f5e9834680c0bc62a86", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365753, "uuid": "1080144e-5e43-4eca-a731-6937857676c4", "value": "T122257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365753, "uuid": "a3473904-6bbb-4594-9c8f-ae00b64bb13c", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365753, "uuid": "fc94b08f-dd5b-46be-851b-5362c99acab6", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYMVP6FuR6shQLj88F+Krf6:v6oycln8cACifP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647365753, "uuid": "7d420868-a1dd-4c53-af80-2ddf60eea680", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647365753, "uuid": "6d5537b1-ce91-41c6-8841-e23ec06a0d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365753, "uuid": "3a5805aa-2292-4933-aeaa-68f4f4bfde3a", "value": "4XzSxFDNZoliRm6EC4dgGAE44nIDZlgmHl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0f51a7-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647353838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353838, "uuid": "a4fb6d94-794c-4586-93d0-321a6c7d5cbb", "comment": "Malware payload (Loki)", "value": "af0578a03268526def5d06bce4f654d0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353838, "uuid": "87134bdb-ec19-4e37-8fa8-7474b91489af", "comment": "Malware payload (Loki)", "value": "90ed2ef5ee577ae94f0df2d97a6e6f5c415fce351d7fffe1df0979df7ef5ede3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353838, "uuid": "334f094d-9550-453c-b2f6-c74c4705057a", "comment": "Malware payload (Loki)", "value": "d91c5cb529c3a7a8fd2bdb4948ecfd2181e2b6c0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353838, "uuid": "755ab3f9-27f3-438d-a733-e07298320249", "comment": "Malware payload (Loki)", "value": "7b1111fd1ba08691a88375d2a7fbfacd62828e9bdd3454afafee2e407e471746b3b3f23f1a1afa3843b23233f65e52a2", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353838, "uuid": "0ae238a2-f3d3-4a13-8a3c-47217177a3c8", "value": "T18EF1E711E7F84B32EEFB0B726893A2408374E712686FAF5F6844534B6D122D501A3FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353838, "uuid": "8773eb5c-404e-438d-aa2d-17c755116e57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353838, "uuid": "1e66e748-dbbe-4a22-8f8d-b1d5181c0d99", "value": "192:O8MB5cvzjNWirqWoZsJhFgXmMnwdPAUC:JMTcvzjPrqWoZkiWMnwBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353838, "uuid": "b49bbe4c-7e94-4b98-9f65-99d0edbac279", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353838, "uuid": "cc606145-2c46-4b29-864a-145ed2c5ecbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353838, "uuid": "f14acc9d-2ae9-40b0-9b86-eaf47f390708", "value": "DHL Express Consignee Shipment Docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79b3b48-a4a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647380186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380186, "uuid": "d020ad9f-f9a8-45f9-8dc8-bcd8efb00007", "comment": "Malware payload", "value": "66c4a75ae28cf082734e800b88e0fb47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380186, "uuid": "5a63fe7c-55a1-4a96-ba37-40d12c01e96f", "comment": "Malware payload", "value": "91db477ebd4078f466066d60173620ec44535f06e3396f40ab89bb48326c0fc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380186, "uuid": "e4005cb3-93ea-4904-ba4a-134bdd517bfb", "comment": "Malware payload", "value": "1071b1b30d9def9b4a4311be10ceb6ad96871f4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647380186, "uuid": "9d3b6862-131a-42ca-bb07-1e5f6d021185", "comment": "Malware payload", "value": "bdb86f7fc19471e6e7cfe611735efe210a6627780a04595cf20d3aa0bdd3ffb5d7f38d2d8537c308824286d1001aab32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380186, "uuid": "35aa8104-df03-4941-8c49-205246d3444f", "value": "T18FE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380186, "uuid": "66237610-189b-402a-aa2f-0dd17007f759", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380186, "uuid": "f599a1c4-5020-4f30-a052-f6291babe555", "value": "12288:E94YBCR2xP7guDo463OP4eOsiSOZjb2woE+MhJT:2kRAguDogPyddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647380186, "uuid": "5b4b202f-0294-4e3a-bc0e-654c0927a1f2", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647380186, "uuid": "28b9e608-f4da-476e-a8b5-f0beb49e1df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647380186, "uuid": "498083bc-73d9-4d00-8360-9b54c4a6b4ff", "value": "66c4a75ae28cf082734e800b88e0fb47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23266bb8-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1647354059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354059, "uuid": "18d5e55a-c4c5-490f-ba63-d398416625bc", "comment": "Malware payload (Vjw0rm)", "value": "69c06fd94a073383b9435c801ebb62eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354059, "uuid": "0cced22b-1aee-47f2-9ce5-d3826e45ea55", "comment": "Malware payload (Vjw0rm)", "value": "925d5dec4f50c6ce6eb8bd56a51cdb123e8639f282292e3ed1b6cdd4f37e504b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354059, "uuid": "002fbc82-fa55-41c3-adf1-6cedcda4e9fd", "comment": "Malware payload (Vjw0rm)", "value": "0fae62beac98d2806118a831eb0eca04bf351b65", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354059, "uuid": "af912105-4c1d-4b8f-aefe-9a67f0f6f7b3", "comment": "Malware payload (Vjw0rm)", "value": "fc8eebd54c3ca96f6f4aa158528c77cea54905bf322dadaa9dc4faaa8fefd11959fb639337e1439ab7fb03b75a82cc48", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354059, "uuid": "bec80fa4-bc3d-4358-8b8f-d5a68de5db15", "value": "T15A5527CC7954E8E9D91AE17636B9ACD843E5A60FE15523CE348EB3009B72B10C3DC9B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354059, "uuid": "067aa710-0016-4cb9-9b8d-a9c416d2cb6f", "value": "6144:tiepg4k7ox8ytM/HuMPQH5xvlDKV5+UFs2kooiOXayMfFluoHvLe3xQLv71H0Qd:w2vlDKV5DoihnHuoHvgoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354059, "uuid": "3f858950-523f-44e5-93f5-81053e4cce6e", "value": 1314012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354059, "uuid": "c2d35362-7760-4ce6-acab-9f5ea279b5b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354059, "uuid": "4287122d-e018-40c3-bd70-be684256d2d8", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b753fad-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "8a870557-357d-4989-a5a4-66e1b6358b8e", "comment": "Malware payload (Heodo)", "value": "e18ec45199896ca31daecb61997383e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "632d0d75-4c88-473f-888a-0e7aced83850", "comment": "Malware payload (Heodo)", "value": "92985f520ded2c38c66ea2d165aff8cc52bd028558bb7b0f84a240798783ccb1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "b0aa06fe-1c2f-42ac-bfa0-7fc56d69fcf8", "comment": "Malware payload (Heodo)", "value": "5acf9ade893e614049f6b09486de2d17acf14ffe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "c3eac88c-e700-4874-9f21-c85fa8c5aef5", "comment": "Malware payload (Heodo)", "value": "3ff520ab7e7507fde9870242fd45f78e9e1e2b4c902698dddb97ccc9e4d1f49a18c61340f84986a6490bd6356eeb38f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "5108f1b5-aab4-45ce-b040-893738fff6e9", "value": "T166256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "df4c4c7f-9800-4dc3-809a-b32b95b41d48", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "bed5384e-7b55-4331-8c22-fbd4338f7820", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkxwLBeUNKsuG31Pt8H:3dlV0EnIT7wgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302695, "uuid": "d845f04d-dab4-4979-859c-1860f86e5fa7", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302695, "uuid": "945aaa65-057a-4407-a599-364ff3d2ddcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "b44a4d07-8fff-4107-ab64-b099f2412b2a", "value": "emotet_exe_e4_92985f520ded2c38c66ea2d165aff8cc52bd028558bb7b0f84a240798783ccb1_2022-03-15__000448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839ba0d3-a464-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647351215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351215, "uuid": "14974e06-efb5-447a-a6b8-99c1b7271c01", "comment": "Malware payload (Heodo)", "value": "f8e76a139725e33b13aa776779fcf152", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351215, "uuid": "87f044bc-707a-4d0a-9f8e-4616ccde8b70", "comment": "Malware payload (Heodo)", "value": "934bd452d5b1c07bbe54d1d5272c01090d6dab66428c84667d17a0168bc805fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351215, "uuid": "e854df54-3c36-4995-a379-92eb9d4691d8", "comment": "Malware payload (Heodo)", "value": "380c5af0a65503a97e5c1d2815e5cf08efaf9100", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351215, "uuid": "af3fbd95-e8fc-4bdf-a2d5-40745d03634c", "comment": "Malware payload (Heodo)", "value": "39be58254d206fc46bc79140b48fe7c9caa9b6fefca01b2130ed9acc8df7f2262f8c5ffb53cf6dbeac8a5e99b39bc724", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351215, "uuid": "e29dc0f1-dfcd-404d-bcbc-4abdd086d3f5", "value": "T109257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351215, "uuid": "946c263d-9e70-414c-b796-adf37f747856", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351215, "uuid": "c8b32750-aaec-4b79-9870-e382eb34c538", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlROlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Bl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647351215, "uuid": "73eafbd6-e465-40a6-8a4d-ab57be43fbe8", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647351215, "uuid": "c031c200-d265-465f-a20b-027474ef5ad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351215, "uuid": "de208c17-2e0d-4541-92fd-4e4d46d0b09f", "value": "f8e76a139725e33b13aa776779fcf152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd72926-a460-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349484, "uuid": "8c0a30ac-d6f9-4a41-8bd4-8bd5f5440562", "comment": "Malware payload (Heodo)", "value": "7c246b4f735b2f3161ac7de242b07c26", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349484, "uuid": "61a07e43-7e55-405e-9bda-743ef78dcb4c", "comment": "Malware payload (Heodo)", "value": "93740ee01364a8545278cd0828d2738d4c9a7ede0700b125ea7ff2cc518e31e2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349484, "uuid": "24e48b8f-c754-4e9c-801f-ddb2f43142bc", "comment": "Malware payload (Heodo)", "value": "962fbb45510c780e1a8d761d2fb7604fcda1fbe2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349484, "uuid": "e8382172-238f-4200-ae73-9045628f0a4c", "comment": "Malware payload (Heodo)", "value": "583394654e6fa088d94dd40e99f41339fa9ac54f02e0db5e704670d84b34618f05d8bbb16acc9f247739d27a33dfe2a9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349484, "uuid": "7944558e-51af-4108-bcb3-9755bcc5137c", "value": "T12F33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349484, "uuid": "449e5b56-2e91-4875-bf59-50b7adb69951", "value": "1536:YAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:BcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349484, "uuid": "b3426535-32de-4b97-ba43-bd7c3f05de7e", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349484, "uuid": "5be065fe-9941-4bfc-b04c-ee69379205b0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349484, "uuid": "834289b6-af05-4e38-a5e3-ed091d060416", "value": "Angebot-TUVB-12174.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6b1232-a474-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647358261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358261, "uuid": "682ed6b3-0dbe-42cd-8dc2-0d401ab8e425", "comment": "Malware payload (Formbook)", "value": "bf97e119c4e62d69c98a8b381a1ba55c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358261, "uuid": "1204ee97-4441-4d7d-9f85-068d861f6bd9", "comment": "Malware payload (Formbook)", "value": "9408143fbc58c7ad883b13055422a2cae7f9d9a0bb191561f219b28e361b81de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358261, "uuid": "2f92ba44-234b-4a0c-9449-0812a01c5e39", "comment": "Malware payload (Formbook)", "value": "8ed861c17f60d5ee1ad0ea5c8d618ba0fce72d8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358261, "uuid": "eb0a7db8-b666-46c1-8727-664871627a65", "comment": "Malware payload (Formbook)", "value": "56e2db9d6cc056f4eb564e6b7cfba8a1637944c8b7cf032142297768b4d261ebdd52383a1234df5264ac2149fd2e4d56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358261, "uuid": "3d5ba85c-468d-489a-b824-973540779f87", "value": "T12D158C8D6CE17B25D5BD82B2ADB3DA7D4F726D47DB62EB0418E4D7404C8B6C01A628CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358261, "uuid": "a0780d91-b8db-41ef-8801-c5b27eca176a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358261, "uuid": "0be952e2-a36d-484c-8bdf-377e5f522f3c", "value": "12288:UI2qbJk36PVKPX+1qTCeH+8g/y359iLLRpXQfDLvHcXkVZ9d7Vz/RZcbty0fv2/k:XJkrN+B6kL/uTHcXkVZ9dZ0b1Bpxki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647358261, "uuid": "816dd1fb-7c91-43d5-8af6-68eb0585f7d1", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647358261, "uuid": "810b41a5-7556-4546-90f7-c98b067f7274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358261, "uuid": "b6a89cbd-7466-45a9-b5d2-25f2075a4371", "value": "bf97e119c4e62d69c98a8b381a1ba55c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb61dee-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647333810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333810, "uuid": "1d5d29a3-52e8-4511-adaa-bdffdf096d87", "comment": "Malware payload (Formbook)", "value": "c6e1a03d0727296a8cae1b3ed9b53c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333810, "uuid": "e5bbf568-d52d-4f82-9409-13c952a56384", "comment": "Malware payload (Formbook)", "value": "9460e8eec15f3c956225833db6614bc93ef7699de5bc8e2ee6ad8d120f5fe775", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333810, "uuid": "9aa0ec11-fc6a-4c99-8ca3-00ccf4b83e75", "comment": "Malware payload (Formbook)", "value": "29d8788901097dc0cdeb01950377901da9b0fb1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333810, "uuid": "cb1899d4-75ce-437e-9b9a-a84bd4027a28", "comment": "Malware payload (Formbook)", "value": "b8f048071873688eb4820933e2485266f98bf4269aaf21abad8cdf6a4c31ff9d6242dabe3a7e3811104d701d64b6c4a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333810, "uuid": "04ffd9bb-959f-47fe-9ab2-cd49c58e40c3", "value": "T1EA05021AB2E49F83E57BEBF69A650A4447B6B539050DE38C4DC230C719F2F0057A4B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333810, "uuid": "9b1d4daf-c09c-4951-8944-e3d99e7db54b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333810, "uuid": "94642305-df02-489c-944e-dec562bd8c3d", "value": "12288:GsmTkwOEocEo7sGmMbjRIJMfEDAMxOCj+nhhk1+2m4CcqB4geLQg5f7J9WEdq56t:/m4wO5GBbIO9hSfm4pqqcSNl45w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333810, "uuid": "2e3d5240-46e6-4133-b772-30a79de6fd48", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333810, "uuid": "c055fbc2-6a8e-4910-a278-4bcc440e8673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333810, "uuid": "8b5fdbb2-69f6-4e7c-8e4b-34d89709fe8c", "value": "MV00195010030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469ce3e0-a434-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647330497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330497, "uuid": "4eced468-3577-42b0-9381-17330a6067e2", "comment": "Malware payload", "value": "2b1e28c572b13c757506a1307ff8f051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330497, "uuid": "1fa1fd4c-4a1f-4bff-a3d7-85d473b183b5", "comment": "Malware payload", "value": "949c7b6c3a6f957bfd8044f3d4f090ba38db4ab9b026d14672cb8184011aec8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330497, "uuid": "5aa47bd9-cd7d-4b95-9e35-925c0cd9f13c", "comment": "Malware payload", "value": "4ebb8e8beaa48fff1e9c95ac9dd88d93f50adadc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330497, "uuid": "714aa1fd-0559-4b53-a46d-d3d39c65fb57", "comment": "Malware payload", "value": "f67e5c4ee3a84b2bc16d1a4d8305112cfa0a82bcbc4f4aec935f6498db5d5d0172cf602acafe0898fb6fad04ca6c9a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330497, "uuid": "4d323c94-b5ff-4a68-9f38-790c06cab41c", "value": "T1E0F49D61F69641F3E981307061BAD7769939BA3923347FC3A7E43D781A211C2AE3934D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330497, "uuid": "2fcf9179-de08-4e8b-93a4-fdbcb37b9d1b", "value": "d45ad06d41e77dfabdd72c5e57235656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330497, "uuid": "52c456e3-03e7-48d8-b964-c10f5f80ef29", "value": "12288:Z/3X0FwXk2x2wAdm4pb44f+sn5qeUZUk0t2XrAyc2BNuRJqgMj4a+4i7Js0GN3Ni:Z/3EFwXHAQ4F44WK5Rq8+N8bz6HNe5dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647330497, "uuid": "7df97462-3ad6-4bc1-8e4d-4828988311bd", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647330497, "uuid": "bd83a6f0-68fb-4bb3-9265-4a3e9c9625b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330497, "uuid": "e9f45d34-03b0-476f-9d94-6ef26d199ee2", "value": "eufive_20220315-013249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c85ed05-a47d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647361914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361914, "uuid": "a1531c52-8f5e-432a-ad37-7e148b62b736", "comment": "Malware payload (Heodo)", "value": "b6217f58efb7b75060701c4168a76657", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361914, "uuid": "4a2f62ea-3b6f-48a3-bc5b-c0ffc8735fd8", "comment": "Malware payload (Heodo)", "value": "94b1cf24f694995f733911be82778295a42629507203b3262b88a70784b3422f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361914, "uuid": "85201072-dc78-4fdb-9d1d-529911127ec2", "comment": "Malware payload (Heodo)", "value": "81561b5e48cf2ae7087c51ab38d3af389da042cf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647361914, "uuid": "91e11cf8-be80-4169-9fb5-f74778ebe8c4", "comment": "Malware payload (Heodo)", "value": "211a34311bf450f1c8fcbbce0a48f1cef2e03d50addc65027e7d32cc467303740482e65109af59db018b391fb461c9a5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361914, "uuid": "75e9c146-7b9d-42ba-8f67-ec206cda705a", "value": "T16933D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361914, "uuid": "b6521613-82a4-438d-81ab-3e188ac6e098", "value": "1536:oAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:RcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647361914, "uuid": "71f34eca-324f-4b58-b3f1-1287de3d5398", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647361914, "uuid": "c8ebb976-0ac6-441b-8d09-18c2a2aaea7c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647361914, "uuid": "4478fd3e-39a7-470b-b379-aab4aada38d4", "value": "Rechnung 2022.15.03_1603.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f816ec77-a450-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647342820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342820, "uuid": "0f15d8c7-27c0-4cfd-a9ef-6b222ea8346c", "comment": "Malware payload (Heodo)", "value": "5d241ce962a58ab89801f5ad8106fec6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342820, "uuid": "c395e383-fe17-444d-b171-672428fd780d", "comment": "Malware payload (Heodo)", "value": "94d09d715f403ec38b4e54eae6b6a06ea545debe733f964874f7be71b53a2e79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342820, "uuid": "c3c2843f-739a-4485-9b0c-c13aed8f07fb", "comment": "Malware payload (Heodo)", "value": "6574199b0185e416b9c6b3a667dfdd3aa43cfbcc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342820, "uuid": "f36a369d-5508-4d23-b49b-8547f10135fa", "comment": "Malware payload (Heodo)", "value": "fac58739d39e5bd7d7b4a89b492bfef27aaa0b243fba77725b2ccd9e7236ef07d072e5bfa80dc5eb00e4e867c771d2c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342820, "uuid": "b1bf1594-cf61-4504-b185-72a4966d839f", "value": "T105257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342820, "uuid": "15ae7849-705e-441a-975e-973fe3b8e9e1", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342820, "uuid": "4fda7ecc-c668-4caa-b5fd-7b9edd9ff236", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHY1VP6FuR6shQLj88F+Krf6:v6oycln8cACi0P68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342820, "uuid": "d150eb51-1d50-4d79-b150-f7129ac3fb58", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342820, "uuid": "513bc716-ac5d-4da0-a120-9b8037177916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342820, "uuid": "e69d71b0-e8e3-4afa-bf23-161be027229c", "value": "vGAfFFwRFzcZs3A1gRJ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a478b5d-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353266, "uuid": "659ca29a-1dc6-4cad-9c6b-e2fc2c2007c9", "comment": "Malware payload (Heodo)", "value": "c4c6d8b5ed202009b19f158ba8a9ab5e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353266, "uuid": "1785d9ef-9585-4cb4-9099-df1616bec860", "comment": "Malware payload (Heodo)", "value": "94d7ec70fa1eb8d42dcacec6c21d18c3a33509b324fdea36aa4b9c270701cfdb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353266, "uuid": "c8a729b4-93ca-4cbd-860b-797da43ab9a2", "comment": "Malware payload (Heodo)", "value": "c51d81f6a79b7c88911b37c36c96a8e58c8fb405", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353266, "uuid": "f3e68c1b-6ff2-4bbc-b19c-9175c53f8c9c", "comment": "Malware payload (Heodo)", "value": "854f6a33fe07cb761b6bda6c6cc04c2bb72ddfd604ba316bd09e5074aca5ed2a34df55bce5beeab49f6384d5488003e8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353266, "uuid": "13ac526f-881b-4fdb-a5c8-3816f6832724", "value": "T1F133D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353266, "uuid": "44d0154d-42a7-40f3-99f9-d5d57eedcd09", "value": "1536:kAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:NcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353266, "uuid": "136a2c96-1c4a-4c8b-af4f-e8c6fe9142dc", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353266, "uuid": "1e594e16-472a-4af2-a016-d73f246127fc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353266, "uuid": "a6d0d490-5a82-4364-90e2-5bd47afdb5c6", "value": "imedpub_5.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc35079-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647348980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348980, "uuid": "5667fc76-845d-43a9-b739-7de2e38a810e", "comment": "Malware payload (Heodo)", "value": "df65bb940539dec78ecf562e1c77ecac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348980, "uuid": "1baf35a0-b8fa-4332-b823-b556cb3c4ce7", "comment": "Malware payload (Heodo)", "value": "94f0c2245062bd7542b0e74460ffc2b59bcbc1d2ad1b984c7f183093fc8f3bd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348980, "uuid": "fc9f1264-1292-40d7-8be9-957a24317190", "comment": "Malware payload (Heodo)", "value": "ce80de26ebbd418f44c93d84e498a91f8ae5e31a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348980, "uuid": "43b477fc-aaf6-42ba-87c3-9f5271a9ceee", "comment": "Malware payload (Heodo)", "value": "feb38ec429b80e4b148c18fbe5a8b30e9ddd4425cb45a01ac04ed308f366b1d7fa1092a4092b03e7964d5e15a088547c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348980, "uuid": "99c0a571-0eca-4bae-bcb0-a7bbe4a77928", "value": "T187257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348980, "uuid": "4bb50ba8-d4e0-44e4-aed7-6ed17ed1a473", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348980, "uuid": "5d6807a8-e1b5-4342-8c12-01b584b5a493", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHY2VP6FuR6shQLj88F+Krf6:v6oycln8cACiZP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647348980, "uuid": "d02df566-a260-49d0-a0b9-c76330c68ebd", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647348980, "uuid": "56e37ef3-f0a9-442d-a3a4-4a82ac811fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348980, "uuid": "b3d8e748-fbbe-49d3-b9b7-82bf4bb953b2", "value": "df65bb940539dec78ecf562e1c77ecac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8ce4a8-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647354456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354456, "uuid": "5330920a-c689-4639-986f-cdeb66ba6b21", "comment": "Malware payload", "value": "c523118e2167bc4709218ce81810f14a", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354456, "uuid": "59030aa4-dac8-4411-8ef0-30fb11d90730", "comment": "Malware payload", "value": "95561a116a974f1f494dde96adf5ab4bc2611f00b0e111fb5643ea17f10a99c8", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354456, "uuid": "9fd447a3-c73b-47a3-9067-11fab0cd16dd", "comment": "Malware payload", "value": "4d1231c50ab48b5eedf3fb08a9d04467f781b66c", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354456, "uuid": "77ed9d8f-0afa-4a70-a054-c64e84f469f5", "comment": "Malware payload", "value": "61f0894c185e9170b195d6aaa2224e11212eef3f8e242ced976583de9606ff2e2b221106c045182c808cae5c8d322e0d", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354456, "uuid": "7788ebc3-ba81-4223-9e32-d07b7e88c536", "value": "T11ED1BA6C744B0491FBDF806134BE3CA000B2F4BAD7D85A8473BDC7B1A3D265A9A8118C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354456, "uuid": "84b635cf-d98f-4a5f-99e7-812227bdb7a5", "value": "48:qN+wDKWFtAdNKWLxv1Mhk2y1IHUyEEsj2UNTa02a7VWoAXl1T7vAdIwKiPYJ4la9:qNKWFtA1xSNGIHIFag7j4l1go449", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354456, "uuid": "6167db11-32db-4c80-97a9-7f1b81a73dfd", "value": 6293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354456, "uuid": "f32ef14f-726f-4a19-b13d-d03129b12c0e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354456, "uuid": "04997013-c82f-4c50-a238-0e02211dee4c", "value": "c523118e2167bc4709218ce81810f14a.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb3bd6c-a460-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349537, "uuid": "198303a8-6330-44c4-868d-e50c82b39dbd", "comment": "Malware payload (Heodo)", "value": "036f23bdc96615d13e7d9f9013879d02", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349537, "uuid": "2d970df1-328e-41f6-9bbb-87dd5b158ff3", "comment": "Malware payload (Heodo)", "value": "9575ebcbc88a2e1152a861626db0569a551d93cf8bc04a1c325c5d1e7da25994", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349537, "uuid": "2ce87dcd-6deb-4efe-86d7-e3e84f27792d", "comment": "Malware payload (Heodo)", "value": "2772c8330547339c5fd1234f49d7c58d2133ee9a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349537, "uuid": "47d30f58-281d-4263-8dd5-3f90ab3ef002", "comment": "Malware payload (Heodo)", "value": "bc06481d9b517ca7287f5685c6ca8e76d1a14a24c63ab8e4326af2d8bd5c13bef084cbfa23c6b733f03c3e9e466849c3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349537, "uuid": "176ebf37-bdb9-4713-9dbf-1eb1f4b4c79c", "value": "T1FF73F11EC222E15ECB2714BCD48F0FE7A54F761929C4E87687D0FA4D17049AA638E71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349537, "uuid": "6815d8a0-660f-43ae-b836-008a4eca8563", "value": "1536:aLgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:d1WiCtzSmICpH7OZuvZGsM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349537, "uuid": "f43150e4-a31f-41a1-ae24-4c6c68601055", "value": 74757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349537, "uuid": "6c2a4433-2d5a-48e3-8f1b-4e010b2ba7ef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349537, "uuid": "b2d8bd02-f8c0-4213-b775-a17594a3f975", "value": "PACK 279910415.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa2b2c2-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "28e8f9d8-4024-4689-bbbe-d9264f2b55b3", "comment": "Malware payload (Heodo)", "value": "b3b5295adb004a5cd4f61f94518644cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "0c941713-6211-41c8-854e-ec0844103eef", "comment": "Malware payload (Heodo)", "value": "95a9f8545dd453136dcb2cfc10cf588644e9e2570f7348e9b38caad23d87e63d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "c5a19bdc-aeef-4fd6-aaa9-8d8ce5b75e8f", "comment": "Malware payload (Heodo)", "value": "40c18856b4371c678b083dba17c5df51612d03a9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302836, "uuid": "943ca33a-14ff-4855-9dc1-74189fa3a3d7", "comment": "Malware payload (Heodo)", "value": "123413509a8223c030fd1aaf904f623823ee007f96fdb5f086372ad6f3d52a790213116921b724478afff646396964c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "0a790a9a-aaf2-47af-88da-0be1cbc1faaf", "value": "T1B1256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "5c48c0c5-2f06-4b8a-9eff-830982dd1154", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "48b24f38-b0f1-404d-a5a9-9b227583b66a", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1XWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6FWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302836, "uuid": "61c406ce-7894-4444-8969-3834371e1151", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302836, "uuid": "ec8716ad-0768-4ac6-bd60-893fd0157869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302836, "uuid": "7b404c96-abd2-4711-85ef-c569c8a2dc60", "value": "emotet_exe_e5_95a9f8545dd453136dcb2cfc10cf588644e9e2570f7348e9b38caad23d87e63d_2022-03-15__000706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316044b3-a467-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647352365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352365, "uuid": "2c304152-5146-486e-b2c6-1691ab847c62", "comment": "Malware payload (SnakeKeylogger)", "value": "32ad117a678e6b9713107c68a9e7e380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352365, "uuid": "f3073a1e-d8cb-4415-af2b-27415594157d", "comment": "Malware payload (SnakeKeylogger)", "value": "95c403b8f788b264dd24a0254fe983c7225dab0a6fb320baba59b0addd01e622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352365, "uuid": "b18fb73c-8f01-49b0-b669-2d3f25aa52e5", "comment": "Malware payload (SnakeKeylogger)", "value": "f1dcd979f4b33306047180417d047ebe0ed3559c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352365, "uuid": "cf315be8-489f-4d92-8a09-9c8287ace096", "comment": "Malware payload (SnakeKeylogger)", "value": "69d6663038e2a6934f57f77a1d078e8270531f7b1e48bc53fd8670aa8793483ff817e42e3a0c145d3391e609ddb5aac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352365, "uuid": "25955403-62a8-472f-af80-e050f3446587", "value": "T1F38349C3778C1356C518483D49F78D200B777FA66D06F616AA84BB6E1FB33E16A02E85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352365, "uuid": "63a45749-c331-4c5e-a32c-ae517ccc8944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352365, "uuid": "939e64d8-e343-4419-9357-221f8be1485f", "value": "768:zj0FZUI2JUKqRfLo5/96D7ELgOO0zSMpciTzRmLowVYCIxGzNLEYD22HMSEE6BdJ:zmRzo5/9prNzsLowmAmYteE6AGt/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352365, "uuid": "cfd5b858-ebba-41cd-acd0-770b40b93fbc", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352365, "uuid": "3a760806-20a5-4454-b44a-4676c778b827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352365, "uuid": "74897f86-6f35-4e5b-89c6-6ee485be4c4c", "value": "2b k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0400bd2-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "6db19172-a0f8-4630-9221-e34aa964cda6", "comment": "Malware payload (Heodo)", "value": "2674b068a8bff6b9f413e3f06ba9592d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "f1f17de2-a51e-4e9a-ac5a-30d85654c3d4", "comment": "Malware payload (Heodo)", "value": "960aad12b7db251351136784454fc945dbc5eda218f950b06864a3ce52cf2ad2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "ed2fc6ca-9a4c-41d9-adc6-d7275264446b", "comment": "Malware payload (Heodo)", "value": "43087a4a8cd0027053562ef887d78e179738f3a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302837, "uuid": "ce5dff2b-2c26-49f5-bcd1-d893bfd78b42", "comment": "Malware payload (Heodo)", "value": "3f0e8a5b4d578292a91449252a6e8ebc0db70ec22bfed58bece98a43be6bbf224f3565d16dbc101149931d093e7748e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "023dcf72-ce73-49ec-9ddb-916841997a62", "value": "T11D256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "070612a4-8fb4-42d3-84c0-0a0523d746c2", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "4f4d21d5-eeff-490e-b0e1-e92f1e6a3a9a", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1TWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6RWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302837, "uuid": "e25fa924-9920-4b3e-9003-9ae84c213b7f", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302837, "uuid": "874e1b78-8c05-49e5-9946-2a2a8ac52023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302837, "uuid": "eac3cd19-09d0-40f8-b65c-2b7abe386bbc", "value": "emotet_exe_e5_960aad12b7db251351136784454fc945dbc5eda218f950b06864a3ce52cf2ad2_2022-03-15__000707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716c7f79-a488-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647366646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366646, "uuid": "a141f039-43c6-434b-9460-743f6a1fe381", "comment": "Malware payload (AgentTesla)", "value": "3c1c3635231fe663c0a5cbda3d2c3a31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366646, "uuid": "1bb6d08d-f5e8-4763-9e30-5540f7a2c17e", "comment": "Malware payload (AgentTesla)", "value": "976f6318f447a325ccd5969f760ac7014721d63dbc2f85764ef98d5390854083", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366646, "uuid": "b2ca9c8b-4355-4bba-88ff-6007376a4fab", "comment": "Malware payload (AgentTesla)", "value": "d8b32bf4c0d082db7ca9f10f8de9dd9675186332", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366646, "uuid": "93c012be-fe3d-4a6a-a5da-a2b809210b9f", "comment": "Malware payload (AgentTesla)", "value": "3bad0aef6f8cebbe2621f4898c66a59b81a87d6ce939d60bc26a74c4c1f922bc45544d2a86b9212b98bded4d6a529af2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366646, "uuid": "3a5f1408-1e47-4abe-bb3c-03e2bb525a4f", "value": "T19525024621DCA017ED1876F555E22B781AB3BD1F902AA4FA32809ED0ECD83C52BC57D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366646, "uuid": "e791f8d7-a09b-4c9a-b486-c3a26b02a68b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366646, "uuid": "1aad8ee8-420b-4338-b064-448b356a3390", "value": "24576:m6NgDS80jO+ux/qvCe0OXh30sMFkYmmFaSn2UUY:RwyiEKz0hkTyYmoaS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366646, "uuid": "18f0a7ad-a232-4132-a537-ba5d9d2cb7d8", "value": 997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366646, "uuid": "b85e270f-9561-44d5-b238-9a7133375cd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366646, "uuid": "85cf9412-6dee-457d-a7af-5332177183af", "value": "976f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c3d4d3-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302840, "uuid": "0e4e7419-b360-4dab-b747-392f36601da9", "comment": "Malware payload (Heodo)", "value": "8b7e2aa638c91f93b6e073e7cd3e2e80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302840, "uuid": "9631cdc3-b59f-41a7-8ad0-0285f80be8ae", "comment": "Malware payload (Heodo)", "value": "97aa8a93629df620365dd7e076c59f011c5afd73d6908b76ee008798f5d32667", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302840, "uuid": "105f5f93-e440-4d37-a139-655b54426e96", "comment": "Malware payload (Heodo)", "value": "ce318a9ca9b005ec678de3428d64756c57b50735", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302840, "uuid": "be5ac2a7-7c1c-4785-a512-b9953dcd4275", "comment": "Malware payload (Heodo)", "value": "ddcbff8b8727add5d89ebd39cb835678e14f713da8c6e38931540d442af815347ac0ce0470350e9263d34948c22b8c11", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302840, "uuid": "82e9b1a3-66d7-4fa2-9a0f-da42325e8712", "value": "T1C6256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302840, "uuid": "9e033d53-cc0d-4bc3-85d7-f54c8b8f627e", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302840, "uuid": "19a59ebd-680e-4ca4-bd51-6b08c8a56b46", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1/WGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg61WeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302840, "uuid": "f3c836e0-321a-4edb-b2ef-a96af204adad", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302840, "uuid": "9d577efb-f6b7-4762-83cd-95e62c8f4b95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302840, "uuid": "d12f6384-a5ee-49d4-b5a1-55ca4b0ecd44", "value": "emotet_exe_e5_97aa8a93629df620365dd7e076c59f011c5afd73d6908b76ee008798f5d32667_2022-03-15__000711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200ef803-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647354054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354054, "uuid": "158732dc-4099-4634-bf51-a0a3319c2045", "comment": "Malware payload", "value": "9570550f0c772c42b25f2d9f8ecc9a65", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354054, "uuid": "6d2116c7-e18a-4fcc-834d-34783b17e7a2", "comment": "Malware payload", "value": "97ee4ed77dab949b46061c9c75b4b3ea7f2e58a9ae3dcce13d658f50c3a61f85", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354054, "uuid": "3cb28cab-d8fd-4eca-8607-0801f215efc3", "comment": "Malware payload", "value": "b50d56b1159dd9a6d39e4bdd145257c6ec977a2c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354054, "uuid": "21a46610-126f-4021-b5f8-2200d25b6b99", "comment": "Malware payload", "value": "51d3471f69cfd1ebc61ffb463658bd86c1ee4ae1c38db3a517b1ab303dee6b688a5bb83e6d95280c5cf5da9bb34ce018", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354054, "uuid": "f809be00-4052-47d8-be6d-8dd81f8c7a7b", "value": "T1041469C5A543DE5A882C482C40BE92160397E609BE034679E5FDAF1FABF694FC105D4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354054, "uuid": "f4d21c45-dd96-4aa5-9049-fa934318014b", "value": "3072:viF3bTKO6rI3f+k1iHm31IDM6Agqcmu4NjlE8x6o/+CEqnMwYJ:qBu0RZy33HDseozoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354054, "uuid": "113f1a1b-3d13-49b5-8daa-1457c1aefb3b", "value": 203379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354054, "uuid": "361efd43-7221-478c-b44e-aac753f0b27e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354054, "uuid": "bb06b23c-ca19-48e6-a3f0-c8924beabf1b", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbccfc3-a4b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647387226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387226, "uuid": "3067cb45-d2b0-4fad-a8e9-28b1ef1c8e95", "comment": "Malware payload", "value": "35d7f0dd22470f8177554fcaddc0d056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387226, "uuid": "f7c5fbb3-7ed3-4e47-af54-6e44117f91b5", "comment": "Malware payload", "value": "97fd9f15a70326bd7eaa7489e6f75bf118546a11cb249902723221dd68802e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387226, "uuid": "1b43d551-551c-4794-871e-16a8e878ddb6", "comment": "Malware payload", "value": "19b40b62a12daf24169671ae4a71eb8a63e0ea28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387226, "uuid": "39b70104-6961-43d2-8f2a-99d4f818049f", "comment": "Malware payload", "value": "931f8fa478ba8bc47b31510fe7cde7680889646f1bbaa10f185e00010500dbf0c9368449cdf148cb765993262b596cd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "redeemer", "colour": "#5CC3EA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387226, "uuid": "c3e3d8c2-38b5-4a68-9d65-1e60b0cd13e0", "value": "T11D95DF02FB82C4B3E5975535917AA77F493AAA104328CED3C7D02D669D312C16A3F3E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387226, "uuid": "898509e4-857b-4330-b2a0-36a308c20a91", "value": "d01bd22a3ef9031c2323f198964086be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387226, "uuid": "aeda8d7b-d3ea-4498-8f8d-cba4e06d4312", "value": "49152:ITvsPzWKDjQC2OD947YluatPfvk/qJjHgFA1m:ITvsPzVb2OuotvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647387226, "uuid": "20f308da-e6ca-496f-acee-88717434c196", "value": 1912320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647387226, "uuid": "429465af-19fc-4882-9ddc-f7aae927a7ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387226, "uuid": "c7d0b867-25ef-4730-af3f-cae307969a2c", "value": "build.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abd0dfa-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647354045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354045, "uuid": "7fda564d-6409-4405-95a6-0e5db7995508", "comment": "Malware payload", "value": "9972778d794eab2e38598642812b0491", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354045, "uuid": "7f27fab7-52c7-489e-8457-570d8da8e525", "comment": "Malware payload", "value": "98c20ea1488ac48e4c7910fbb583aee4e9b3f1bc347f479e17def2f948e178f2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354045, "uuid": "0053ef62-c612-4517-be64-6848953a2bca", "comment": "Malware payload", "value": "cbd018c338b85ea5fc1db7601e4e606a2a482967", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354045, "uuid": "e010bf9e-754f-49b8-ad0e-9aaa6509c7e0", "comment": "Malware payload", "value": "cfa1eecb3ef6b27524be2fdd2fc75291d76f2178f751155f17d1c77570c13b7ce94e563d993c0cafca1c15a665d60115", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354045, "uuid": "b48124ba-e72e-462c-9c87-3640fe33928b", "value": "T179166D23B244F93EC06F0A3E597BA655983F7A616912DC1767F0188C8F39580BA3F647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354045, "uuid": "0c894f5f-2bf5-40e6-a4ff-6069f9942157", "value": "49152:XRtMqmQYVt6SgsLsiJ+zDF1FIMkTcwP4QUAN2EfJCGYu3A:TMTh81HXwPowf4GYaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354045, "uuid": "2f906692-c985-4d48-9f70-f7099b8bf923", "value": 4090368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354045, "uuid": "ec17a1e2-f9b2-4907-b926-fb7a9aa63ce8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354045, "uuid": "8f35015d-f06b-4a45-8e3e-50641f75e78c", "value": "Fact-uraEndesaEspana.Archi2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34184eab-a431-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647329177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329177, "uuid": "799d7b0d-d3d5-4699-af49-5dfb352bd457", "comment": "Malware payload", "value": "a8453acb72f0bd17f5b69076bae05358", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329177, "uuid": "99227238-59a4-43fa-96e6-57fe3f6e0dd0", "comment": "Malware payload", "value": "992331da3fcee44de3f2fc24e0395a7930a79ce6fadbbc50638244446cfe4d47", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329177, "uuid": "448e8adc-3417-476b-b90e-9092783b4464", "comment": "Malware payload", "value": "b71f3b974657c9a47d2b19690ceb0d1d1e163b54", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329177, "uuid": "61b85f97-cb13-4cb3-abe3-9985c67a1580", "comment": "Malware payload", "value": "6fc6dffaa7e5f85b0345f7d814e9b924708f06a75a1097cf0ad51462558763c78c91d17882b9ff1e7cc5e96f0dbabed9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329177, "uuid": "ee10a9e9-f88c-4c48-a82f-02fc8c4d47d2", "value": "T1831402A975266AC2D07786B08D53F8ECAF22EFDD463AA1302801316D0D7657D8A307DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329177, "uuid": "2154d1b1-5617-4bb5-ae7e-96e06a5ab674", "value": "3072:UtBaq31kypPOjKQ4ihhHiknwAf25clmXgCPDMK6DFYnQjn2NAZJM/4Q94XWuMs:2lkgMkGhJwf+mXBPAdZL2NoC/S51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329177, "uuid": "bcc31bf0-ae67-4695-b899-d417cff3bed0", "value": 191176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329177, "uuid": "2fc48e8c-9704-444c-9bcd-941c2d4ca0d9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329177, "uuid": "b87005f0-2920-4d27-bb8d-1f5e95c7f556", "value": "Order150322.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e2a18b-a461-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647349742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349742, "uuid": "a2a8a7b3-9954-464a-b260-1fb11e7e15fe", "comment": "Malware payload (Quakbot)", "value": "f6cf8d0dc990f0e73ca71bb91c68e35f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349742, "uuid": "7fbdb020-d95f-417b-9b7a-d705369594e6", "comment": "Malware payload (Quakbot)", "value": "997c73e9f09586d43bc539917465979ef9b121678be33846412ef3fb550ebdaa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349742, "uuid": "a3454902-cfff-44ec-bd81-862abdacf5e7", "comment": "Malware payload (Quakbot)", "value": "4cc92c3f60df03ef6e2fcfc39453de343e81b661", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349742, "uuid": "e9b4592f-80b7-4435-a444-9c43ee9e6676", "comment": "Malware payload (Quakbot)", "value": "53ef924ff36f4eb1cc9aabdf9c17de18eaed7ce4fb38792e0bb34f035c61198b3648dd2fc1dae75f8bb564466746f295", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349742, "uuid": "2df54b43-15bd-4586-93ee-5d61b602c001", "value": "T14415BF71E3A014BFD1323ABC5D7F33599D263D012928C48967D96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349742, "uuid": "1729ef1f-eb80-4300-9e17-962827557751", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349742, "uuid": "7f1a38c7-e3c4-46dd-8b50-451dec5d4eff", "value": "24576:86BseOd1eQJn+Xz4oA9bDajPNI5zvpiGaT8:86toeQl+rAdDa7alpiGM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349742, "uuid": "c6b3b0f3-8c89-4efd-bb44-b5305a184a07", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349742, "uuid": "054b0aa9-9b87-448d-a863-1de018d1b440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349742, "uuid": "c424e81d-b10c-494b-9bbb-0bf87857db0d", "value": "7162256.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fcdf62-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647353641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353641, "uuid": "424bc1c9-05ae-4cb6-81bc-2682ade8bd85", "comment": "Malware payload (Loki)", "value": "522b354f6a3fcdf06fbbe4db5214f25f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353641, "uuid": "0da72e5a-f26f-458b-b303-25ca1e48b327", "comment": "Malware payload (Loki)", "value": "99d00e1001a8c91202d83bcd8acbdc7e24ae3357a9342832d8d5e5b7267a9630", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353641, "uuid": "809b9c1b-7430-4092-a21e-04bd88acf48a", "comment": "Malware payload (Loki)", "value": "6fe36202bd63919681d3024997bf72cc5fda75ea", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353641, "uuid": "66141459-01e4-40d4-9832-b7201e964a15", "comment": "Malware payload (Loki)", "value": "838a5f4484e0eeeb2cb6f83ae304a64328f87e4179d7023c3b6f17bcab0d769fc6073b7bbbaae402b2179c07f2e2f9c4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353641, "uuid": "6e63505c-952d-4542-affe-a84219d58fdb", "value": "T1C914029C5F06FD88E9607E7623F2D689ABC58E7041A0342F2187BB1748BD54FC486E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353641, "uuid": "84eaa6a8-740d-4f17-aeb9-00a8287b4804", "value": "3072:oiia2JyjuT2Vw00zPH5DKqvDc7MYMaIGS/62Vo6H8/AaskMhKAt9mfQB:Ia2IyCVlQPH5DKqvvaIX/m6H8I88mIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353641, "uuid": "a7976ca5-7173-478e-b479-ee413cf554a9", "value": 191128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353641, "uuid": "b2bd6f17-5951-4c81-be4e-bcb8b182d601", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353641, "uuid": "3a42c92b-a70e-449e-acc5-605f88a11dc1", "value": "SCAN_PAYMENT_SLIP.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be7dd9a-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353645, "uuid": "4fb65d41-7528-4aaf-9c0e-8ee101c84a46", "comment": "Malware payload (Formbook)", "value": "0db82ab0e6b64c0f62a4cecb60661e31", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353645, "uuid": "08045cc1-233a-4ce0-b1d6-630b02cefec7", "comment": "Malware payload (Formbook)", "value": "9a19b3f7270433c730c20b5f55726f487faf5c8efb24b976232a921ce16333f7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353645, "uuid": "aa403178-bd99-41f6-ad9a-a89e6266ed94", "comment": "Malware payload (Formbook)", "value": "6ddb7106adff0f20ee82bc7180c10379b1e834c6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353645, "uuid": "94f5f99d-2cd2-4ecb-b11d-2cc87605fe38", "comment": "Malware payload (Formbook)", "value": "1f86185b6a9bfb989052bc4468b85800f019dbf76f5a36aa5083f57b2467b0c08d603d40412477e189ab6e1fd8564398", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353645, "uuid": "92a8b28f-2379-443d-a361-6696326e747d", "value": "T16C1412083128A301DC73DDF0AF17C229C521EEAE5B24B57E1B68BEA8247757D140CADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353645, "uuid": "b77abc09-c5e0-430c-8176-ecd29aa6da05", "value": "3072:PbpX6XIe6YYChBidpatjHNDpku5DkaOrf+88Wz4/OmNoujFvCUs1xsBP8t6:Dl6Blid8tbNFhDkB2lbQUs1Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353645, "uuid": "4c26a361-5e59-4e37-ba8a-fd7261faf526", "value": 190600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353645, "uuid": "7ad3833a-7139-4480-8752-4101fa1d12ce", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353645, "uuid": "3e11449c-fcff-4145-bd0f-ba3f96a2eb60", "value": "PO_ W2214300.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a84eb8c-a473-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1647357508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357508, "uuid": "66c88d57-f463-4ed2-a9c5-4a55aabac671", "comment": "Malware payload (OskiStealer)", "value": "76734690b1107d43d732f6d981997147", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357508, "uuid": "a20a8594-f2c9-4055-91f9-2e0be0580f31", "comment": "Malware payload (OskiStealer)", "value": "9ac0322714806d2e922280dc9d59622656f1d0f682cf093df8505022cd631da0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357508, "uuid": "190e300d-9a26-401d-a38d-3bc85f2a90f5", "comment": "Malware payload (OskiStealer)", "value": "4e0d14ce3ea36f9eac0cb61c59f07c9708e7a81f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357508, "uuid": "fc84a63f-5460-4867-8b42-5c4e32b407e2", "comment": "Malware payload (OskiStealer)", "value": "45db1904b62bf12170b03e3052e295bc8c82191bb5cd149a4e9c7d04c0f76e7d91cb8a4f7567fff9091ec10b21256a68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357508, "uuid": "71adbe1a-631a-41c7-8600-c71d2281c595", "value": "T14A059E667390C536C5321AF48E0782B8215DFD799D18A8463FECFE497FB52C22C2625B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357508, "uuid": "72f30a38-2ea0-41f8-8757-e9c92c8c144f", "value": "8fb8f661cf68b470434b4ce11c0f8cb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357508, "uuid": "d3902dd0-3dd7-4841-9450-e1fd8abc560f", "value": "12288:6C0ONbdsEPpzOXGEfb4rjn1hDjJzl/jRIlRfkC1+ZUROM:qcdOXGEfbw1hxhe7fjCUR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647357508, "uuid": "760f2776-18a7-42a4-9fca-722d2a271abf", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647357508, "uuid": "dbdc6d7f-dc60-4bc7-b167-9210950c9c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357508, "uuid": "ed359b7c-3565-462f-87ec-b1025ca3a850", "value": "76734690b1107d43d732f6d981997147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65be3b93-a44c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647340857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340857, "uuid": "fa976da7-5ff9-40e8-bd55-3f63f195f544", "comment": "Malware payload (Formbook)", "value": "20a3a5750dce13373228cc5e85e469ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340857, "uuid": "89968b0a-530d-4abd-ab54-da4f927cef5b", "comment": "Malware payload (Formbook)", "value": "9ac626aa27ed91a3d825388f32d02778a0486e8646fcd9a672c29f3ca6f09e56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340857, "uuid": "f9e406c3-2ae9-4466-8062-cb236b837b1a", "comment": "Malware payload (Formbook)", "value": "8c0387e0cffb83ba164aa422f8a1020c7303e1de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340857, "uuid": "44f3d28e-fdaa-4184-8e15-b484206e85a9", "comment": "Malware payload (Formbook)", "value": "f2b96d136b358bcbf9b884cb7d6639a3ea50c9c1ea7bfb6cdb077a4ffc6cd2aba2519d6bda06f55351cbe9031f9cc3d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340857, "uuid": "3bfcb79a-13eb-44ff-9f53-253c3ed69b03", "value": "T17F64231F76E1E0BBC88888741275D36DEBF8E2842A7392DF27042CA74C954EB46774D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340857, "uuid": "9967ac66-358c-4929-8129-886742cdbfce", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340857, "uuid": "0fbaaade-f936-4a8b-af70-cd21cab4bca9", "value": "6144:rGiUCgcBAcKNoLn/ZXzwb3wua7AvqeKn2lFUsMGEm5bCQGw:ACFBfEA+Uuvqeg0/57Gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647340857, "uuid": "dfcb47d6-2dc8-4ff4-8ee1-fd935a0897a7", "value": 306751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647340857, "uuid": "798a21e4-b8f6-4d52-82f8-480f5db54e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340857, "uuid": "4c53f1b6-2d8e-424c-9968-b87b6d258467", "value": "mammu466563.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ada097-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647353047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353047, "uuid": "ed8bed9f-d7a9-42d6-91a1-b76de51c0037", "comment": "Malware payload (Smoke Loader)", "value": "4e3789cb8b0ecc6c475ada81caa6e704", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353047, "uuid": "59924dd3-ea49-40b0-9919-1b93973556dd", "comment": "Malware payload (Smoke Loader)", "value": "9b156152fd69aa8bd19e5a7717275dbc89404f584852d89b1e60c408de7ed657", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353047, "uuid": "dcfb5ac5-3a7e-4da8-81f2-3f527891027d", "comment": "Malware payload (Smoke Loader)", "value": "975ff52434f840b23114fe54ec07b9e3eccda144", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353047, "uuid": "00a1170d-65ee-4966-9bac-d61b019cf9d0", "comment": "Malware payload (Smoke Loader)", "value": "cd777f9467e94ff872ea45f448a909d4e1193b230fc228e71a155ae8efe023e8181bd057ce601081ccfc4f52d72e1266", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353047, "uuid": "945cbb27-df5d-4c67-8296-5fd71d688584", "value": "T1A3547D10BAA0D035F5B716F8497A536CB93E7EE09B3450CF22D52AEA56356E0EC32707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353047, "uuid": "b943651c-0be5-4cdb-bf2d-946d28989588", "value": "1a72927bac711ac16868d3b02bbb2c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353047, "uuid": "ef881af5-0651-4d67-a486-701b7355d183", "value": "6144:+r1Y+ck6/WlYnTqirGTTu1joObu7Ie2xRJiqbdIYvZrs/q:+xY+I/KYnTqirGTC158KRJ96Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353047, "uuid": "2a441d63-c06c-4246-8bb7-e0304fbf25d6", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353047, "uuid": "12c88651-622b-4e10-a77a-1bc2ec4225e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353047, "uuid": "7ae1996f-81d8-4985-91bf-28474f82a9d3", "value": "4e3789cb8b0ecc6c475ada81caa6e704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37552011-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647354523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354523, "uuid": "6063ccab-1cf3-4fc2-89c2-4748f9e84e5f", "comment": "Malware payload", "value": "9039d768b43fe36778aeb62dbb12f481", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354523, "uuid": "5f811611-7668-4273-8f64-e088c58a13b9", "comment": "Malware payload", "value": "9b981f99acf6031b6369e89a19209d8f83f54de1f9558e94c2097a132ce9cc45", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354523, "uuid": "f5131ece-b3f7-41f6-acfd-008f8e9eb7a3", "comment": "Malware payload", "value": "19cd1b08533c4801099f37d9c0f55a4d3c081cce", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354523, "uuid": "e2598b0a-6b08-4b91-9903-df42cd73b128", "comment": "Malware payload", "value": "49c6485adc2fdfce2129562179819bdd0e5bccbe55ea3588dd33ec5adcb67d7027e3cdba06c33deac63cedd64c9fd199", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354523, "uuid": "c5026b8a-550e-4d4c-8a55-f6a1b2ba5dbe", "value": "T1F6016DB125A9C2654EB0C227F53B69D75330C1A660F2E2EC648E814EA2E5184DF607E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354523, "uuid": "65ff8e8a-c4b2-46e3-9a78-0d9a40ea8cf8", "value": "12:x3voQByLsKvzwMO76JohgesFskSX7KtnGyhnGQnG2nGmSRrF7BA4qkz6gtL:x3QUyL1zwMI6ChgeKFk7KwnBL9hBF6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354523, "uuid": "73dbbab7-6f68-48b1-80cd-965f81c38d65", "value": 760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354523, "uuid": "894bc307-dfd8-4e5a-94d7-c3854209ac8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354523, "uuid": "8211fb54-c2e8-4f94-a295-6dbd1a6d684c", "value": "VP2ZB9GJ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f619cf-a460-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647349694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349694, "uuid": "5beba482-9c36-4bed-b064-1d40299fa2e8", "comment": "Malware payload (Quakbot)", "value": "d424ca5445f8b5ca64fc0b306ce948eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349694, "uuid": "ae2d5433-d01a-4995-b9a2-032e94efedc7", "comment": "Malware payload (Quakbot)", "value": "9c47896eaa27c1ec31c48af31a42af85646c6311d6c2f17e20840be756ce77bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349694, "uuid": "d70820e7-abc1-4065-8111-be21a630c235", "comment": "Malware payload (Quakbot)", "value": "b0c5515eed81a2ad74467c0519a055e6efd6064c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349694, "uuid": "d0fba7f8-dc08-4792-8807-5dd629bbc5a6", "comment": "Malware payload (Quakbot)", "value": "7ccab3af074bd130fc0168bb20856a447da37bbb41951a11e281e737bc6593c877eb9e6cc67ab5a34f4719a9868fc012", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349694, "uuid": "0f8d1a42-82c6-4e84-842e-50104fba8c27", "value": "T1E615BF71E3A014BFD1323ABC5D7F33599D263D012928C48967D96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349694, "uuid": "11c0f555-2635-4f93-9d54-8597260c47e3", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349694, "uuid": "50a653b0-fcc9-4b6a-931c-e30653e64900", "value": "24576:86BseOd1eQ/n+Xz4oA9bDajPNI5zvpiGaT8:86toeQ/+rAdDa7alpiGM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349694, "uuid": "e219ada9-f7e5-4bab-9b4d-127ceab66aee", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349694, "uuid": "f5dd5de1-108a-4be9-942c-c8ea29e803d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349694, "uuid": "c8fd7ff2-c600-4cc1-bc04-4945fc64d511", "value": "9338160.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bf1009-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "e3b9c42f-6ce5-42f0-98b9-ad6636bcc8a1", "comment": "Malware payload (Heodo)", "value": "7f2028254d142754376660c1e4b8c960", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "733b70c9-ddf9-4dfc-8de2-35539c36236d", "comment": "Malware payload (Heodo)", "value": "9c55c20fc12655d50832fc3bb3fdeb272c8d1a6e017bcddb28ccf92ff6fc29af", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "8f9aecd7-7348-45cb-a8ed-fae9146e053b", "comment": "Malware payload (Heodo)", "value": "7bfc19727c39da8bfae597421fc14e3c2962db77", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "d077a92c-024b-45bc-ad1f-12ccc9291c92", "comment": "Malware payload (Heodo)", "value": "2d079d6befa49965e3c3bcc61e45537abf0fbccad3d4657c2b683e110a6fb083cd85db0e9213e6d1e64089596239e118", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "5aa48ce8-3834-4903-b2f8-983f725d1e33", "value": "T17E256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "fc9fcb18-0066-4d3b-8523-b5351bee2323", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "48a71ca9-7970-491e-b737-c681f6074b5e", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk19WGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6/WeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302838, "uuid": "5ea8ba89-bcba-46c0-84d4-1af1d8be22e2", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302838, "uuid": "a1727518-717f-4ef5-aa68-9e812ae481e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "5214d00e-191f-4b22-9d93-371a8412a189", "value": "emotet_exe_e5_9c55c20fc12655d50832fc3bb3fdeb272c8d1a6e017bcddb28ccf92ff6fc29af_2022-03-15__000709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de273201-a4ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647381861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381861, "uuid": "37e5f216-8959-409c-8480-531f3b7e2566", "comment": "Malware payload", "value": "9d0bc2709aef90cf69408d3e0d2b9274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381861, "uuid": "bc3e2194-6868-48b4-81f1-79943526a22f", "comment": "Malware payload", "value": "9d0d6436e90b210bd26234c6e265712700b8057b3f49db46337d83ab6b9b1427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381861, "uuid": "33614ce2-488d-4c82-8698-f14d25acdf9e", "comment": "Malware payload", "value": "d5ca131df8ced9a3116b62fa2f5b687babfe7065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647381861, "uuid": "2896ba4f-ef2c-4c48-a0d4-eeb0d020f34b", "comment": "Malware payload", "value": "8c8e8ddb5d3c2a46c50157d9445305ba9fbbc1ca4c34e995397741dd99e69da168830fda53dbb9122043fd4f69d3c2e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381861, "uuid": "742f208e-92f1-4599-8b9e-4b14a0ba0c87", "value": "T16756F7233A819273C49C1C36D4819B7F456ABE3346135D27F2A6A65F0F3B3B14A762C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381861, "uuid": "35a45c4c-83b9-4137-b256-2f90eb0a8898", "value": "2d079e67ec3c8cb76fdef6be53c3af0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381861, "uuid": "c48d39b3-eabb-4554-999d-32b459dc62e8", "value": "3072:+D8WJnu1zNSTeReJ3vbNLWADjti550jm6:+D8WJu1UTNLtDj04P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647381861, "uuid": "d6ea981f-397a-4729-94a2-00f0477ff85c", "value": 5948343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647381861, "uuid": "7033d79e-0093-44e7-9279-4e0e6cb58775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647381861, "uuid": "71741ec0-6da7-4073-9b68-83fa8c990285", "value": "9d0dbig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b422200-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647353321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353321, "uuid": "110a1fde-3b41-46ec-ba08-e241516f8f60", "comment": "Malware payload (AsyncRAT)", "value": "881bdb65541039b84660ea9110721e8b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353321, "uuid": "64e60f19-ac1c-4702-970c-7770759b8329", "comment": "Malware payload (AsyncRAT)", "value": "9d4dde887284965c3da6bcacaaf612544dc56fa72898d10d1028b006023bcf26", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353321, "uuid": "69c30be8-deca-4949-afc2-27373b94c71c", "comment": "Malware payload (AsyncRAT)", "value": "006488987324324f2b89dd58c743d86a29f91ec6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353321, "uuid": "1f67f73e-3373-4a2c-b17b-92c9a583a485", "comment": "Malware payload (AsyncRAT)", "value": "72abbada5e95f4f59df80f213979a08d84e194ab783dc006fcb6217c7540940b3b0e2e253c9e4515a7d11ab9f2fbdb2a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353321, "uuid": "2895f600-df1d-4b14-a111-631e19a033f7", "value": "T1E9427C3466B87897EC43C079D939FDBA53E6F86606CB6A84735DF8E10B6E3005423495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353321, "uuid": "26215531-4068-4c05-a408-8f627e5b17fe", "value": "384:f1b4hnmVmXdvZ5An4MCMMkMMSv9WdxKWBA3wzw0:faN6mXdfIkzkdzdUW+3Aw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353321, "uuid": "1560369b-428d-448c-978d-e7d3b7ba81aa", "value": 12622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353321, "uuid": "82ac91ee-5236-41ee-8835-76331d26e2a2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353321, "uuid": "cb584450-665a-4e4f-898a-cafc26113df2", "value": "Fancourier 09032200754RO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2f9ddd-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1647353080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353080, "uuid": "38b5dd29-77de-4b9d-a71c-b6b3ae1621b3", "comment": "Malware payload (Socelars)", "value": "57dbdc6ad5984a1a972a05738565abbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353080, "uuid": "597b6004-56a9-496c-9b2e-29dcdbe49f1f", "comment": "Malware payload (Socelars)", "value": "9d659813d569ecded047daa2b467718da3bab2a546b220194dcf43eb3969203a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353080, "uuid": "41a5b1f9-658d-4482-905d-9cef470ba3c0", "comment": "Malware payload (Socelars)", "value": "e63a9a2ab91b21a8497d0290ab4facc8fd0743f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353080, "uuid": "fdcb663b-085a-427a-94f1-8cb2ad59514f", "comment": "Malware payload (Socelars)", "value": "6bd586c6f328f96dbe67944ccbe904923924bfa395b4cfcbee84a61ee5382e3b796b84c557d29e0046b063945a9600c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353080, "uuid": "8e4fed15-bed8-4845-b79a-176cbcfd832a", "value": "T1D0658D11F6426036EDD3107292BF4EFE9D686D12030494E7D3C47EAA9E725E2363369B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353080, "uuid": "f77332bb-bd0c-433e-9772-b2bc7d0f0471", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353080, "uuid": "3b455899-04e0-4d6c-8ab8-d8c697f9c49c", "value": "24576:LKAgpBGV2HpWHuREjDnI2AuADZ8KvqC7mH2dtDPc/dBKFXMg:3gpG57R8jnDPc1BKxMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353080, "uuid": "f9b6d42c-952a-4379-ae87-8ddae496e1d8", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353080, "uuid": "93904eb0-73e6-42b4-91ee-853d753e3ea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353080, "uuid": "b4d06652-32d7-45d2-9940-03cdcbd10645", "value": "57dbdc6ad5984a1a972a05738565abbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a16707b-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "426c65ea-e0f5-4c3d-97b3-6b0e35d435b0", "comment": "Malware payload (Heodo)", "value": "964eb180db6b4b3c0cd758695eb4a0ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "60b4bf8f-1f2e-4953-87d6-5643b143ee52", "comment": "Malware payload (Heodo)", "value": "9dfc8bdb4edd4181e916f5e2a131ef379a529bc2da83c7d6d5c7881bb54d960c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "d9f9f71f-dbac-4521-8308-a9b1ead2b1ae", "comment": "Malware payload (Heodo)", "value": "8f364400532439c506beacd6a1360a4baa1a87a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "a25ba8ef-2f67-431b-b6bb-6c08802d8cb0", "comment": "Malware payload (Heodo)", "value": "4c78737460f0cbaec6feaaf59e8b80963a35aa2a5b0f84db539191d9913a99f56ef2553b971c07e1a45f92f2fadc983b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "5e607b15-451a-4984-94ef-445cdd221141", "value": "T19C256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "5706cef7-89e3-4dd1-915c-65086f98a96b", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "0160a43b-febc-416c-8fdf-60f7f21ff604", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkEwLBeUNKsuG31Pt8H:3dlV0EnITKwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302693, "uuid": "4dda0e0c-6d27-4021-b14a-87acc9b045d8", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302693, "uuid": "4d9edcd0-bf17-48cd-87e7-eda54973b516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "1e9eee74-7ff7-485b-93a1-7197e8b74ad1", "value": "emotet_exe_e4_9dfc8bdb4edd4181e916f5e2a131ef379a529bc2da83c7d6d5c7881bb54d960c_2022-03-15__000446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e2771f-a49d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647375645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375645, "uuid": "bd1cfab9-0e8a-4a64-a59b-8f64dff545a8", "comment": "Malware payload", "value": "27206c84d664d753e21fa6e3d0d29a38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375645, "uuid": "8264e3a1-9d48-45d5-8d44-2a6f7f63701e", "comment": "Malware payload", "value": "9e42d7816c72f09c1ad64e8411d409c3d093614c6990092b9dec6b4fe94e4942", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375645, "uuid": "701a93b5-78ac-4689-bbd8-bccc99d93e8c", "comment": "Malware payload", "value": "f9c3e453e960852531d5db0f3e6e74dea9d1751d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375645, "uuid": "2c68d208-c3a7-40a4-92b1-2dd0e5b4915d", "comment": "Malware payload", "value": "951d95da53de29356cccf9621838f75d328d807eced8a6972aa052909c8d93ae7065a54d488a74bb43431ca445cca06d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375645, "uuid": "efdeb71e-a100-416b-ba74-c04315baaf7c", "value": "T13DE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375645, "uuid": "5c716230-e773-4533-b04d-416f93e0e7a0", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375645, "uuid": "5f1cd786-6988-456b-bac1-7a5d4aa2cfbc", "value": "12288:E94YBCR2xP7guDo463OP4e/siSOZjb2woE+MhJT:2kRAguDogPbddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647375645, "uuid": "10d5a757-1862-490e-bef4-757a66b30bee", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647375645, "uuid": "be0735e0-9070-40dd-9add-b0205386d845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375645, "uuid": "510f9aad-5dde-427c-8df8-4c793a3bb758", "value": "27206c84d664d753e21fa6e3d0d29a38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03252dc5-a475-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647358301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358301, "uuid": "365c4d1d-874d-41b7-9b97-5261d7bbbb63", "comment": "Malware payload (RaccoonStealer)", "value": "793caa95f7e961bd74b782e4f5d96780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358301, "uuid": "153ea128-52fe-45c8-9f12-3f03a2a4cdae", "comment": "Malware payload (RaccoonStealer)", "value": "9eb980a3a65d550661eea3c2de5c763af6993f4da16ffc0aa80202a48748d231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358301, "uuid": "275b56d6-1884-4680-a0c0-28dac204c4ad", "comment": "Malware payload (RaccoonStealer)", "value": "5a91f5af87b2423276b8befbed75aac0c51a7b15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358301, "uuid": "28cffb88-32aa-44a2-8d10-c2fc7e683e7d", "comment": "Malware payload (RaccoonStealer)", "value": "70089d8746812ac015fc8b1e6e64f8fa4505485ad0a29299168aea948fffa44fae43ff876ee2dc324bbd99ff3f03b904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358301, "uuid": "da27de24-85e3-43ff-93ee-4661a3fbfbc6", "value": "T1BBB4E100B690C035F4B716F418B6A368A93E7EE2AB3090CF63D57AEA56346E0DD31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358301, "uuid": "3eba83e1-6430-4208-83a5-04126ce53471", "value": "0bff565af25c1bc5033321ca0bc710a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358301, "uuid": "6e836e5d-a55c-4c8a-8f5c-deb06ba38010", "value": "12288:7/fJGQW1SMIk/4vdv6iKx+T+ezc1D3FhIEPltx+JyN:VGTSMD/O6ia+5zct3Fh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647358301, "uuid": "048a2bc4-ee61-47b2-90cf-4b69f2aab756", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647358301, "uuid": "921471d5-36e0-4d4d-b411-4f5501882f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358301, "uuid": "34d87f4a-b166-483c-b825-2eb6f3fc1db8", "value": "793caa95f7e961bd74b782e4f5d96780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2cfdd1-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647353595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353595, "uuid": "f2391eeb-f8bb-4a13-8507-22d5f465bbbf", "comment": "Malware payload (Loki)", "value": "7585b780b2970fb7cdc5a4778e34a8b2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353595, "uuid": "93ffb72f-d53d-4337-8f65-eb627e4824a2", "comment": "Malware payload (Loki)", "value": "9ed47b5a6eedc8fb6845617c9a64319a19dc42191ca4436a8aa7815772c84f18", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353595, "uuid": "16e4fcba-f433-471a-afa0-4e8d2692e394", "comment": "Malware payload (Loki)", "value": "dbce1709ca7f15dc43138e7588b3d264835e262e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353595, "uuid": "b0d1adcf-ce5e-4a79-948f-ef2700e41cef", "comment": "Malware payload (Loki)", "value": "e548ca0c94fd8d2f51f6467a8d75606cf46e68efe3e0a03a320915c5552961a38651dc056bff4c336bf2b4b55fa4fdfb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353595, "uuid": "d3ae7845-4b86-4e64-abc4-c22cb909687c", "value": "T1B2141209710B3AAAF2AA49FC992DC5D43B7BDD49230F4ED5DEA6363C147192B301CC89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353595, "uuid": "a6bc46ea-cf46-40ea-890f-6853a06aea02", "value": "3072:U8lGTj3sTic653iyZIQ9Xvt1xxiUrDPBHroboqlbSm6QVQHVeo6j2G1bq0:oj3sTic65SCH1mUPN25yQToUtq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353595, "uuid": "108feeb7-01e5-4687-ba2d-de18cfabd547", "value": 190472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353595, "uuid": "89e45bc1-e418-4a6b-a5f1-96a17cc05468", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353595, "uuid": "8bc02660-4158-4bcb-a957-dd64cfd07572", "value": "INVOICE & DO 220098.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b440e67-a45b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647347147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347147, "uuid": "caa1142f-6e5c-40b6-bfc2-278c4478804d", "comment": "Malware payload (Heodo)", "value": "ce69a7d9b0686f1474a16031dc7e80bb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347147, "uuid": "f1256800-6493-429b-9c20-60710735d914", "comment": "Malware payload (Heodo)", "value": "9f1a7d0dd24348d5ca701d77aa428973ab1ae3a33d0c0d089b49f411af21126e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347147, "uuid": "3af3634c-7e80-4ecb-9b6a-c88e7b2bf89d", "comment": "Malware payload (Heodo)", "value": "ca22b8e787c9a95d2507fe0b58d7f3972b5a6286", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647347147, "uuid": "45ef7352-5c7d-47b1-87cb-922b45b7cfda", "comment": "Malware payload (Heodo)", "value": "c2a0c13cb1d7441c736624066438ef580388b9caabd7f2d8957cba1ea0d266dd996cf7ddf0d35f793cc06ec98be51d64", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647347147, "uuid": "f9c50c44-7516-427d-bad8-df327c79d621", "value": "T12833D00F9A22B5ACC3136C3CCA8C55F9650E5592A0C9F72B08857B9C7B1B1E7179F282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647347147, "uuid": "18962ba8-38d1-4d63-a66c-9b0c8b80da2d", "value": "1536:kkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:9cEe2Kd3zdtdEwo/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647347147, "uuid": "f5370b84-5185-43c6-b731-3985da6dd9de", "value": 50643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647347147, "uuid": "6dbc8e5e-ae47-4c33-935a-c96135c00dcb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647347147, "uuid": "befbb65b-f88c-4083-ac32-91910cecfa88", "value": "Invoice Copies 15-03-2022_1456.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57dc6cc-a493-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647371565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371565, "uuid": "a2b440ad-d239-4c72-bf2d-ea4618f93f1e", "comment": "Malware payload", "value": "dae7f23e07d7e741ea4c3e9279d709ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371565, "uuid": "e6669565-176b-4bee-bbd9-281f28a8b0ea", "comment": "Malware payload", "value": "9f514738ef91e49d1d6a170adf47381bcdcac08c99a12dd5036d45645e2bac16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371565, "uuid": "f93886f3-a127-41b9-8fd9-657d2598e3f2", "comment": "Malware payload", "value": "9bfd705640d1c34a26842d49e2e66c73c26c9a37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371565, "uuid": "dc57498e-6ddc-41bb-b848-0ebd582ffd6c", "comment": "Malware payload", "value": "591fd5a175dee2e67f59211850749a8dfcdafd9958119fb83aae4e9149a981e8f4eafd627ee8a84499c271945e95454a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371565, "uuid": "c2a29777-1ca9-41c5-9f16-6c4f0c8c8d68", "value": "T13515128AB2E8ABC3F477CBFB8865160483B6B1692519E3491ED570CB05F3F408799B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371565, "uuid": "7f618508-f1b0-426b-be1e-814509325da3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371565, "uuid": "61d5cbbd-0a4a-4235-9b4e-6d330daf21ff", "value": "24576:7m7wOn5ZVVLGkzYgNPNiRWqjHYmbZZv8+o9:76fnrVDZNPNicqjHYmP81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647371565, "uuid": "345e83a6-98a8-4862-bf7e-db56e20f9aab", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647371565, "uuid": "930698fe-ee67-48f7-9b00-cc9aec2f21f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371565, "uuid": "4ca39012-a05b-43f9-b17a-6e2ec57ea64e", "value": "RFI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e729fae-a42c-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1647327101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647327101, "uuid": "0cc667ee-0a8b-4585-af71-ff2d4445ab54", "comment": "Malware payload (AZORult)", "value": "a5669a3c8acad2ac38e73306066edecb", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647327101, "uuid": "851a7771-0f5e-426b-b7c2-bb7b61547bf4", "comment": "Malware payload (AZORult)", "value": "9f6a8cf503fa963fca29cabcadab8cd6fb9dd99387a0a67fb81f9b15fe4ffd94", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647327101, "uuid": "426819b8-1601-4971-8dfb-d5944bdabf4d", "comment": "Malware payload (AZORult)", "value": "484046726d558f448051e5bb73e2b531c2c45246", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647327101, "uuid": "eae9debf-22d5-41b6-8e9d-c92465ee7244", "comment": "Malware payload (AZORult)", "value": "af6ef131a1ca59eb22a991a6217b62d9f23d7c6e845fec6e584aa1e4225f0b330efd698d917944de9913497acf580dbb", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647327101, "uuid": "134a3aa5-ad0c-45b4-8613-b5eea52fa834", "value": "T183B4286E667255A6E7DE44308F5C7A2C2B93562C0CAF32C1DFB71A54F216133762C8CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647327101, "uuid": "40c60b46-a8a8-44b8-90b1-d3aa2b8b4365", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647327101, "uuid": "b0c7384e-b52c-4e7a-94d5-b2477cbb8375", "value": "6144:SGix4s6JSSgUi7a59ZghIGtQzhZAFKB1w3nr5GttW3NaVQ8T6FEcPAs8DPI9bfEH:URozXA0B1I5GtU461FEcY34zErw53OX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647327101, "uuid": "3ce877fa-059a-478c-b733-595b34dcf8b7", "value": 528435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647327101, "uuid": "f2030eca-824c-4924-a63c-bd95bdfae5a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647327101, "uuid": "14e620af-fc0d-4761-acc3-133ac2ebf9a2", "value": "ElsantuarioPurchaseInvoice2008373745.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37cbdbe-a474-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647358274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358274, "uuid": "ef0a0b47-3322-46f9-93d4-63dda78467dd", "comment": "Malware payload (Formbook)", "value": "00c6d5c908902b425d518d8b50ef54a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358274, "uuid": "a30625c0-ef59-4a3e-b1d7-bc62f83b262a", "comment": "Malware payload (Formbook)", "value": "a045f05076f6ba87c264a104517f72a16e629fc713fd6591078d46b14776ad1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358274, "uuid": "94c70e82-b37a-4092-9514-c9d165f21769", "comment": "Malware payload (Formbook)", "value": "02950b417b690aec2fd4976f08353c37ee616030", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358274, "uuid": "cf45c7af-7d0e-4992-a36c-0534c9a71359", "comment": "Malware payload (Formbook)", "value": "9f715099ab218faeb70bfcd7a13ca34f9536715e2ab8cf99e0ae2f935b3b697a309647059463a6d4a8b356ac790f21d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358274, "uuid": "f6d66e0a-fe2d-4371-b90f-0497174d1809", "value": "T10B74224B9FD80C9BD4E14A7509F6AB38E7B748EB12A7112B37F42E97C1315D1CA016E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358274, "uuid": "ab80049d-d7e3-4383-b6fb-4fe5ed74d214", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358274, "uuid": "0a116b65-e55f-442e-8dc7-878ae73763dc", "value": "6144:rGilrzRsLO1u0b9Bebsc3DyKA0p6WYrvsnpdH9/11s0rI:Jzmyug9BeF3DCSTqsPH998", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647358274, "uuid": "b4b0dd28-8d37-42f2-943a-777b4d9c1e2a", "value": 341258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647358274, "uuid": "9c3c9261-2896-435c-87b1-9ec35fc82153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358274, "uuid": "f3ab7cf2-433a-40c7-a8a8-d884a2d44083", "value": "00c6d5c908902b425d518d8b50ef54a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14f8bb0-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "749b01ad-4127-4f5c-a21e-9b04c8a72a5c", "comment": "Malware payload (Heodo)", "value": "f0880e3ea0793da06d7e52ba3c4ff779", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "1aff88b6-bb6b-46b3-979d-5e4950c95fbb", "comment": "Malware payload (Heodo)", "value": "a0ae4400d42b676093948fb85bf4f8378950457c1e9b1c56844c3cb164971690", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "08351983-9121-4d47-a94c-250f03a225eb", "comment": "Malware payload (Heodo)", "value": "a0e0f38380c0f852004e84cfd7d224cd639d7fd9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302839, "uuid": "c7996bc5-3ded-4bc6-8ebb-11d8e6ff4f4c", "comment": "Malware payload (Heodo)", "value": "0bc9fa7fb855d652b40a71f557a7dee57c44d56303caf912d5c6c2da85ebc40f109be5f72f79fc849641e6e1f468b9a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "0c4b1003-aa81-46ab-a0d8-42332b40dc08", "value": "T1C7256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "d0a44e47-3753-44d1-a2b9-5491e3cfece2", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "5311bbe5-9551-4912-bc84-7265c736e327", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1oWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg66WeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302839, "uuid": "a30a2dc5-6bfc-44a8-af8c-d4e58fe692fc", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302839, "uuid": "a3cd140d-0d61-43be-9395-083875cd963e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302839, "uuid": "5f2fd40b-4981-4306-9bd2-358f9d3b8675", "value": "emotet_exe_e5_a0ae4400d42b676093948fb85bf4f8378950457c1e9b1c56844c3cb164971690_2022-03-15__000711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109c7fbf-a468-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352740, "uuid": "4aace270-8c54-4e85-97b3-cf23b078dc51", "comment": "Malware payload", "value": "315f55bbd8340be95bf207dd27228bcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352740, "uuid": "6116b6ea-35a0-4f95-8d10-2a607ec0de63", "comment": "Malware payload", "value": "a0bcb395c41090083f4b7612c10cb109ca668265b8fdc666dc44057726a91ce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352740, "uuid": "dddec813-02c5-4655-8639-bb74ea8d5884", "comment": "Malware payload", "value": "7ccd9d848681f0c954905758d6cebe24cc3cedbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352740, "uuid": "3210283c-ba98-4987-872a-565dbd0e2966", "comment": "Malware payload", "value": "ab08481aa283f8440cf30c486be2aa1a17715f1d980a8273a7e0a57be834d9e94faeac3693ec0280f928d4b69d35965c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352740, "uuid": "4d604bb1-ea7b-423b-bc81-ac269008d822", "value": "T16C350120B6A0C035E5B312F544799358B62E7ED1AB3885CF63D636E997306E0ED3274B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352740, "uuid": "7e83945f-5ec1-43da-8297-1ad828ec812f", "value": "6728da03e60bbe718ffacc65d5c92de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352740, "uuid": "af40aaaf-1fed-4282-a77c-2549fcafb7d6", "value": "24576:6nGl4yEOz9JCnAeGvFdK+XK0Js9Rcgc4xX70:r+CJQcvFd6J3170", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352740, "uuid": "c960f93d-3079-45b8-a18a-3fbf1a599ff1", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352740, "uuid": "39de87eb-1292-4fd1-af63-62acfc64e07b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352740, "uuid": "5f0d4a38-e4e5-4a14-a095-8557bc686cdd", "value": "315f55bbd8340be95bf207dd27228bcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d1388d-a473-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647357533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357533, "uuid": "13bfdc4d-a98e-4b7e-a485-4dc99289a8d8", "comment": "Malware payload (AsyncRAT)", "value": "f0fc87cd7409e7f3a58c2a76244b7dc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357533, "uuid": "1c486ce5-9360-4634-ad60-1225bee4c281", "comment": "Malware payload (AsyncRAT)", "value": "a1010140f708dbc5ac52ef146bc31220d4b85e4623f2d29fddf2c302c77e9f6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357533, "uuid": "0cdbb104-e45a-49e4-8393-6edc39bd820e", "comment": "Malware payload (AsyncRAT)", "value": "e7895424faef93fd015026a145e095be149b9df4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357533, "uuid": "4cdf4ff3-4187-4ba4-8d7f-7f94ba713ed4", "comment": "Malware payload (AsyncRAT)", "value": "3356b679fdd609a27398a06d225b6a32af6bc38a7f7f0a17bb5b4240abe81af53fdb5e875f4f67a3949f582ea52eefdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357533, "uuid": "7b58d527-dbf1-4654-b287-41c76667f63b", "value": "T12FB47C3D8F5783D3D9626F7FBA7206A513C8DD22986382233458BCEF757B1AB4641086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357533, "uuid": "b851a5fa-6221-40fe-8eae-c8770708fcf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357533, "uuid": "ac3c3bc2-935c-4185-b64f-a9b4cb526cea", "value": "12288:pPT4WiIBTknhEKVfJDYUb3eoTE3ME7PrGS:qSTTKHY7T7Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647357533, "uuid": "32cd28b8-60e8-403f-8b63-be8a1fc1d0b3", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647357533, "uuid": "93e100f0-84e4-46fd-8adb-5946ae578aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357533, "uuid": "4897385b-f2a6-428a-8342-1bdc5ad8c392", "value": "f0fc87cd7409e7f3a58c2a76244b7dc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058f9252-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647333823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333823, "uuid": "222518f0-a413-423b-a9ec-2814dc5a48d6", "comment": "Malware payload (Formbook)", "value": "2be8e81bfde8abf4bdae8cb44c6cdbe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333823, "uuid": "8dc76050-015f-4af1-94ea-4c6e4c3bfa7f", "comment": "Malware payload (Formbook)", "value": "a15521135ce72df5cc2d9a02d558558ee3c38e48025e806173f15488b49034f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333823, "uuid": "c1efaee0-f88f-44b6-95ad-dd68efd6bdcf", "comment": "Malware payload (Formbook)", "value": "611ee1652b4ce5c18f23ae8eebe70726d9f07537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333823, "uuid": "5fe0d648-a048-4ff6-a239-de1dd3786bef", "comment": "Malware payload (Formbook)", "value": "fef9c87c8eb7ed0cb64e1fd097747193b0a22785e0a210ddfedbd0a59b896808c477b136877293e560fe454594e9651c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333823, "uuid": "0fca12fa-5cb2-4da8-8969-dcbf4e369a6e", "value": "T10FB4D024F2395AE1D96D97788820952CCFD9E326D32EF16C2CB774AD40B1BCB0656E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333823, "uuid": "591854f8-6f16-4bc0-92e2-aa174f9199f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333823, "uuid": "c0302773-c0c6-4867-b709-b1aea760f0a5", "value": "12288:3DTRUcZ64yEyhOnX753mx4nIkLjkJ44L9tBWk:TlUx6X7lLEts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333823, "uuid": "730d0941-3c7c-4bbf-b7fc-a7579dbfba51", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333823, "uuid": "e4b80cb7-0464-40aa-8b61-f08329dd266b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333823, "uuid": "4f14487b-a71d-4faf-b9b0-32756f534df4", "value": "Outstanding Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc4d48d-a46f-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647356007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356007, "uuid": "e4d02eb0-290c-4bc7-aa21-b46c09af2516", "comment": "Malware payload (NanoCore)", "value": "15b470c89e951bce3984e21ae710a5c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356007, "uuid": "06df7389-3285-4c03-b303-1e8c8ca38a1d", "comment": "Malware payload (NanoCore)", "value": "a16fea865f78a7f59cda6592aa166a5573b95d16d20832bbf00137c6d121d961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356007, "uuid": "a3635239-d5fd-4121-bf42-2a142a529abf", "comment": "Malware payload (NanoCore)", "value": "12213d7fe83bddf0d4888d12cb103dd1bc0d29bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356007, "uuid": "0326f0d5-6dc9-43ee-ac9b-15bfcefb6fa6", "comment": "Malware payload (NanoCore)", "value": "9dbfd1881ffdab6b88e420f6d47ab658e7b441a408c1e7663c462546f0baeac5d2dc542bbe9a8443ad81aca31a2fe072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356007, "uuid": "669259d4-c897-4ce7-86aa-365729a8020a", "value": "T14825D0AC32C47ADFC663CE36CA641C24FA31747A6707D203A147059D5A5DB9BEE206E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356007, "uuid": "aeea7e94-2390-4218-af1d-ac0f89db04fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356007, "uuid": "734adb03-a5cf-49c6-aa4b-b54b52b54dd8", "value": "12288:0aSlXqH9oH3VnkwOEocEDWhMrOepDDzoW9HBK6Y2iemidD8J0ojHDbOhTcWumdie:7eXVkwOA4/K6Y2bmidD4fl/kghJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647356007, "uuid": "38ce66fa-516d-4b9e-802b-9f388a4079af", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647356007, "uuid": "68333834-bc4f-40e8-9182-7120fc1271a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356007, "uuid": "9af92643-f6be-4854-a13b-3ad09011260f", "value": "nzezx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930d7550-a486-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647365844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365844, "uuid": "b87e85f1-7b73-44b7-889d-ed9322a699fb", "comment": "Malware payload (Heodo)", "value": "5b42cc597076760df976efe3ace12409", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365844, "uuid": "0c611686-6955-45ae-b50a-97673b7c691b", "comment": "Malware payload (Heodo)", "value": "a1cd91f0af76c1329c8b6663fc5fbc06f3235a167522b2aeab850dcf3b41ae15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365844, "uuid": "1fe1a60c-ea00-4a95-859d-2fd689ddf8fe", "comment": "Malware payload (Heodo)", "value": "c988b4dfb2c8ca7d6d5d9f6af032cd392196720b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365844, "uuid": "74bf4f20-1cb9-45f3-a4ba-f81fc9a3173c", "comment": "Malware payload (Heodo)", "value": "e74d99a42b145bd63ab864ff3b925e2c272e14f4fc424be5828d9ecf7411479393d5677f1fc79265008c64fb9c6a280b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365844, "uuid": "7359f0e9-05d7-4ff8-9b26-55a00d83aecb", "value": "T188257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365844, "uuid": "a02370cc-f8dc-45d3-bb43-6e67840cecfb", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365844, "uuid": "46b6b324-e90a-49b9-8f2d-9d36cc2e898b", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKleOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8al65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647365844, "uuid": "f4872d74-2690-4b97-b2e3-35b8b90810e9", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647365844, "uuid": "0300b16a-54e4-4544-bf9c-5e3a3f5c381a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365844, "uuid": "2f30a61d-c83e-4008-904f-7c385ffc60a3", "value": "5b42cc597076760df976efe3ace12409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b86ad21-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647354449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354449, "uuid": "831b409c-61e5-492a-9243-169a129c4e42", "comment": "Malware payload (Smoke Loader)", "value": "fda89191c03f31849b3998a2029ec344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354449, "uuid": "e65b44fe-465f-4bf4-b15b-5bfc09e5740a", "comment": "Malware payload (Smoke Loader)", "value": "a26a9bc9ccf57336679fa059e5239f8f360a949f3a707af2ccc84269bfee7259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354449, "uuid": "c9e44554-e3cc-4913-902f-e538192c5687", "comment": "Malware payload (Smoke Loader)", "value": "43f78e50250661b0171d5aa5cbf15fa2a296ec09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354449, "uuid": "62a88762-17fb-4c90-8a6c-4462b7f452c5", "comment": "Malware payload (Smoke Loader)", "value": "55d19dd2c2d1864d5802eed3e06cd1d2802adebbbe06139c3c8a77bb7bc70dd7f0f595d459791e5b4be81cf55c21faf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354449, "uuid": "20e530c8-c843-4720-b489-dbe6debce27c", "value": "T161F47D22F1A28837D1332A3D9D6B5265982BBE013D38698A3BF51E4C0F3965179353F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354449, "uuid": "6e5d0919-285a-4982-ae1e-3b4cf0d17471", "value": "fe8fe697a2113c9983ebb64a3ad85165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354449, "uuid": "1efe9c78-d245-4bdd-8518-e840b5363059", "value": "12288:2S1PtiVzhCYsLMsmHZDkEIsyHzf80+uAZmi1mfxvv2PQKVUnTLvO+Y63:h1i3CMsmHZDq5joZmIm5GPQKmnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354449, "uuid": "115f12f2-7f06-4cf0-a60d-3067998f472d", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354449, "uuid": "4f74556d-621d-4a80-b9e5-32e3b3b02e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354449, "uuid": "b9cd39d9-930c-4ab0-be74-e40c270fcc0b", "value": "fda89191c03f31849b3998a2029ec344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56b9d24-a48d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647368935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368935, "uuid": "46fa4ce5-c393-4583-bd77-56d72cede590", "comment": "Malware payload (Heodo)", "value": "b7b406d4a3e54144586edd3dcc728ee8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368935, "uuid": "eeac7aae-3a12-4e7b-a532-baeb80b29a39", "comment": "Malware payload (Heodo)", "value": "a29767184c4d97aa244fc8adaeaaf99bd4e5217ca85b30a3a33cd70c1c0b8d49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368935, "uuid": "d69d312c-353e-406c-8c71-a1c83f1eb41e", "comment": "Malware payload (Heodo)", "value": "c82f1f5f153bd3da2da9c0cbe27a91716cd0da31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368935, "uuid": "72b5aa91-6e69-42b6-b41c-e28b8990831d", "comment": "Malware payload (Heodo)", "value": "48b12a6083d7751d1b3da2df90f78444c4ad56cc90dbe865f1e174f3ebdd959f6c56379e2b2f60a0b2790abf83b38897", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368935, "uuid": "fc2928ce-6ad0-4b88-a9a1-6947a3dd1056", "value": "T198257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368935, "uuid": "f81f2503-2e9f-4c17-a9a4-d56ade4d0ba4", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368935, "uuid": "2b57a541-296a-47b9-9883-0b3b70da6c5d", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYOVP6FuR6shQLj88F+Krf6:v6oycln8cACi9P68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647368935, "uuid": "0f7e568b-3d87-4432-970f-90ecd0fd0a3a", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647368935, "uuid": "95a3cb32-4d04-4b7b-9a46-d9a30252024c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368935, "uuid": "9340c8de-d0a6-4aef-8704-e5f94d6a5104", "value": "b7b406d4a3e54144586edd3dcc728ee8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d419128-a473-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647357539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357539, "uuid": "d3b1b456-895d-457c-ad3e-eaec30d1202f", "comment": "Malware payload (RemcosRAT)", "value": "6cfceeb676d49151e8c2fec9c4209789", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357539, "uuid": "f75cacc4-2b11-46c7-b441-fb9ab47783df", "comment": "Malware payload (RemcosRAT)", "value": "a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357539, "uuid": "5ec9ec1d-2c78-49e0-bfb3-9e69d1bd2439", "comment": "Malware payload (RemcosRAT)", "value": "42c87894f183c3612e1662f531003bbe7478f875", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647357539, "uuid": "bd2fc8be-cf49-4239-8124-03488c671059", "comment": "Malware payload (RemcosRAT)", "value": "878716b51643f70fcc9994ad05e3f95686c027255f33f80ca49205038b28edeeba960dacef6404982934dd824bf1477f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357539, "uuid": "2f1bbb81-61d1-4e81-ac57-ffdecaa0f0ef", "value": "T1E0D5336C49F729A9C987A43185A6E533A2583ED4A9CC2D876DFF3F27B8E550DC3C4840", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357539, "uuid": "7946284a-f3ee-41d0-87b8-b5fa6c03dbf3", "value": "01d1b984e99e67b6f7ae46199d7dfd92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357539, "uuid": "2fd28c01-8766-49c3-be56-595c2170ed00", "value": "49152:K9SRQo3DNrOKFcHxALBpIHo9HYdZvXYEj4UDEbVhqTig2Iug/xRNzacq:KMRQo3DNry23M80F4WyhqTi5Iug/xRN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647357539, "uuid": "9dad31c7-24bf-4a97-bc31-389e3fa44212", "value": 2904080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647357539, "uuid": "6df9385b-cfaa-4574-845b-e97696bec4c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647357539, "uuid": "23233b58-90ff-469f-b69a-e399f4f9e115", "value": "6cfceeb676d49151e8c2fec9c4209789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5b0803-a42b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326861, "uuid": "d8f7517b-5259-45f7-9213-c44161c13335", "comment": "Malware payload (Mirai)", "value": "fc249ff6e0015702a21e198861332364", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326861, "uuid": "6a6ed279-ec2d-4a3c-a0e2-9aa0d7f98c50", "comment": "Malware payload (Mirai)", "value": "a3a613775c9bc49d25556fd79d8aec7544974b86d0a831e0f1b682e474c4c3e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326861, "uuid": "bd0fd47d-6332-4e1f-b30b-059dfeddaaab", "comment": "Malware payload (Mirai)", "value": "b59ab0124de325d1b7a2be9706cf435adc473a9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326861, "uuid": "385374d3-a9d3-4341-8a17-35e5b71f1fa7", "comment": "Malware payload (Mirai)", "value": "360d768631dbfca2f1fabed616364cbee9b4cef7c64af758a48d463b80c0f9d73a0f3d9a0d0571fac10edaa6d419ca50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326861, "uuid": "37323235-8294-460b-a1fc-afc1dbf9c5b0", "value": "T10CC2D03E120B50F5DD23E1F760E957AB7D341BF99003684283D2B64ADE066A5B813FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326861, "uuid": "8e256b73-058f-4113-ab6a-9d01e8b6b5ae", "value": "768:6rPXYMwthCSLFgND6nYYtxUBJgGlzDpUYs6:szA1Li0yTVqYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326861, "uuid": "decc25df-dd8a-4e0f-bfc2-2286c2e49db4", "value": 26772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326861, "uuid": "c1f492d8-a820-4d06-b877-2f4461256230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326861, "uuid": "141e9e8d-433e-452e-80af-f690e318315f", "value": "SecuriteInfo.com.Linux.Mirai.1288.17208.16153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfad9c8-a450-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647342454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342454, "uuid": "424f1c6e-cae0-4a85-8e52-23dcf247fb01", "comment": "Malware payload (Heodo)", "value": "cd7d2cc4f8d12e2e6a4fb85eb4d58ab0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342454, "uuid": "c0da01ec-0896-416e-9b06-2afb0b4e66d4", "comment": "Malware payload (Heodo)", "value": "a3c49806a92fdb258321a30687c096b9013d7d31803c2349affe05b73d826816", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342454, "uuid": "75554a99-1997-4d41-9021-107baeb303d6", "comment": "Malware payload (Heodo)", "value": "9e864d7fa9613e1839d33be64f13f99a88829681", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342454, "uuid": "71b0628d-52d6-4e66-a5c2-e49dd715a644", "comment": "Malware payload (Heodo)", "value": "61e0c5c2cd1e6ecac84f0e2b285802cdc11130f0f0c99d69bc59a75e38aa9ac4ebd836ac111435a4e8f0a80d422506e8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342454, "uuid": "9ab466f3-38fd-433b-b7cb-5cb548d9b9de", "value": "T14D33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342454, "uuid": "32ec495d-50ff-4289-8ae5-b3a1ef233a1c", "value": "1536:4AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:hcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342454, "uuid": "036d7c84-62af-4df4-ab8f-6bd39cea8728", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342454, "uuid": "2ad65ef3-e760-4209-8d64-28ac42da4839", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342454, "uuid": "1c1c8d0b-20b4-4ce4-a2a2-bcb3fcf72f87", "value": "Rech 2022.15.03_1202.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86132266-a44b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647340482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340482, "uuid": "2c650ad1-0afa-4d01-9a6b-cadbca9b7f8b", "comment": "Malware payload (Heodo)", "value": "296fd758aded0b9406804a7ed74cbc23", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340482, "uuid": "cc595238-65db-4961-80b8-adcd7449f8e7", "comment": "Malware payload (Heodo)", "value": "a4085476bbf1fb0d8bb980d52612f739b3d107698b2138fbc61f91903621c02d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340482, "uuid": "cf49f79c-be3d-4446-8b59-c51a984033cf", "comment": "Malware payload (Heodo)", "value": "52c6fcef55d5aabcf1690ae4c8bf5a97c7a8fa22", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340482, "uuid": "191be7e6-238e-4445-afad-ec9741613a6c", "comment": "Malware payload (Heodo)", "value": "2a17e48bf02c27bf97913467261473b5fe0053964c81d81c9e4ccafd2bba14cd060aee0b9b1c3897becca8d0034ae3a1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340482, "uuid": "3423cb43-2a8e-40f5-9fc8-67ee251455cc", "value": "T10BE46C13B5CEC17CD46F50778A5BB63E25A7D82C0B319A87A6C06EDD2F304D2963EA41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340482, "uuid": "72b151ae-eee7-49ba-bd44-6e523eb5ef64", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340482, "uuid": "929d237a-e45d-475d-a100-f967681dda56", "value": "6144:AFFTxx+67O7tB2MEcqCZo+fgGNWsNAhCO0c4TScA5D1mW9wiElZDZ2p79JHYzLVA:AFFTO6oyclOdChc3cA5D1mJiQiHY/VPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647340482, "uuid": "ab51ab10-93af-4ccb-8d01-aa63b405ceef", "value": 690157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647340482, "uuid": "9159dbb8-a832-4334-abc6-d6065f0cb9b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340482, "uuid": "3e3b3388-a74a-457f-ad92-4a5b58eb663a", "value": "emotet_exe_e4_a4085476bbf1fb0d8bb980d52612f739b3d107698b2138fbc61f91903621c02d_2022-03-15__103436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d0de2b-a438-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647332178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332178, "uuid": "f5b8100c-d3bd-4369-adc4-aeafff713cb1", "comment": "Malware payload (NanoCore)", "value": "c2c2c07a2e1a3e18655ae3a895a69e8c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332178, "uuid": "fa12a789-809c-4ad2-ba59-d9fe58df1d97", "comment": "Malware payload (NanoCore)", "value": "a4dc824fb77312030c7d799e71a21a136a1ca60d5389f3dc15fe26bba97fb1e4", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332178, "uuid": "de1463df-21fc-4193-a2f9-90e4142a063a", "comment": "Malware payload (NanoCore)", "value": "5c3a97558827e4c7da0a76023c5bba9f8176dc2b", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332178, "uuid": "f25f6588-95af-4a6d-bc82-2b695e7add05", "comment": "Malware payload (NanoCore)", "value": "d181e01231508e4d424fbbffc3f2fc5a08485144cba3d40c2c2f8b5b2b00585eefeda420485827b433422a228b7aabb6", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332178, "uuid": "d023ce7a-c0fb-4042-a97b-baf588a90d1e", "value": "T15915020773E89F42E876D7FA8962150453B6B1591429E3493CEE30CB1BE3F018795BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332178, "uuid": "d6785f08-499e-442a-8534-91b3d97bf9e5", "value": "12288:pEmdkwOEocEqQDeFr957lMRJCji9u7wNnf0V0VkEDyG8PHvliSgXBSLIX:Cm2wOHDeFr9PoDgMtflejvdiSgXAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647332178, "uuid": "058891e6-67ab-46a0-9488-50ed459eee23", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647332178, "uuid": "ec60b994-af69-49d8-b614-d7988a166730", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332178, "uuid": "4e6bdfdf-4145-4df5-a204-c2d3bf089734", "value": "REQUEST FOR QUOTE_Spec of products_Pdf____.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671b9ce6-a436-11ec-9275-42010a9c0029", "comment": "Malware payload (Hive)", "timestamp": 1647331410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331410, "uuid": "077cf1a2-9a0c-4694-a310-ca7faae4c0f6", "comment": "Malware payload (Hive)", "value": "887f345dce4426b9c841c7fde581b18f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331410, "uuid": "652e62ea-2eff-41be-bb0b-26850cbf23b3", "comment": "Malware payload (Hive)", "value": "a500e5ab8ce265d1dc8af1c00ea54a75b57ede933f64cea794f87ef1daf287a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331410, "uuid": "7e69b2b8-e4b5-4b81-9ff8-cb82780416f4", "comment": "Malware payload (Hive)", "value": "59ae2ee86e7f9f90fc3c5737355e88b59b00fa2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331410, "uuid": "b4fa643b-e13d-47e4-a92e-467d0291e29c", "comment": "Malware payload (Hive)", "value": "8f03cedb2a03524e73b052f939dcde99455901f8814992e7d1d3573b7b4cfd5bc64ef1a2fbc63b10e44f682c1890f450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331410, "uuid": "2f147e77-0fbe-4a16-bc7c-514de3c30c7c", "value": "T182267B50FDEB60F1EB8359315877A2BF7334A6094324EFC7CA444EAEE857AD10A32255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331410, "uuid": "9f56e025-f213-4205-becb-ce353705f4ba", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331410, "uuid": "66e68ddd-c32a-4789-8ae6-1cac93e82edb", "value": "49152:8l2Lw0mTYM97bD/K8wnK1CeDaN/FQYqy9LR6iAPfGj0xK7/dl6zq9aU+bV71+xco:8A1mTnDfHDagIVWk/dl6z4T+qxe0Ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647331410, "uuid": "ef7ae9e9-f3ff-49a7-9953-8827d4526665", "value": 4717056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647331410, "uuid": "e7c17c0c-57ab-40f1-b961-375abc0da5b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331410, "uuid": "feb0f6bc-a681-45b2-bea7-8d2c8c23762a", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1981e3bc-a456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647345024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345024, "uuid": "e123fe45-d067-431a-a05e-1011bdf1c68b", "comment": "Malware payload", "value": "b5229ee3dbf4702757573d05abce3f04", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345024, "uuid": "9b4aac26-7f01-4d05-bc98-e001380c6c91", "comment": "Malware payload", "value": "a54e2ae96e5a23562ba60fc2914edc60ee72600a019c4d41b29636e4710c274d", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345024, "uuid": "95541b36-fe9e-4461-b3f5-410d4cb648cb", "comment": "Malware payload", "value": "d31457b089f07cfc20e6b81834ebc02725a9754e", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345024, "uuid": "01e5e673-1a4f-4a6d-8a63-2b04a58a56ea", "comment": "Malware payload", "value": "2364cdfa6290be924cfc4e4d3277c254ff9028e838496db41f46e9be83d8d99c4c6270b6f6c182c59ebc2d845625628e", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345024, "uuid": "13ed989a-3bc8-4ec4-b945-a68571c89da0", "value": "T113D02BB49D70E4CC839CF530C693682964518166CF542EFCD621245BE51CB4DCB2E8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345024, "uuid": "effed029-e988-4821-87cb-4b75b6c312bf", "value": "6:IXeqF9tSa2jkzozaqEHiO6snaYpXkGVokOMkvGJkilP3L3RFd:IXfXtSjJ2qEHiqnaYuGPOVekeP73RFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345024, "uuid": "25aab9ad-4fc3-4a64-8bb8-30184e56daa5", "value": 287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345024, "uuid": "02465eb0-d65b-4a37-8787-5adf7b434538", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345024, "uuid": "b225ed70-43a9-4901-a17f-dcfcb77b970c", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88256b08-a469-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647353370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353370, "uuid": "01522d9d-bbf9-4c19-ae0f-4d240078693c", "comment": "Malware payload", "value": "561a731b601e6ae89285965a2baa641a", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353370, "uuid": "342e6f7f-1a7e-447f-b037-cbf2d2339445", "comment": "Malware payload", "value": "a5c5aef7a92935dc91e55e03674651d27ebdb348fbde8dc55e3f77a47ce6b11a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353370, "uuid": "8f97543e-fba8-4a17-84c9-8d0ac355eb8c", "comment": "Malware payload", "value": "f2cacb03deb461edc578400b5d53082ae2382a52", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353370, "uuid": "5af82a56-28ed-443b-91e5-a59ae0053d74", "comment": "Malware payload", "value": "8b0dd56603f3be41a8b3f089da01c956f749c4aa33dc803db6bc162f06ae990fc0b9873fc959171ff305c93704b5213f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353370, "uuid": "3831ed40-dbe4-4576-9d4c-b55ae32f5501", "value": "T1A9A422417A93CB77F9A382B089E6FEB51234FC054E26C6237B043B0DDDBD3549A29A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353370, "uuid": "9c459b01-aa9b-4495-acf0-9509cc3f37c7", "value": "12288:vtvF+n3JRDjvOfj8AWKAT0+Ztau2IPzCBNDpO6aYw:Rof7u8AUT0+ZhBrCrDpO6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353370, "uuid": "ee07c0dd-cdf1-47ab-97da-6c648827158e", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353370, "uuid": "29d0bd16-a62a-4967-afd4-873e406a2173", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353370, "uuid": "5b9a376d-967a-4f97-87a4-feea0a3a771e", "value": "Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7040839f-a41b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647319829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647319829, "uuid": "35e0c0e7-0a85-4aba-ae40-18d3bb42f58c", "comment": "Malware payload (RedLineStealer)", "value": "b4b86b8505a51c92593bd4b427b24018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647319829, "uuid": "2053cc05-7ca0-4a92-9cef-5c425ac07e97", "comment": "Malware payload (RedLineStealer)", "value": "a5cb0a4e7729e0d88dd37098944ce472750a723ce0f68be3038d5418a77c6746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647319829, "uuid": "4f204dd7-80ae-419c-afd4-d31d25c09a03", "comment": "Malware payload (RedLineStealer)", "value": "d7e5bbf3012c1193250ca3e6fddbc85a7dd49668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647319829, "uuid": "12c4a08e-a6b7-4b29-ab22-92e896f48870", "comment": "Malware payload (RedLineStealer)", "value": "25786aff28d51e816134c0bfb223fd413f9426fc397f12a8250f1eef9eda132af557b7794d784d91c1b39002915002c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647319829, "uuid": "488f64a5-9d08-4015-924c-901d32d418b9", "value": "T1F81533B92333FD34E94B097B8D157A0EEAD746624CC4B277635F1D4209FC4ABE092A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647319829, "uuid": "b0b939a3-e165-476a-8b28-20cd49934e0e", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647319829, "uuid": "fdb4083c-4e97-4dc6-bf4d-4f5194467275", "value": "24576:LmXANUP3EffmLy7NM8C/XEy6FFgZkEaHNYK3oWaJVd1ye5:LmXAGgyFEy6FFONaetJd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647319829, "uuid": "48cebd12-f98f-46d7-8028-2d5e7c1d4734", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647319829, "uuid": "3153ba39-e9ad-43e5-a7a2-f878e434b120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647319829, "uuid": "5a8c1505-8e7e-4908-807f-30fbc0001259", "value": "b4b86b8505a51c92593bd4b427b24018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f2fcea-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (ModiLoader)", "timestamp": 1647353774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353774, "uuid": "e283307f-6189-4c83-a96d-217042ae3518", "comment": "Malware payload (ModiLoader)", "value": "bd98516738a50c0952450f6c03507e3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353774, "uuid": "bee25c13-e96d-44b0-9970-646524a2baa5", "comment": "Malware payload (ModiLoader)", "value": "a6cea446b135529f57315da655e5329e267f80a67940edbf949196536b212c5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353774, "uuid": "140ac080-d61e-4b83-bfcf-3927bbbd1c17", "comment": "Malware payload (ModiLoader)", "value": "4c58262441f9ee984acb4df781e59027f95e5c0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353774, "uuid": "8018e0dd-9a58-4716-a81a-1e48e4cd9cb4", "comment": "Malware payload (ModiLoader)", "value": "27e49275b56f0cdce4d8243f969d79dcf6ae05931e30057b2108f1ea543971e50c012f0f1d04639edb0c251a4f1b6fc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353774, "uuid": "39df986e-bd31-48ba-83fc-ae5dd23ec78a", "value": "T16AE4AF52F7E18436C13259788D4AD2A8681FFD202D15EC873FE99E4C6F766C1391A3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353774, "uuid": "64fb51d3-4d4a-4260-bb9d-7c6f375df0b9", "value": "f411b7c64ae0f16bd14a751e9077781d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353774, "uuid": "a2cfaa28-cf2f-4b28-99be-3ad9b042d87f", "value": "12288:/5VHItCEqofo3cOS0aYcdexwGN94Y9/rIPR4KeBIQCN1+ZAzl/jRIlRfkK:zopqofo3cOSpYcdexwGN39TIPR4KeByA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353774, "uuid": "e57b10dd-398c-403b-84f5-049e1786ffab", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353774, "uuid": "3ee72bdb-353a-44dd-a0d4-2f77518fd312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353774, "uuid": "f37afae1-a404-4d4a-945b-8837bf97489d", "value": "UPS#SHIPMENT_CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c406e1-a45d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647348084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348084, "uuid": "a7fbd943-383b-43b6-87ae-b80c2b8d3007", "comment": "Malware payload (Heodo)", "value": "72f9a2314385dfce25d81b13bea202be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348084, "uuid": "3f116c78-3c7c-44de-a76a-f8a7f3f92b9c", "comment": "Malware payload (Heodo)", "value": "a6efcbda2962b1ecd72a0f3a0157c2cafad8f93176a8382523779d9bb064b598", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348084, "uuid": "a779102d-5b0a-400c-a58c-19fda7ac03dd", "comment": "Malware payload (Heodo)", "value": "5b89829d51e7aadaad295877b4dda8fca7aa7f5e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647348084, "uuid": "0e7ebb51-1f7f-4533-98fa-e9d20b2ce972", "comment": "Malware payload (Heodo)", "value": "353517c673a22469f304bd286625c3f00bb395b1f5dff0c9a8e9e11b28fc7915f21237318bb40ef1b3a12e9a6350ae5f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348084, "uuid": "3a565bed-aa8d-49c8-a015-62db77a3f69a", "value": "T107257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348084, "uuid": "8c3a713e-1ff7-4c75-8fcd-e3fe7e71eb1d", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348084, "uuid": "d5b93768-04af-4af5-bb89-ae2849f6a313", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYeVP6FuR6shQLj88F+Krf6:v6oycln8cACiJP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647348084, "uuid": "830fabad-2413-4fce-aedd-e3c37cc4be99", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647348084, "uuid": "c1cb5ecb-466d-48e9-a3eb-a8179ba942fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647348084, "uuid": "41111edd-7205-4136-bb7b-e1ee0154136f", "value": "CpHoiccKqogwkI0B9YykKqCYf1dpE9kY.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfb7aa6-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647333809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333809, "uuid": "a7422232-df27-4196-b8a6-6a0e72563ad0", "comment": "Malware payload (Formbook)", "value": "5879dcb6632d8c3d53f39a29e86cdcce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333809, "uuid": "8bf8b7f0-29b8-4e1d-a1b1-2d4b1c804215", "comment": "Malware payload (Formbook)", "value": "a84bdf209b862ffbdf3d963611eec3c1c2d70024e24041727a49bc618d6ff4cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333809, "uuid": "b4e640bd-13fb-44f3-8955-38618ac8389b", "comment": "Malware payload (Formbook)", "value": "97c358a006711c52a4647c3db520a9fdb575e952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333809, "uuid": "8484b7a7-c9d0-4fc7-92f8-d5272ccd8162", "comment": "Malware payload (Formbook)", "value": "028181c6a17e78434af116459f5775849cde46db9a9b9a58dc95c13120e26d22a292b29a2dc4aa1a8e98fec6fedc4c6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333809, "uuid": "1a7027e8-beee-4de6-98a0-0bad9d0ec2d5", "value": "T134E4AF3673D18132C1339EB58D4B53A8E42DFD206D19A8873BE9EF4CBA766813529353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333809, "uuid": "2ce8f36c-e1ed-4bbd-b929-2a6edf9ab6cd", "value": "f411b7c64ae0f16bd14a751e9077781d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333809, "uuid": "9d940065-ef68-43eb-8fdc-545f2e145441", "value": "12288:/5VHItCEqofo3cOS0aYcdexwGN94Y9/rIPR4KeBIQCN1+ZAzl/jqqqqqqqqqqqqp:zopqofo3cOSpYcdexwGN39TIPR4KeBy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333809, "uuid": "db4c3055-4eb1-4bd6-be4e-cf2150378335", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333809, "uuid": "36b75a41-f119-4a68-8bb5-5102028d6205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333809, "uuid": "0f54a2a6-a24c-42a0-bed5-9df142f68446", "value": "Lista narudzbi u prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5bbf2f-a457-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647345487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345487, "uuid": "1807b8cd-5a08-4adb-81f0-280c659a82bf", "comment": "Malware payload (Heodo)", "value": "09cee082024129afaa1c11abcdb7c00b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345487, "uuid": "1d8e82b3-482e-4138-8f94-b1988bb7e283", "comment": "Malware payload (Heodo)", "value": "a90e348f636488c29756e8631b55414da1042a4a13a92c75eac80a7a7ef6ab4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345487, "uuid": "dfe67fd9-c43d-41b5-beee-5ae1944fbd3d", "comment": "Malware payload (Heodo)", "value": "a897718e5c3a934e505f70c1acc595d6fd47085d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345487, "uuid": "57b005da-b938-411c-a902-26f0b7869aa9", "comment": "Malware payload (Heodo)", "value": "123b50ff8c8631f18c41a1c8f5e19c4bd5629f72520dd4c79dc5f91217806356ab471c4253fb7d1eb5c7e52f6bfdd678", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345487, "uuid": "396ebb14-bcc8-4b2a-af28-0fcc7ea5716e", "value": "T12F257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345487, "uuid": "dfbc9821-26d0-47d4-8ab7-5f8a3f5c5e5f", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345487, "uuid": "5b7d1665-6e71-4e2a-af5d-2ef2c12c890f", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlFOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8hl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345487, "uuid": "f156ff00-1ece-4a77-b823-ce095fbabd20", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345487, "uuid": "14c19027-1706-451c-945a-9d82763f2fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345487, "uuid": "ad2ef73a-cb3f-4be6-845f-aa59673a1db1", "value": "09cee082024129afaa1c11abcdb7c00b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8c2d9a-a42b-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1647326806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326806, "uuid": "3ac9a048-0feb-4cdc-89ac-12dbd264a9c0", "comment": "Malware payload (NetWire)", "value": "996fd0a78c7ca69f0f5e2beecb9fb1c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326806, "uuid": "376766d9-7080-44ea-888d-c5e2bbae1a5d", "comment": "Malware payload (NetWire)", "value": "a9189b815c696214f9c7297e0ee9d6ecfff9bcf7e7064651dc3d64522d922b8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326806, "uuid": "aa9d1723-7247-4b9f-8407-6c5ee04f3675", "comment": "Malware payload (NetWire)", "value": "0c7a6da13a2e59fd9d1932f7c365a367a957745d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326806, "uuid": "bd2fcac2-4a44-4d7b-896b-671c81fce652", "comment": "Malware payload (NetWire)", "value": "a1071187fc0402358646e428fc4062431004bd518913118ec264a46583eb507ca06682a495dd7bcdb11a00032d24b329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326806, "uuid": "ab97b307-1af1-4c68-ad1b-aa060291bd95", "value": "T15615129AB3E85F92F4BADBF784765A1403F6B059520AE34A4CD230D705B3F1053A4B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326806, "uuid": "690c0bc4-b419-451e-bbdc-d90f54126a14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326806, "uuid": "e8a2207a-86c3-492c-9a9a-1a6163dda48f", "value": "24576:QmRwOiAUVxhgnMtPRNT4eDc4Qv4n4DS0I2io2JYgR:QMfOxP7T4eo4K4n7AH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326806, "uuid": "ed8c25cc-eaf7-45b0-96e8-035a8354c353", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326806, "uuid": "97637995-8ef6-4214-a6b8-90052147a046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326806, "uuid": "510a55f0-e3e0-494e-91e7-540d10978172", "value": "Purchase Order SKMBT Ref 15032022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5988f0c9-a425-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647324086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647324086, "uuid": "ef144042-3f82-44b9-81fc-3210bddb6674", "comment": "Malware payload (NanoCore)", "value": "0115f7c838bdfc7ef1dcbfafd82e1418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647324086, "uuid": "d1b102d0-0038-437f-9e71-33ef2d486af5", "comment": "Malware payload (NanoCore)", "value": "a96ddfe26cc41ec92563b0b721a0036e9405ac08f617d5289a921ad054b4ae5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647324086, "uuid": "f1d8d5e3-93a0-4292-ae0c-2ee9c55758da", "comment": "Malware payload (NanoCore)", "value": "ed9499a08f156387c473eebf59e5a329e98a855e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647324086, "uuid": "8ac1a8f4-9e0f-401e-8b0a-77641cfadf54", "comment": "Malware payload (NanoCore)", "value": "a2a5ae1f39d288625313d5f1fc0bece824dcdf4162e9cf199d3ba26d165a0e26f90c3ea0fc7182f857a257af444976f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647324086, "uuid": "ac56e3a4-4208-4ebb-bcb6-0c783780ece1", "value": "T1A62559A1E6805A31D03F57301138BD4407A96EF5B62ECA1D6CE93C9A7E71B0D3663E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647324086, "uuid": "9d9a9fdf-548a-48d3-90a1-9cb0bafb2830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647324086, "uuid": "dd3f72b0-4f39-43fd-b71b-f54f460917f2", "value": "12288:Z8W9SWwQ0Z570ZE5UyiErCi0GIG4H2tbuo7ixV96C6rinkSDfcuNm2uPmSAQdP+:XoWwQo6Up+RGx4H0b97igC6r4fDtkOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647324086, "uuid": "07fddaff-49fd-4d74-9c02-d8975d39353b", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647324086, "uuid": "1b9982f9-6e36-4a14-ab3a-78f08ed06ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647324086, "uuid": "8ae7ac76-a039-4dc3-82e0-8cc20fb232e6", "value": "QUOTATION#RFQ827636-ABWShandongZuozeImportExp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa97b8e-a41f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647321788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647321788, "uuid": "f5207b64-7a46-4d32-9181-9b9405b2b5d9", "comment": "Malware payload (Mirai)", "value": "33c9e2d3757844a385cd26bd3667e49d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647321788, "uuid": "2032dda8-d54c-4b1c-9295-48026086dc61", "comment": "Malware payload (Mirai)", "value": "a9c8e992891763b46872dc127a754e72392840a77b8f8512949209b629d0fcc3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647321788, "uuid": "b75269bc-9fa4-4f64-b22d-f3ba4751eceb", "comment": "Malware payload (Mirai)", "value": "2c2ed6ad2a9d802fa3d0fd95ece33dee97acc31b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647321788, "uuid": "95598f2c-e43f-48e1-8bba-11093543536c", "comment": "Malware payload (Mirai)", "value": "65a217bac9658c5fd5455b267b0a5f0d9ffc7ea1f4ce304e8e015b4f26823214a88a6cefb68664b7eefd50753d19b68c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647321788, "uuid": "6b4755fa-c489-48ba-b8ae-8944ee086399", "value": "T1E2B2BF5AB6224F3FC599CB3449AB423955B57404FA236A6F3F0075381981B684B2BF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647321788, "uuid": "dca5d939-8acb-4ffb-8013-022797fbd549", "value": "384:BWskamFsqGhR9ju+dC9RZL/QHBD8wYPcWhNqKZT2MHpUnD1oitt:AFTaLRRu+dChLKBD8wYJ/pUDu+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647321788, "uuid": "ad1c728e-620f-4539-9008-bfb18a1886ae", "value": 25335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647321788, "uuid": "3fefb56c-8ec3-4ae0-af9e-e3fc62ef6383", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647321788, "uuid": "c976fda4-930b-472c-95c3-9ec67fc05e0a", "value": "x86_64-20220315-0523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc91a980-a46e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647355713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355713, "uuid": "b2a45f49-9734-4957-9cbd-c17f9dda227b", "comment": "Malware payload (AgentTesla)", "value": "78d8eeac81b803458a7af557e7a6616b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355713, "uuid": "872ee6df-6241-4fbe-855f-46df65103ab6", "comment": "Malware payload (AgentTesla)", "value": "a9d56a970eec658eb67a023fe7b188a4275499d2acf9f91819ae95ffcbebbdad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355713, "uuid": "a7732da6-6f8d-47f2-a7ea-7370a54a007d", "comment": "Malware payload (AgentTesla)", "value": "d0ebdd8c0fd0a6baf96bc187b012981685ac138f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355713, "uuid": "a96f0f94-2239-4780-936d-eca3ce78d64f", "comment": "Malware payload (AgentTesla)", "value": "ad5c5bc64e8bdc5f92378f5f0a16fcecbd257e48fc67f1685ea567384951c19e981ceb598d95f75bd413433de0ea46b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647355713, "uuid": "d5769f11-1302-4550-b345-e3635b1955d1", "value": "T103C4121BB2C0E3E6E82482B1547EC03597722C6B91F055BF3385F77E1BB11F25A0A969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647355713, "uuid": "c13fffb7-06e0-494c-8c9a-1d6f0e9c107b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647355713, "uuid": "5162e9ed-7627-4fa0-a7bb-575ef1dbd071", "value": "12288:6sQF2KfpUOa0YIwQ/AqGluk9vn+NN2qQ9gXrcbmiH5u59gt1kZjp:GRT9v8cN2qqg7w/HQEkZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647355713, "uuid": "41138429-ab82-4e1a-88e3-ef45e412b5d0", "value": 593871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647355713, "uuid": "badd3849-c8a9-4b0b-b448-5133521fa571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647355713, "uuid": "84bd09bb-8182-4e42-949e-7434f71e9707", "value": "Bid RFQ_pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fcdc45-a450-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647342810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342810, "uuid": "4d49f01d-9a9f-4cce-8f50-74a7553a7244", "comment": "Malware payload (Heodo)", "value": "dc86f77cd3d5e9bfcdf95a9ca77a4733", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342810, "uuid": "526746b5-aa8e-4b6b-b46e-bf6f82dc9bcd", "comment": "Malware payload (Heodo)", "value": "aa264225ae4b495cd76caa36207f7bf294696aeb06fbfee15d29f6f91b31ed53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342810, "uuid": "8b7e18c2-118f-476b-9790-3b10cb5b1216", "comment": "Malware payload (Heodo)", "value": "168e77a209db54bf2e5a6996f05cbd9b67b66cdd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342810, "uuid": "ac40612a-7aeb-4559-a2c3-11fcfb6dec53", "comment": "Malware payload (Heodo)", "value": "d1786e6332c1063f5bc2d322d5c082f099a28959bfc08040c7d062bdfb9389ea689f6707dfeaa5a341e9890168bf216f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342810, "uuid": "5bf2701d-3d5a-4f99-a746-e83d08d3b6c1", "value": "T199257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342810, "uuid": "17fa85be-d098-4a14-88b1-0970d30b36f3", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342810, "uuid": "a29f4bd9-25c4-4789-8e81-cea143433e3c", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHY3VP6FuR6shQLj88F+Krf6:v6oycln8cACiGP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342810, "uuid": "95f1c77f-37d7-446c-a038-5720781c7d65", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342810, "uuid": "44f031ee-56d1-4176-875b-44af79023911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342810, "uuid": "7bfe526e-b8fe-4c72-aa6a-39aed1773373", "value": "JMKiv8FsvlIN0sVcAyt3UJVSQVTZGw7j.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709c144b-a461-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647349894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349894, "uuid": "c846d3af-a96f-42b7-bd06-56a319dc1556", "comment": "Malware payload (Heodo)", "value": "a92e9d0ceae1cf3f832de2c4984d98f9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349894, "uuid": "8b8ae2b6-8683-4ac1-be70-6ecb7232ddfd", "comment": "Malware payload (Heodo)", "value": "ab21821898ba5fd48aea603490aa0a8d4905bd5f171e48fd9061ed3c69ebf224", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349894, "uuid": "a53214c2-da0e-4b76-ab2f-55a9aba16603", "comment": "Malware payload (Heodo)", "value": "855247e397882026b9459690c60220e4a4176757", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349894, "uuid": "c9b00b65-ff4d-41e7-b751-6166d4000d48", "comment": "Malware payload (Heodo)", "value": "769dbad82ad2c325a17d70770f699d0e047368d0697a8821c25bb1be92f3f9bbfc02ef19a25b41ff7345ca83c8d890dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349894, "uuid": "548dcff0-15f1-4377-8bb3-80065f5c0fcd", "value": "T19033D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349894, "uuid": "16c0e519-4d23-4374-98eb-5ca3d73e2384", "value": "1536:UAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:9cEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349894, "uuid": "7d722289-ddfb-4c74-9904-68cbebd8744d", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349894, "uuid": "f983759e-3bd1-4a59-8ed8-664e10c1d6e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349894, "uuid": "cdd95926-ce6a-428b-8bc6-bcb32d9084d3", "value": "Rechnung-03-2022-9306254.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27b1abc-a441-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647336342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336342, "uuid": "7bca8bfb-ca74-4605-889b-39da05f17662", "comment": "Malware payload (Heodo)", "value": "a32dfcd37b33256d55657e3d19b3dedb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336342, "uuid": "477aae4f-9261-4048-b767-fdf7874e3c72", "comment": "Malware payload (Heodo)", "value": "ab662880753e0828df60df0b117ba0bcc834532955e21da88528337853650059", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336342, "uuid": "d4395869-b5e5-4d5c-9c94-342d29186dd8", "comment": "Malware payload (Heodo)", "value": "3d5b6a35e6b0f27cc7fa2e1ee3124c3d0ff79c8c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647336342, "uuid": "f282d191-4f86-498e-ac6b-4892109fbee7", "comment": "Malware payload (Heodo)", "value": "3f9e293b9af5cede434ab3ec2fc4047af343684270a5e2d59535153538d8dae2d824648f7619884c9f6627e861fbd352", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647336342, "uuid": "90a8e1d0-cf76-4ecb-8e2e-a6a7ee96611a", "value": "T1D6257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647336342, "uuid": "7c502353-1a53-472a-b298-925eb57ad71a", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647336342, "uuid": "c9d7319f-8131-4671-94e0-4160d763a3e1", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHY3VP6FuR6shQLj88F+Krf6:v6oycln8cACi+P68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647336342, "uuid": "ebe55429-ba72-45fe-a8e3-f5327de0b7a1", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647336342, "uuid": "66d9503e-ab7d-4963-96ef-fca17d32f57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647336342, "uuid": "08db3774-2370-4cae-ac25-2e59db6e148b", "value": "LBIB1t5JZX.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe87f555-a466-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647352280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352280, "uuid": "dfe08919-cd3f-4c9a-a589-d0bc6f832967", "comment": "Malware payload (SnakeKeylogger)", "value": "f0f3071208588898b502bfa66887a1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352280, "uuid": "35ab1dc3-87f1-4a83-9205-18ad4961048a", "comment": "Malware payload (SnakeKeylogger)", "value": "ab69eda869d946c014e1084c7f6befe96ecd89287cca2c648b5039516a10cb5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352280, "uuid": "c5a03cf4-f11f-4ee7-8f3b-b12ad4a59fc2", "comment": "Malware payload (SnakeKeylogger)", "value": "67fc6989b2e4cbdb89713100f57d74dd63bcaef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352280, "uuid": "53a387f8-4ab7-4490-a143-8ba12ca94bde", "comment": "Malware payload (SnakeKeylogger)", "value": "331f97f577c185854fa6aacf5fc8bacbd70adb69bba39e209c463ba0155b5c34f74668ed4957cd0206864cfb39f1fb87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352280, "uuid": "b84d0880-c22c-4262-a244-4fa32b7fd219", "value": "T131835B867B8C5346D5184D3E9AF74D104B77AF667E02F60EAA84F61E0EB33D06A03B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352280, "uuid": "2cf92a97-c9cc-4367-8755-29b4a9ec3cdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352280, "uuid": "9afd6b35-7646-408d-9bf6-6bec9437cb20", "value": "1536:CRAHnajPe/Kv47kAjmLD9kNhx9ER1tDMeF7Ci71A:Cpe/G4oAjk9kfx9ERjFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352280, "uuid": "c3a5c448-eaa2-4d1b-84ec-524e267cb92b", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352280, "uuid": "b06a2399-e929-429b-979b-614b6b5ab11b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352280, "uuid": "51bdd20d-5cea-43c1-a4cc-9948fb9e650b", "value": "Odenmemis Fatura Bildirimi,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d50e068-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353298, "uuid": "5c8d4788-680a-47b8-86bc-48113083f7cf", "comment": "Malware payload (Heodo)", "value": "a0b3ff66a9849bd8f2f0d09618d536b0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353298, "uuid": "a8df7bf6-b323-42a7-a5e9-87efa1d8eac7", "comment": "Malware payload (Heodo)", "value": "abf02d10f75eb6021c1730c2e4d3304c1433cd81a19deddf29ece14812ee16e4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353298, "uuid": "6f754daf-2f13-4622-9dde-14e728d7a996", "comment": "Malware payload (Heodo)", "value": "82e6459ecebeca6618cb1ed92bc43840f2d9ad88", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353298, "uuid": "ff04d439-a189-4732-964c-1c2fadbd1c9a", "comment": "Malware payload (Heodo)", "value": "ae7bb80719c1b9a171bb560d0eed4ed83c206ee1a2e2cc26aee3ed51bfb5244beb5d8e6c609deeffde34fe8de2e09984", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353298, "uuid": "1180a8ed-292f-44de-a411-d41980e862c6", "value": "T1CD33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353298, "uuid": "bff59db9-dc70-4660-8ff1-c6dd82d473ed", "value": "1536:IAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:xcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353298, "uuid": "8341f714-82be-474e-8c6f-aab91163eeb3", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353298, "uuid": "bc719210-ffa5-43f2-8b8e-c93ddd2c98ab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353298, "uuid": "ab83f37f-11f9-47f1-b342-2549f85dd702", "value": "OMICS.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da27c3bd-a439-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647332892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332892, "uuid": "ea7ca3eb-420c-4019-b17b-bf18497dfcf9", "comment": "Malware payload (AgentTesla)", "value": "18fd5af453336d20d1a8a3a5e7607bbb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332892, "uuid": "9c231c3b-d96f-41a1-abab-7cb495991120", "comment": "Malware payload (AgentTesla)", "value": "ac064981583a22c0a9b60856fec89bb5cf4f4cdba4bb8e81d49c451b4b9a3857", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332892, "uuid": "00b70471-6a5e-4268-9372-465b1befa78c", "comment": "Malware payload (AgentTesla)", "value": "9ff6a35235f25cb7050e1e176f6dd8324c3b6dfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332892, "uuid": "f4d60714-2d38-409e-8553-08338f580417", "comment": "Malware payload (AgentTesla)", "value": "b36e95ce4369d0a504b286512f2c1828ac7223094e5edc5e57fd390df6d111abbb8304ed52d9dd824db665f3ed51b00a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332892, "uuid": "77514a35-eb08-4137-8c12-440f5b40cac1", "value": "T10C15124573E88F02E5768BF89521290803B676ED9430D74D5EDA30CB6AA3B168F60F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332892, "uuid": "fc6ce5c0-8dca-4784-89d0-66ca4cd333a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332892, "uuid": "7da4c031-ff30-4703-91f5-1ccfde2611c4", "value": "24576:KtkwOt5CpNhSQzNMThOWOPcl6T+5ciXIQQ:rft5WNeThH865+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647332892, "uuid": "6bdc76e4-2323-4c0c-840d-4bf99ec20ff0", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647332892, "uuid": "9ebe7727-0dbb-46f8-aa0a-1ff707121037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332892, "uuid": "d047378f-31e2-4797-bd5b-01f5150d08b5", "value": "RGA's.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f2ac3f-a48c-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1647368447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368447, "uuid": "360cb409-36a3-42f8-ad4b-7f5b0124b415", "comment": "Malware payload (AZORult)", "value": "669997d4919a13cb6f23185d90bd5aa7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368447, "uuid": "d6fd60b6-b86f-4645-869c-16e996460c3b", "comment": "Malware payload (AZORult)", "value": "ac36c5174ef7ba76a704baeaa713ad6630fc79db52bb904a5b41e15316e7d353", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368447, "uuid": "33bc9bca-aa7d-445f-943a-46eb6db82e0e", "comment": "Malware payload (AZORult)", "value": "9956119d94f6342024f8148716add56a00acc5a9", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647368447, "uuid": "8d0dbce0-1b63-45db-975f-edf82c4f7b16", "comment": "Malware payload (AZORult)", "value": "ba3821595abf4eefe617f49ca61d3d6c1d28f668c992d6413cc7e1059f715fbec623dba0933fac894eda19dba24e080d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368447, "uuid": "cea3ed50-2b0a-4d9e-8e57-8bce05c0267d", "value": "T16F648E10BA90D035E5F712F8467A936CAA2E7EE19B3450CF63D52AEE56745E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368447, "uuid": "76354b12-a219-42d3-8a6c-3d919afdee8d", "value": "efc09099dc764fac02664e8bd8784b14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368447, "uuid": "6203cd6f-588b-4b7d-9ff6-a9277615bc37", "value": "6144:PnK7xggvCbveW2PF/9su+WOFgPEKAQWbmAvwZ/ElZh:PKSsC7l2PF/9sJFaEHLwlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647368447, "uuid": "44ad1188-38d9-4196-b123-ab19122c92b6", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647368447, "uuid": "13303db1-bbe6-4a5c-8989-fa4418e40b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647368447, "uuid": "ee4d0d81-f0f1-42ce-b7bd-b10f6b05f664", "value": "669997d4919a13cb6f23185d90bd5aa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28052d5a-a470-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647356215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356215, "uuid": "1a0ca176-3d68-47c1-9930-001dfbdfe432", "comment": "Malware payload (Loki)", "value": "d832eb7cd1df9b74abf8910d0342691e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356215, "uuid": "a18eca28-49e8-4081-9d02-dc70c4cad29a", "comment": "Malware payload (Loki)", "value": "ad061bddd3a0b93d5a03463c939eea0f64bc3d894768d2b45138c5d1968f1223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356215, "uuid": "c78f4359-6627-4ab4-8e6e-e43281e7d0d6", "comment": "Malware payload (Loki)", "value": "d45102c21c84c1232ebad44bd38b53b60fb2b030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356215, "uuid": "45aea0a3-2afb-49b4-9fed-21f91b486f83", "comment": "Malware payload (Loki)", "value": "434e156de7f2b25058bdccad332a884a9e5376e4c47b7ff94322741578c43db6f2024ce6a6e832e2957c8f120c08b1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356215, "uuid": "f2b3b872-7c99-40a5-8d43-e616b0f658c7", "value": "T19474124266C46EF2D24189B2207BD3AFD2F763F081550B1267802F7AAD60A4F596DBC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356215, "uuid": "f0078d87-daac-4628-b965-6366ac17902d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356215, "uuid": "e7656285-e3b9-443b-b94f-f2876e8035df", "value": "6144:rGilAkE06gAQGi6Rt6yvQYnrrV8Xg8pUt3ItQtunbPqxq2asLhpNG:ekE0LV4Rt6mQSVSUC6Gqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647356215, "uuid": "2f16eff0-435b-4bf2-8ade-c932702aa414", "value": 338522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647356215, "uuid": "563bf1b3-0dd7-402c-965b-ef1705a072be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356215, "uuid": "8e42498e-2537-439d-8de8-d143b174acc6", "value": "d832eb7cd1df9b74abf8910d0342691e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f35665-a474-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647358255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358255, "uuid": "a2a59e12-be18-4c8e-9341-c0390f90b31f", "comment": "Malware payload (Loki)", "value": "39f169406eeadfddb95a26cf94be4615", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358255, "uuid": "d97c07cc-6137-4934-872e-b71076b49fd6", "comment": "Malware payload (Loki)", "value": "ad7ca7fa7e54af78edacc71c98fcd1c611668eb1c222d232dde551a36052e502", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358255, "uuid": "f6f7d95a-16ab-43e9-9719-6b8f14e91de8", "comment": "Malware payload (Loki)", "value": "ce746c91a87c9604dbf6a1b892e339958020209e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647358255, "uuid": "8b4856a3-54e6-4edf-879d-9456de06b578", "comment": "Malware payload (Loki)", "value": "5d631e50a7a8c3b966dd1f044797927c956d6af23b0f7afd8d1196aff908c0e85e9975663f8ad2580798a604c635b06f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358255, "uuid": "df771561-7104-4bea-ac3f-546b42ba9a43", "value": "T1D5548D10BA90D035E5F716F84A79936CB52E7EA19B3450CF22D63AEE56346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358255, "uuid": "d9e80053-8f5e-4f51-bf8c-58306692e636", "value": "15365c930d750ee03adb61a7b335702b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358255, "uuid": "1156e048-d9e4-4c10-8ca7-68762101d0a4", "value": "6144:gorjv2irihxbD3tSHQQlDQmptt1FGLgK/cBT2zD/C888czTVh0Z7:1nv2ThxbD3cHQQlDQWttuTW2K88dvAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647358255, "uuid": "5c96e5ea-450d-46f4-90ce-2e4dc06d0c9f", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647358255, "uuid": "6c48a488-7c21-43b2-965c-9b28ef9e9351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647358255, "uuid": "a0d450f0-f4f3-480b-835d-f071c4781d26", "value": "39f169406eeadfddb95a26cf94be4615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213f77cf-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647354056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354056, "uuid": "023367cd-1e6a-4685-9401-015b7e1def0f", "comment": "Malware payload (Heodo)", "value": "ff81cdc86b7c12c33ed8c106fb0c0b48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354056, "uuid": "58493f9b-6313-4a0d-85ac-aef2a2b31a07", "comment": "Malware payload (Heodo)", "value": "ad9f5e3ac5323892bb626eed057e2d41b652be8a1c89bea111e64aff8dae5040", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354056, "uuid": "060b6b1e-033f-46ea-91b8-1708f20be961", "comment": "Malware payload (Heodo)", "value": "9ccfcb9a85cc9771b4696cfc1de4b954ab7fcecc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354056, "uuid": "f130c49c-8a9e-4556-bec8-83bf0fa964b0", "comment": "Malware payload (Heodo)", "value": "ff96d658f1ab31804d825128fd7f81fb7f3d0a515768f4aa1ba1258f9bbc594d5db3859e88d6d850366eeeb9f6143a95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354056, "uuid": "021d35ed-eaa0-4c31-8199-2f9a2b5839ce", "value": "T110257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354056, "uuid": "ed103d51-3827-4f4e-8b75-d6a52ccf21d9", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354056, "uuid": "58bcb7f9-6328-44cc-855c-749f001bd608", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKllOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8ll65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354056, "uuid": "b3e8d184-7f6c-4336-b46a-04f4995cf1a4", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354056, "uuid": "5c2f36af-f204-4918-bab0-281b96d8b67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354056, "uuid": "819b17a1-d783-4274-b2bc-e80dca23929e", "value": "ff81cdc86b7c12c33ed8c106fb0c0b48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0f90f1-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "955c16ae-9b19-47a9-8b85-73f5bf99fe9d", "comment": "Malware payload (Heodo)", "value": "59a17c40210f657a63b1aa150c271f26", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "725a89c7-7d99-425c-b630-20b5d4ab5abb", "comment": "Malware payload (Heodo)", "value": "ada01b1f04ff73cc8a7100d2193ba4f56642a42a1db1aa25837f7a9d921e69e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "000cbdb9-c6df-46bd-b313-71fe97d41283", "comment": "Malware payload (Heodo)", "value": "b3602910d0f3b2449bf4ded8bd16b1c2324f620b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "dc19f485-dffe-40b6-963a-e0495822bbc6", "comment": "Malware payload (Heodo)", "value": "8670f8961a36f698b240a6865104f3f6b4ddf323e41ea2a8da1a6ada0b5ef342812896811de2a2a30f774882beea696b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "0756a5b3-4ace-412e-ad0d-50bbf4774188", "value": "T106256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "d1f0fcbe-ea6b-40e0-9124-600441b727ba", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "4ea71330-fa7e-4739-9947-d177617e6d1f", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKk0wLBeUNKsuG31Pt8H:3dlV0EnITawgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302693, "uuid": "558c754b-357b-4367-a006-0e0af087d3de", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302693, "uuid": "e7c3228b-5fa0-4ade-9334-224af97a3009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "fb8cad00-b01a-442e-8803-7746d5268ac3", "value": "emotet_exe_e4_ada01b1f04ff73cc8a7100d2193ba4f56642a42a1db1aa25837f7a9d921e69e9_2022-03-15__000446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e109d1c4-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "bf295051-3c45-4f65-a50f-70a353b87213", "comment": "Malware payload (Heodo)", "value": "2bf9cce78a243938d70e7e65955c9c86", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "0ea283ad-0950-44e0-9d39-21f6ef2cce75", "comment": "Malware payload (Heodo)", "value": "ae701633b430e7cbe731f4b6b81c38fcb887a5d7e8b7dab8c814584a845ccead", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "3b68872a-c1c5-4acd-b6a9-1a000bb5861d", "comment": "Malware payload (Heodo)", "value": "a01088530588be8ccec4afdc3586065af4d8c0d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302838, "uuid": "a491ea09-27d4-40b6-9dea-a651cb2df595", "comment": "Malware payload (Heodo)", "value": "4aa1e5956f345ff986953e8edfbb2718c1599a3319063327c7f34fb7cf2f2eb9379a9dbf7f2c265938636aebb9de58f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "e1013d9c-a536-434d-9460-434f2cee5de7", "value": "T160256D10A2849A3CE5BF0575CCBAA6BD592CBC101735D0EB52D4AAFD5E309E2ED32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "29d2b6a5-f50d-4221-b1dd-e1ea6906e1c5", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "76099987-7eaf-42ee-92fd-793dc8568066", "value": "12288:x5Vo9Kjtm2aVFyuI7/URXPDMS57jcjdk1BWGJUThK6zJiwdkCuKeTO7FPWEF:xkZVFyRs/DVtg6jWeUNKukwruKGGPWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302838, "uuid": "2b5aefd6-7a69-4632-89c3-9757f566b8b6", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302838, "uuid": "0b65f713-66c2-4233-bba5-1920987b9fed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302838, "uuid": "6fc7a9df-669f-4601-91bd-875a162dfc2e", "value": "emotet_exe_e5_ae701633b430e7cbe731f4b6b81c38fcb887a5d7e8b7dab8c814584a845ccead_2022-03-15__000709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5424b194-a49c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647375187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375187, "uuid": "9bbf7102-01ba-46ab-a249-f835a848fad0", "comment": "Malware payload", "value": "60d867c1bb4677628220f5c02a7f3e50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375187, "uuid": "92eb1197-7806-4235-af51-78633579a08d", "comment": "Malware payload", "value": "aecf388fde8112564e0b36d5725abc89b32916e0accbd114782425a70c53618e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375187, "uuid": "20035b80-97f1-428c-86fd-759bd29efe99", "comment": "Malware payload", "value": "ef260bdf8f2a86c13c97568f7cbd5ba19ea0b0b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375187, "uuid": "995a1171-63f7-4ba6-80bc-86d80e38242e", "comment": "Malware payload", "value": "284706f1d9bfbb2f45f12151b0ca8b821e25bd67ff41fedd489e813d1a5e32738ddcf241d83d2e938ccd6a15d50c9ece", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375187, "uuid": "142c2a4c-1636-4e8e-930e-9fb08b4b8185", "value": "T113E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375187, "uuid": "7c7ff6e3-ca0e-4a42-ae1d-ff94160b6008", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375187, "uuid": "f2385ecb-a22c-47c9-8b32-240671b5361a", "value": "12288:E94YBCR2xP7guDo463OP4eEsiSOZjb2woE+MhJT:2kRAguDogP4ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647375187, "uuid": "39b689c3-6d4f-4d7e-8eb4-7711a1f2c94b", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647375187, "uuid": "f8dd23b7-ed9c-4319-8e02-13b4620b90a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375187, "uuid": "f8db5edb-0c86-4c5b-993f-436c9982de60", "value": "60d867c1bb4677628220f5c02a7f3e50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500966f3-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353276, "uuid": "f0709b09-ec07-41a1-9714-13c6b2c4369d", "comment": "Malware payload (Heodo)", "value": "616169eece6db194a2f0af1ed579894b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353276, "uuid": "cd19645a-1cc9-4565-9dba-4903e6185cdd", "comment": "Malware payload (Heodo)", "value": "aedb238301f701e9d3d0eeac8fb375f77f0008d19e7d4d8d9e223d95aacb7395", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353276, "uuid": "e571331c-782b-434f-8617-41cbf0d9fbde", "comment": "Malware payload (Heodo)", "value": "f33b645b6334d20121bddf2601446d60d37d2941", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353276, "uuid": "abf5b85b-8605-4a7c-9fa8-72c1195fa31b", "comment": "Malware payload (Heodo)", "value": "c86dbe0268402e804d35381d7bb378fdd5a87f51220e2265c8dcbd35254c1971ae8f44fa5f5c3923854ccf9a937f81b5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353276, "uuid": "37912327-22b4-40f9-8d21-3008ff0fb921", "value": "T13833D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353276, "uuid": "75fbe2f2-493b-4ae1-be30-74b5f2676e6a", "value": "1536:0AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:dcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353276, "uuid": "2f14293f-2766-4cb8-a390-5354a000aca6", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353276, "uuid": "52bab8be-df4c-46f4-a212-193baae15964", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353276, "uuid": "a61e2060-9710-4fb4-a1a1-77e338a3aaf3", "value": "innovinc.org.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ac3d94-a435-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1647330928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330928, "uuid": "7ca62826-05cf-4715-9aa5-d45228a82bdb", "comment": "Malware payload (AZORult)", "value": "f04791f80ce74a9702ecda811fca7edf", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330928, "uuid": "edd08791-b4a5-4636-86ed-4c643b992e86", "comment": "Malware payload (AZORult)", "value": "b05adf9ad869adb1c7605901185d74da4ccc5ad49106044a1114cbae8908713a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330928, "uuid": "4aecebbd-8158-47f6-a15f-b3f1a09a0a19", "comment": "Malware payload (AZORult)", "value": "33e5c4fd1858bf56c91586ce72daa6029039e23d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330928, "uuid": "c2b0a019-a9dd-494f-953d-7497adca7c8a", "comment": "Malware payload (AZORult)", "value": "51e6dde61ca93511512c6120bceffff20933ec85fb2ffaa96733f5f089b3119de47aa08b8f2ec5a1d7a6559c137a476e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330928, "uuid": "34d84272-3c10-458a-b860-a8b8fd11a2db", "value": "T152D4239D7CCADD53CB1099B44AB3E13DEB756855247A8223BB41FFCD1F618FA2A02901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330928, "uuid": "11a34aee-a5fe-4e3c-a4e9-58aac8ec426d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330928, "uuid": "7283dd3f-718b-4df4-a395-783052856689", "value": "12288:vW5Mi73KQoXmV37bavHax7B5drhFUi7s5M+5uDi7Pt7ZnMeaE6nIW:+5MOZoXm9G/ax7zlwqir1tMeZ6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647330928, "uuid": "66029335-e1d8-4a52-b07e-cbbd8bfdd4f4", "value": 604048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647330928, "uuid": "e5863127-8daf-4ebd-93c6-42f2c675809b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330928, "uuid": "141f9cf2-2106-40b8-88ef-02ea6ad2cb73", "value": "DELHI-Aircraft- airline spares purchase order-Specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6ecffc-a44d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647341482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647341482, "uuid": "9ff24b94-f682-475a-8b3f-414baa17bcb0", "comment": "Malware payload (Formbook)", "value": "ad6618a08596eaa3aef00918da003917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647341482, "uuid": "a25844b7-6e0e-4268-a906-61dc2dd602b8", "comment": "Malware payload (Formbook)", "value": "b08dd02223a62d1f9dae7ecd8770288acb32dcfafcfa5a58095b495dd43e3f1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647341482, "uuid": "0d77792c-ff8e-45be-af41-9b1538ecb114", "comment": "Malware payload (Formbook)", "value": "cc892ca2ded3f2fd58fb139384071e99d31c3609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647341482, "uuid": "c641c5d1-82bd-46fa-b9e5-10bf0c4bc9a8", "comment": "Malware payload (Formbook)", "value": "0435307f6d6fb024cb59f2ff76d96110261e7360dc821f78f1746601387dc5abc1154f2852f6b9cba2d704eb02ff7db7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647341482, "uuid": "ab0948a2-4694-4e53-bf08-7394240bcf31", "value": "T174E49E52F3F18436C03349B58D0F46A8687EFE246D18B8572FE8BE4C6E79681391B253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647341482, "uuid": "489c9cbf-a7bf-44f7-b51d-33ce1034246a", "value": "f411b7c64ae0f16bd14a751e9077781d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647341482, "uuid": "3ff1f30d-d5a3-4a38-8f17-7225e3efbfd9", "value": "12288:/5VHItCEqofo3cOS0aYcdexwGN94Y9/rIPR4KeBIQCN1+ZAzl/fRIlRfkK:zopqofo3cOSpYcdexwGN39TIPR4KeByE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647341482, "uuid": "35d25539-f586-4e6a-b388-d931863c444e", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647341482, "uuid": "a215882a-1e97-491a-a713-31d2c1b17904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647341482, "uuid": "81cdfd12-25e7-46c7-b871-56f7aeb89ca5", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe044be1-a4ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647383203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383203, "uuid": "b5eb5d91-b692-4fa0-b86f-4d3c6cdb5456", "comment": "Malware payload", "value": "d02dac492ddd440509d2c4100b165fb6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383203, "uuid": "ce387a70-1935-4cb3-90f1-324cee599c2e", "comment": "Malware payload", "value": "b12cb07e711917b63b0e37f7ca5b7c7a533c69a47c92da410d0127d5ea2df4ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383203, "uuid": "fcc3231e-712c-4b83-add8-64f8795f10ad", "comment": "Malware payload", "value": "78b7e9dc47d600b3a65b74b7dacffff3e8f223a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647383203, "uuid": "53ed51e7-837f-4fa1-9fcb-5c279a6edd2d", "comment": "Malware payload", "value": "7bbb579eb84ea8e28c53afd70773039096f97787a588008a1aa3efe98b0b4f04f8df0d5b567860d0450de6047b322236", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383203, "uuid": "2ebbc3ca-47da-4799-a14c-083c346e7330", "value": "T1CE42D98579849B03C5C56137FB0E93887B3A161CF2FF37436A2A6FA12747832096E456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383203, "uuid": "17d3ee65-3969-4ddd-b0b3-329b660d68e6", "value": "192:MjToJ3iN65TwnGp1b5B7OjFvTdGILEIcdqlUw4v6kEZx4e8J:Mj0J3DZBKRZlEIcdquHSFx4eI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647383203, "uuid": "8881062b-3125-487b-8059-7e46435769ad", "value": 12500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647383203, "uuid": "5d587a97-563b-4b55-80ab-3b05db6f7edf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647383203, "uuid": "e0b80ec7-1ef5-4862-a472-9f4fa55efc66", "value": "Ugliest.arm5-20220315-2226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7eec61-a495-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647372361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372361, "uuid": "06825eae-23aa-4d7b-a63d-b15d16edfe12", "comment": "Malware payload", "value": "bab1243b4f6f6f714ea42fca7a9600c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372361, "uuid": "17ac2d30-5147-44c9-8616-f4f4b602d690", "comment": "Malware payload", "value": "b183e020ba324a757a9f39db412769c32d9aa3b9706bcfde02872c0f0023d17d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372361, "uuid": "cfe36507-acbe-43b8-83bd-ad522f506508", "comment": "Malware payload", "value": "69d3c9b5ae7d6e596751d7beeab89fb18bf806a9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372361, "uuid": "2370dde0-0b0c-4520-9de0-283ae53cc0e9", "comment": "Malware payload", "value": "a22e7615852560feff8749a27c06722d373e2f948a94b06722d2105305c021e50ac13f120dc4b0d9d37a441a51d44556", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372361, "uuid": "36a7e063-f702-491c-9834-aad278761977", "value": "T195E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372361, "uuid": "b967ee30-7fee-429d-af6b-7ebfe34514dc", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372361, "uuid": "3a10b5a9-6d6d-4ff0-907b-995dfce59a2e", "value": "12288:E94YBCR2xP7guDo463OP4eGsiSOZjb2woE+MhJT:2kRAguDogPKddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647372361, "uuid": "389d02cb-bc77-49db-93b5-6a17a73c5073", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647372361, "uuid": "5b757c83-a728-4192-bcb0-a59482e67939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372361, "uuid": "b9301048-b4e6-4072-a95b-7f718236aa38", "value": "emotet_exe_e5_b183e020ba324a757a9f39db412769c32d9aa3b9706bcfde02872c0f0023d17d_2022-03-15__192553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a8ab72-a41d-11ec-9275-42010a9c0029", "comment": "Malware payload (Simda)", "timestamp": 1647320877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320877, "uuid": "2ad2895e-962a-4d1b-a550-ce7d095a8413", "comment": "Malware payload (Simda)", "value": "d4c75b5e4897bbfffaf10edde3c468b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320877, "uuid": "477894c7-76d2-459e-b268-f6d4e64fc36d", "comment": "Malware payload (Simda)", "value": "b1a72877c41f16f08ed32ff3d01ed51489c5a2e358f2866bceefd0e60156ed0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320877, "uuid": "a2b43797-53b7-4152-9ba2-b34c0eb021e9", "comment": "Malware payload (Simda)", "value": "be2e0c4fa2974da96dcfc60f3ba3d7369d209e16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320877, "uuid": "9b2e4d2b-f53d-4bdc-8799-661add886316", "comment": "Malware payload (Simda)", "value": "15eb055b32ed84f1513138bc87647438b555aca54af8b29afcead85e0a2bc6945fbc7b1d58fd75b0ee2ce372b82a6f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320877, "uuid": "9a06c10d-6dae-42ba-9f71-85fd2bd80ac7", "value": "T172D40293F38A29E7C2200D3F12F7230711B74A615375C59BE641A66D3AD65C8BCE2A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320877, "uuid": "094e882a-afa3-4b1e-be8f-59e0e3efb805", "value": "1c6c3b0bd56b7f130f1f283a88a358b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320877, "uuid": "6d607c8b-ac5b-4fb0-a815-4ec6c93515a0", "value": "12288:SysxVY1nZ+bbysxVY1nZ+bbysxVY1nZ+b:muZ+PuZ+PuZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320877, "uuid": "969ddf93-1cf4-45b2-beda-bc9151d5cc50", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320877, "uuid": "16212896-6f13-4c28-9daf-edaf29b2cdf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320877, "uuid": "141836e8-ec9d-460f-9cb9-449301fb85f2", "value": "b1a72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e90502e-a467-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647352361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352361, "uuid": "9dafb2b4-1b71-4356-815f-8db3ffb7ec16", "comment": "Malware payload (SnakeKeylogger)", "value": "e1296177aac9f48f6f7c998cebd0cfd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352361, "uuid": "90067ceb-dee6-47e1-8f0b-6bd910914e25", "comment": "Malware payload (SnakeKeylogger)", "value": "b1d421d4d731ea1d60abe6384963b3f22ecc445ada037396f510fcde40cdf98f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352361, "uuid": "f26abbf0-a0bb-4178-a979-3382a78c77e3", "comment": "Malware payload (SnakeKeylogger)", "value": "7841205987796cfb2fdb66ce0166190a995d1833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352361, "uuid": "bc7adbaf-6672-4fdf-a91c-ae52d4122350", "comment": "Malware payload (SnakeKeylogger)", "value": "232b675a49d654ce4c1a77a747b08e42e5c96d6317f9f524916b32872cca6069072b161a65b7620309ddeb674b4d91e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352361, "uuid": "8ac8e6fe-f20f-4e98-9c99-8f05de2ed930", "value": "T19105015672E48F83F4B6D7FA8539094003B6BC2A6829D24E5DC6B4CB66F3F404750B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352361, "uuid": "9a2e33d1-08eb-44ad-a08b-cdfe33510aa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352361, "uuid": "046559d9-e71e-42dc-aa35-65f3608d39e0", "value": "12288:2U5mJkwOEocEMgsRaXVvCrBblnlT4RS+zTTB/UWiLUZEnzKxUKaJPFsg9LytV:l5mqwOmgsaIRr9WB/niVzYUJJPt9L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352361, "uuid": "0d68a791-a1d1-4475-a5fa-bf84e4fb3e8a", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352361, "uuid": "01a771ca-00c9-45d6-bba4-60db15a92cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352361, "uuid": "836bed1c-7dee-4229-85ff-ebb665c88fbd", "value": "Hesap_Hareketleri_20220315_153829690,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4cbe2e-a464-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1647351231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351231, "uuid": "b12bc1ce-52f6-4ab1-b367-315434305a6a", "comment": "Malware payload (GuLoader)", "value": "9e5c44259e2972f348a877b61ad8a205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351231, "uuid": "e8ee52a6-f1bb-45ba-94c2-03c268bf2769", "comment": "Malware payload (GuLoader)", "value": "b23475fd35ad50c37f556ecafe225276f957c8af78b6e0dc0c12e73a159b2b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351231, "uuid": "3a6a0925-5ec5-4515-81db-3b498cf74358", "comment": "Malware payload (GuLoader)", "value": "b036217a8e00c33840b450e53302b681fe400e65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351231, "uuid": "fb049d6d-cfac-41c6-aa0f-c9e6959c775c", "comment": "Malware payload (GuLoader)", "value": "c21c88095306152a423f1b0fac65969b41aebf914c57c07994e093a01fce58724b19eb740fcb83b2bbdc4a3a35d373c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351231, "uuid": "705cc944-b610-4762-9b98-2173347a24f0", "value": "T1451502841D89C48AD9110F358AB75A379237CD2FBD7EA60ADDB27DAA2F335C5F908041", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351231, "uuid": "fa499072-84c7-47ed-80c2-9b985949d684", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351231, "uuid": "94133461-0712-410b-b469-3e621497a861", "value": "12288:Bbr/b9PiXsiKrKn8oSTsKu24uDbFE3bwI3V4tIT2oyJuKjmTZR9meDPUXx6:Bbrc8rrK84Z21Hk/xT2VHmTZRERXx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647351231, "uuid": "646f266e-f998-40e3-be0c-eed21bab3a4f", "value": 930176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647351231, "uuid": "dcc94b17-be8d-491b-99ba-99cf0faffe5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351231, "uuid": "3ee56927-43bc-4fd7-adb9-619bb86d8378", "value": "DRMMEAGTIGE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93a50c7-a480-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647363331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363331, "uuid": "ee18c5e0-cb3b-429e-b10e-3cdcb9ffb0af", "comment": "Malware payload", "value": "029f9e7af19d81a98b4338355b78db41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363331, "uuid": "4615faf3-80e4-45f3-8f32-dd709b92560f", "comment": "Malware payload", "value": "b24d2b4a9ac9fa16f493653e58c2a3f11c142999a4c77fc3090be370691dbb9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363331, "uuid": "29cd8858-99d2-4705-ab25-8da8bee5eede", "comment": "Malware payload", "value": "bd2889eb45fa0cd7c79371207825c4b2781c294d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363331, "uuid": "74f48467-66f9-4bbb-9de5-49fee91e5a63", "comment": "Malware payload", "value": "bcaa91a4da16fc1d8ebfa7ae9cd372651b9b2ddec63398248911af9eb438d895232c3ce38318e7f1df786f6d9f9a40d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363331, "uuid": "c1fe4b19-0407-4b64-b49a-dc667ce54c98", "value": "T1F9351211FAA0D034F5F755F459BAD7A9AA3E7DA09B2490CB52C42AEE56341E0EC3034F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363331, "uuid": "e68538fd-c92b-49e1-87d5-0c4d97a3caa5", "value": "ec534fb98de7e8c1f3b452dd02a2ecf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363331, "uuid": "2a160a07-f532-462c-9111-0c14412bc46e", "value": "24576:fGXu3QzdU4b6uXDD0xsWI/a0qhSf/UeZQKnYMTb:4dU4bloG/a0qQUenT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363331, "uuid": "5332fc62-7835-4b4a-9e81-8050324b28a3", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363331, "uuid": "4f298287-c1d1-4cf4-bd44-44a8b6c5f263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363331, "uuid": "c7a9726d-cc2f-4641-aca8-ab3eb79da2cf", "value": "029f9e7af19d81a98b4338355b78db41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f42fd5-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333816, "uuid": "fdaf8c5e-3653-4ad1-bdc2-965abf9134f9", "comment": "Malware payload (Heodo)", "value": "1df3c6b9d20142eea060b2a5bdc0ca61", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333816, "uuid": "295baf9b-3d7b-49da-a593-f0f382401162", "comment": "Malware payload (Heodo)", "value": "b2ca85e9fc62fd194cda60f5838194eded4c2f942afe01a6c5922c2d3f386208", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333816, "uuid": "006c83fd-e640-40b6-884c-4881a1171e02", "comment": "Malware payload (Heodo)", "value": "17e7d2a7a3075c8b155d637d2bdb3e72a1e70ccf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333816, "uuid": "3c76253d-efc2-40fe-b774-0498c55bd8a0", "comment": "Malware payload (Heodo)", "value": "a9a13bdb2e80752e92f1d0507f4129205cee50cbb1c00f91d35ed24bb7d9942435f35448fdcd1144581a1141c8d40af1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333816, "uuid": "130002cf-4915-4d95-9830-6a5729d8e7ab", "value": "T13873E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333816, "uuid": "bd4d7298-36f4-4c1c-8cf9-3e2c5d4b006c", "value": "1536:CuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:8tzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333816, "uuid": "05f840ae-6fba-4d4c-829f-7760fa57f2ce", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333816, "uuid": "48137dca-ff0a-48b4-adf3-e2c6aeb14a7f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333816, "uuid": "c9e35443-04db-4f2b-a8e8-fcb9bafa1b54", "value": "OMICS International.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146164fb-a449-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647339432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339432, "uuid": "a65ca81f-b07d-4a7f-8211-a645de89082d", "comment": "Malware payload (Heodo)", "value": "9a17d25dae5c360be42a39c5f36ea3bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339432, "uuid": "d12e222b-6b37-4814-a5c5-2577c421f293", "comment": "Malware payload (Heodo)", "value": "b2e75a6f4bfddd3b6c8cdd5aba8bd6712e2f8b520bc4893bf23a99e01e8c8acd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339432, "uuid": "b61d7bbd-4cdd-4215-ab07-b5483847c6a4", "comment": "Malware payload (Heodo)", "value": "23d22b9d22ee20e9d51969006118d228278730ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647339432, "uuid": "c4dc02d5-f9ef-44c6-a204-c9ef7fde6989", "comment": "Malware payload (Heodo)", "value": "af3b9c7e313b66b278b1eda8456a7c34633dda3311fd7bb68d27fc1f2268aa1a705e54f3f219651a02f88cadab834124", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339432, "uuid": "01b5daae-f7ca-4328-b8b7-17db277527a5", "value": "T1D524B403E98E437CC81FD4BE82AB723A1867C46D1B71D89BD2D5ACD877148E1993EE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339432, "uuid": "43059424-d72e-455a-910b-2d8be58d3af3", "value": "1536:/cH9LqZvMtFAfuaUxcVJKNTXQw//5r/ev57rBf2luwUrUQuxEQL08oEQlDq8eWXx:/oFqSxNTXh/5DaNaKUQA799Q6i7gLin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647339432, "uuid": "7d70c739-c7a9-4fb2-99ac-870b403a4bd6", "value": 229699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647339432, "uuid": "2d97b0ba-ab42-40ba-8e9c-2734237b2851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647339432, "uuid": "da34bd85-412f-417e-80f6-5a44c5f2cb8c", "value": "emotet_exe_e4_b2e75a6f4bfddd3b6c8cdd5aba8bd6712e2f8b520bc4893bf23a99e01e8c8acd_2022-03-15__101708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30bc982-a4b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647387345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387345, "uuid": "09a0859a-c5c3-40e4-9395-f377b1a3531f", "comment": "Malware payload", "value": "18cb228ab33391b317543a8081801f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387345, "uuid": "55152e6d-3c45-433d-a270-bee8dcc8f5b5", "comment": "Malware payload", "value": "b3c03dc87f759a1b0336cb34993bed8d35f9b4e5b28295ff57ebb968875d14e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387345, "uuid": "cde31c54-f156-47bf-99b5-54cc861842ba", "comment": "Malware payload", "value": "0a6fadbd97a795bf2e2de2d8f179b8f1f9e64c3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647387345, "uuid": "4ab0b91c-9c8b-4844-8261-1f9bc7ae6b4e", "comment": "Malware payload", "value": "ea11c17d81641e02db3223a1f932b050e3eed2f205fe41cb8de921bbea36492c9742e5269a6d4e7d9174cceb59815939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387345, "uuid": "f604f897-1cd9-4413-9f7f-e34ec9e19226", "value": "T1D1937D41F3E202F7EAF1093100A6726FD73662389764E8DBC74C2D529913AD5A63D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387345, "uuid": "a3faf1d6-ef73-44bf-97b2-313838d762f5", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387345, "uuid": "eb761ae5-600c-45e3-8063-eb9d49501dc9", "value": "1536:T7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfiwZnDOf:P7DhdC6kzWypvaQ0FxyNTBfiec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647387345, "uuid": "bd65a389-5ee9-4bdc-93c8-7be7cc34f983", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647387345, "uuid": "0ad3b45a-5e94-4c9f-80c6-a83403180fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647387345, "uuid": "a3a1dded-59be-466c-a1c5-4b9d7a68606d", "value": "0a6fadbd97a795bf2e2de2d8f179b8f1f9e64c3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d1c849-a430-11ec-9275-42010a9c0029", "comment": "Malware payload (Urelas)", "timestamp": 1647328777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328777, "uuid": "8d43f8ce-e41e-4e4d-9c67-e08a8e46116f", "comment": "Malware payload (Urelas)", "value": "19e28366522d009e73cc44df79b81220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328777, "uuid": "4426636d-55d6-4f3a-b63a-f6056d8670ac", "comment": "Malware payload (Urelas)", "value": "b4c3ed79e81647d22f956c0c73876362a49c17d0d893c5f17e4772a5171a5dcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328777, "uuid": "d9cd2d4e-fd0c-46bb-a666-7ee829f67b5f", "comment": "Malware payload (Urelas)", "value": "a2fd4bc1f186bd0bf50c1ecc8aa576829ac9241e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328777, "uuid": "b5695d16-ffd3-4a90-9fc3-849e3ac619aa", "comment": "Malware payload (Urelas)", "value": "6fdc2772bf1d5d765559e737acdca8643b11b1360a864b25258b68ff713915c4cb27b5d4c16a1937b4cddb4a2db2bca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328777, "uuid": "93345728-1cf3-4cdc-8e72-660ad1a06022", "value": "T1F4D47C123A91D073C41D1C30C455CBBE4A7DBD324A668987F7951B2F5E313E29A3B38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328777, "uuid": "32aadfb8-f8db-49e9-9fb7-71bfbe4ea783", "value": "2d079e67ec3c8cb76fdef6be53c3af0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328777, "uuid": "2042442d-32e1-4a66-a031-3fe3e922f0d5", "value": "3072:+D8WJnu1zNSTeReJ3vbNLWADjti550jmO:+D8WJu1UTNLtDj04H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647328777, "uuid": "1206df0b-0099-40ec-b522-e0063adab92a", "value": 625065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647328777, "uuid": "741c3f28-11c8-444e-999e-2b2d54a469e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328777, "uuid": "139aaf9b-0b40-4db3-9ac1-26ef4ea773b3", "value": "b4u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f70a5a-a453-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647344030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344030, "uuid": "1c42ab5b-5ea1-430a-9a9c-df05fd7f2ce0", "comment": "Malware payload (AgentTesla)", "value": "4b0ccc7faaf1a7a6ab80c56cb2619807", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344030, "uuid": "a69569fd-98a5-4d0b-a8c2-17e4988f4213", "comment": "Malware payload (AgentTesla)", "value": "b4e52575a9e73412a60ee894f756b3547e5c38ce5b1d7b3cc59a37ef47fbd4fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344030, "uuid": "10f449d5-b645-444d-8dfa-809aafdcf445", "comment": "Malware payload (AgentTesla)", "value": "67ff5fef6db5f30f51d7beb854ca5dcdfcc09b08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344030, "uuid": "837e8b6d-6deb-4dc6-a16f-450aac03c299", "comment": "Malware payload (AgentTesla)", "value": "018642b4f713f8b9e62db358b55a2b0680f75f6d00bba2d81e85fe34036f4d881ae81f17b955d81e82438d627bf08cf9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344030, "uuid": "e94ce58a-673a-43fe-9089-3562aff40f57", "value": "T158E408ACB22031DFC85BC572CA681C68EF90767B930F9117906325AD9A6D997CF14CB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344030, "uuid": "1a833a17-c74b-4e96-8dca-f0d4c27c79fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344030, "uuid": "b2e141f9-402c-4bbf-82a0-85ffb347012a", "value": "12288:GdWjctE3fGZ5B1WIi/nEyZ9jiqJaeEqdpp7TuP84+AW/iCD8BN7fwDIFaSTNORBi:Gkc3SxvXZBHJ/EqpuZDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344030, "uuid": "006d3b9d-e7eb-4215-b346-4d1ce1db1e6c", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344030, "uuid": "00d740e2-7451-45cf-8c64-6a37a2717ad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344030, "uuid": "5b96f78d-e97f-4088-b793-6e579ab78879", "value": "Payment_Advice.PFD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931fb74c-a49a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647374434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374434, "uuid": "5d21fd0c-2ebb-44ba-9ae0-f44580833778", "comment": "Malware payload", "value": "a1d5cfd587e2d85d6a60548d2112323f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374434, "uuid": "e603e7cd-d15d-45af-8f54-e385c12edf49", "comment": "Malware payload", "value": "b4f28f47ccb540eabe7d215f25b8b2ed2c54cbc663706b103d933d32b12be1de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374434, "uuid": "b6fbd5b4-7dc0-440b-a4c4-c4c9e5c7d6e4", "comment": "Malware payload", "value": "1baab438c9b7f69e2fd2dd96f351945904eb8332", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647374434, "uuid": "0c49390b-f63b-49d7-a2cc-d3b613282ce4", "comment": "Malware payload", "value": "ad330922398c8f2f7bec11f3e9755ffc62ffc65145fed93e945eccb29bd6cc0051943e4abc11b78dd7b5088acdc61c66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374434, "uuid": "40976a7f-67fd-4709-9769-3ccec1b0b8a7", "value": "T179E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374434, "uuid": "b932ff23-7218-4179-951c-413b54148835", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374434, "uuid": "41a3506a-51f8-4d67-a27c-82b8f3107e81", "value": "12288:E94YBCR2xP7guDo463OP4e2siSOZjb2woE+MhJT:2kRAguDogP6ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647374434, "uuid": "b73a05f6-43d5-49fb-8afc-6bc9ba7dfd40", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647374434, "uuid": "5cbfcef2-3b2d-4ea8-bbfc-1a277ef31e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647374434, "uuid": "daac4e41-1311-47ef-a604-9a5370e5f40f", "value": "a1d5cfd587e2d85d6a60548d2112323f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d34dda-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333794, "uuid": "1c9e6033-b9bb-4edf-97d1-4d68bb471076", "comment": "Malware payload (Heodo)", "value": "fe07da737ee1762d78ab5de51e23d34c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333794, "uuid": "eb337a8d-ca77-40fc-9e03-bea7be40e19f", "comment": "Malware payload (Heodo)", "value": "b559ddbedfcba914692c456b49ee491fdbc889c8fc8cb0860d79922f5fc522a7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333794, "uuid": "3c8730a7-3ee3-429c-9b5a-4e82e0b6ed46", "comment": "Malware payload (Heodo)", "value": "e2116abfab3d82942c0c44add761e4091f9e4cb5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333794, "uuid": "79159446-5c81-435e-b9db-c030cf76893e", "comment": "Malware payload (Heodo)", "value": "22c862f347f8242b7f2bc9acaabe1e7556eb5ee31bcda190ae01ada1af9dc116437966b6b1699610844294cf5098146d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333794, "uuid": "26a0c69d-13ac-4bca-a03b-65a45dce6c53", "value": "T17073E12EC232E55DCB2744BCD18E4FA7944F751A3BC0E5BA43C0F64D2A04AB6578E25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333794, "uuid": "2b171af7-f001-4e32-a9f3-ca75bfa3631a", "value": "1536:iuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:ctzSmICpH7OZuvZGsMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333794, "uuid": "8a02f8af-cffc-443e-9e89-585f79cf8643", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333794, "uuid": "d6de1d0f-7a94-42bd-bd0e-4f0b6cd45c15", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333794, "uuid": "52f1f0e0-b0d8-42bb-9780-077862710f88", "value": "iMedPub LTD_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95762fe1-a480-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647363271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363271, "uuid": "77325dfd-ee4f-40c2-ae2c-c74306d91641", "comment": "Malware payload (Heodo)", "value": "18bd0d455c5ce2932916185e1531fd96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363271, "uuid": "ec93747d-b88f-468d-81a4-4c2253067683", "comment": "Malware payload (Heodo)", "value": "b56ce3075307a1325bb89858612222728f090d2c10a887fe8f4aa76e7935aa0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363271, "uuid": "47f46afd-4267-4aff-90a7-409767f135fc", "comment": "Malware payload (Heodo)", "value": "d006f93554829f96667dc89ac17702ad12f7a272", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647363271, "uuid": "eb6b19b0-297c-4246-84b3-231ab007a2ea", "comment": "Malware payload (Heodo)", "value": "f3c05b3419de9b3527e34ef8c5dfc9e3e27060d45024373f00766e447acf6ffe8e4d3332eb900b97500213319ca61839", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363271, "uuid": "d86dfae2-51d4-493b-ba55-3b51926b5a8b", "value": "T1D4257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363271, "uuid": "05802530-de8d-4e64-b3df-e3332c6a5050", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363271, "uuid": "42061946-8282-499b-a508-84d8e522ab53", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlpOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Nl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647363271, "uuid": "703e03f3-c1f9-4bfb-86a3-9e176fa312ee", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647363271, "uuid": "263cb712-9d2a-4b5d-b316-da68b3cd0990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647363271, "uuid": "f13975f2-b22e-4b21-9496-587d8b797f58", "value": "18bd0d455c5ce2932916185e1531fd96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad7ac5e-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353777, "uuid": "b1a59d77-8fc4-4d36-8386-76e0bfb847ec", "comment": "Malware payload (Formbook)", "value": "66b06eb96dc322364c8c2294ade5b72b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353777, "uuid": "54ebdfb1-74f4-42f6-9d13-9ef1bb1700a1", "comment": "Malware payload (Formbook)", "value": "b5f68589e66a77f33e475e9af009e1bedd6c11fae42f65da1886100bd11bc3f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353777, "uuid": "09a766e7-ff38-4e4a-aa11-cb96d302fc5f", "comment": "Malware payload (Formbook)", "value": "dbe08790fdbf852d91d2f8533125e0a3d0747dcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353777, "uuid": "2e21dd20-607f-41e1-9a76-89f6ae344662", "comment": "Malware payload (Formbook)", "value": "da0ff8b17a97f7868123e0845c732a062969574aa1e17308474de5257d6e486df9d5e6d96995df8536c7d99348856482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353777, "uuid": "d599d2e0-1dfb-4611-afcf-9292ad3fa8c9", "value": "T1DA05120A33E88B82E0BADBF78875560447B5F169191DE749ADC670CB18F3F0187A5B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353777, "uuid": "016e21bb-3b51-49e5-ad62-8b615b7176a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353777, "uuid": "c3d5f8fa-46b1-451a-aa11-ad0d764a1ece", "value": "24576:ZmLwOdBPD82erhMmyOR2+hqa5s+GTkC9iOKFZ7F:Zqfbkr63+hqav/gi/FZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353777, "uuid": "8c31ac8d-a5d1-4796-b09a-c45f6f8f0821", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353777, "uuid": "e41b5f47-645f-484e-be43-293d78b92d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353777, "uuid": "16436dc5-8d2c-4d2a-a7f9-6a147b1b1542", "value": "Payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac25247-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647354529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354529, "uuid": "44a5075f-d619-493b-a2b2-d1b14e6b88bb", "comment": "Malware payload (ArkeiStealer)", "value": "fe73ad9ae29a8cab1384dae71204e013", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354529, "uuid": "b70b6738-2f06-48f2-8900-935af4d5a15a", "comment": "Malware payload (ArkeiStealer)", "value": "b601b8c369fb891bc3856cab793446efde8c685d4c2ef4b556fb35b46253ad7d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354529, "uuid": "5fa0ddd7-36aa-4bb5-8c28-5331a2a62456", "comment": "Malware payload (ArkeiStealer)", "value": "aaa2ce45970cac4d46ca8ef2c708463e3369dfb0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354529, "uuid": "00667bf8-f005-4f17-be87-7a574e155866", "comment": "Malware payload (ArkeiStealer)", "value": "7f8f917b3a11697f03b7500cf507a5ff72c55d2372e4dd7d0210e99fc27197d4bcf15e70f3ea23e07a5814fc9434106a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354529, "uuid": "e4744a27-d7c6-4f10-989b-7309aac81576", "value": "T19F54D091BB60C432C1A3113BED25CEA27A7FB4325975D64B7B94037A1FB13C1AA75306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354529, "uuid": "ecc73e56-1f26-447a-b362-5e88e873a3da", "value": "937be297ca9fffccd10ddba731ac45ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354529, "uuid": "c0429268-1999-4dd6-93a6-292aea9107b3", "value": "3072:bXb4k3cIgYYMTNAdVIzjbJmWHgr5mOFqShcE2:X13cIgGiV6f4gLmfcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354529, "uuid": "3e8b9caa-5643-45d9-aac8-a66ab3f1a2d2", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354529, "uuid": "fbbce0c7-0f8c-4eee-a5b7-9c654a9e9ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354529, "uuid": "309563f2-8d94-4b43-8491-52dfbe20db38", "value": "fe73ad9ae29a8cab1384dae71204e013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d58297c-a488-11ec-9275-42010a9c0029", "comment": "Malware payload (Cambot)", "timestamp": 1647366666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366666, "uuid": "fe1b25e4-6edb-44f4-a8b7-8b17dd1bb287", "comment": "Malware payload (Cambot)", "value": "c3494cc8b3aac24903c0ddf8095d919a", "object_relation": "md5", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366666, "uuid": "73026866-c3aa-46c1-b9bf-9cf43ce2d5dc", "comment": "Malware payload (Cambot)", "value": "b6137dce9ddca24ba720d65ffb2fadac112e268e3be6e82fdd30c778f34249c0", "object_relation": "sha256", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366666, "uuid": "a9ebf8d1-e726-43bc-8d4b-ff8d202a380c", "comment": "Malware payload (Cambot)", "value": "1cd912956beb9c0419fe89c1d555e0480d9d182d", "object_relation": "sha1", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366666, "uuid": "e690f6a6-d6aa-4001-a792-9bedd0894721", "comment": "Malware payload (Cambot)", "value": "3dba56f917a36fc407e796b8f2d2ff4b0e3727160559c9f4419b67e0892bd0a7eff69932ffd31db2ed09583ba8b6dd29", "object_relation": "sha3-384", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366666, "uuid": "6fbd06c6-2bc2-4f50-bc59-c4ca0b82eba4", "value": "T19134AE33B3D40A85E9EEDB753BA9C6F9622375187F23618A2108677D7C15E204C19B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366666, "uuid": "cf06eaae-392b-4ed8-a4f2-0cee892979a2", "value": "3e8ae3bc85823ef9afa9731fe8e9fda0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366666, "uuid": "2eb1a0c0-0512-46ed-86df-8838e26abc7d", "value": "3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1:Xo/BHng5HaVG4G/1z+QVMbg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366666, "uuid": "f955fdbd-47cc-45e6-96ac-f7f7f562ec69", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366666, "uuid": "e775bfdd-4ca0-436d-bf17-da4c712b0f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366666, "uuid": "0d36b971-2bac-4e49-b290-135d4670798e", "value": "b61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c454da90-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647354759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354759, "uuid": "e9a64e8a-d74f-45ce-8ba6-950f54516306", "comment": "Malware payload (Formbook)", "value": "92622eaeff7428021e9ebac1b490ad92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354759, "uuid": "82a15dee-1f1b-481d-996a-954c2f20e417", "comment": "Malware payload (Formbook)", "value": "b658c25f1973d56d96fc267f7e626aadf9c6785b1f0a30906b5311dad24e97ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354759, "uuid": "32764012-2016-4277-aefb-1b8a68b07802", "comment": "Malware payload (Formbook)", "value": "cfb18eb436988b60aad2b8b8176518cbc5ead39b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354759, "uuid": "6679faf8-5c8b-4c52-8ccf-f62b3794585d", "comment": "Malware payload (Formbook)", "value": "1a65432ebfdf1d991a1d5845a18a122c30823c0cc70fba49476e0956809ac912f4242732bda9003ccdcf61ed47b59e67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354759, "uuid": "9732d42b-bddd-4ccb-963d-9478e635a1bb", "value": "T103F4CB2A38BA100DF261AD6C6BBCB176915EF7F226365CB70DF7050A11129F0CB9D627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354759, "uuid": "d90632db-ba91-4bca-9a95-de1fee70c525", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354759, "uuid": "2e13e554-50a3-4b2e-a9a6-e6e135876165", "value": "12288:kmh4J9EAXNRFkrYEID7STduSghxtH9Gr0UdSKhbXeU9ouJ91ds6xEk1rHx35:/IaKhceUJhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354759, "uuid": "7461a43c-4f51-4f6d-8af6-07c255d72242", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354759, "uuid": "24af2321-8d89-4f19-8916-74b351b178d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354759, "uuid": "d25b35d9-2608-425c-a280-5e78785a7fdf", "value": "92622eaeff7428021e9ebac1b490ad92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca11cee5-a430-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647328999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328999, "uuid": "25cb5250-9710-4b66-a1f0-b721e5ef12d9", "comment": "Malware payload", "value": "304f5ea1250b398f3856a66d7cb8d594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328999, "uuid": "2a3039d0-e1bd-47aa-82d8-0ce145243931", "comment": "Malware payload", "value": "b677b71f1e72a3c4bf28230dbe8e4dd94da3aaaff30b827804c5b205b11c99d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328999, "uuid": "c63196c5-29c8-441a-8ca9-d84041345bd3", "comment": "Malware payload", "value": "85c0815b2010f5241fbd37feca4044a9149bba78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328999, "uuid": "b83003c2-1ee5-4b1c-8485-31243ffa0a2c", "comment": "Malware payload", "value": "37999bf7e9aea24b39fd2ee76413b13c6675026a8e378e53411fff041dfecd3fb1058c830d58efe5cc2165cd0562221b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328999, "uuid": "47de3be8-8fec-4e40-a1a8-7db1642dc44d", "value": "T10CD30217F5E2D533C0408A7EFE16852A96BA77153E7CCA8066F45F9EC81A1806E3C1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328999, "uuid": "0d1d3903-f6eb-41e7-a3fc-b2b01eb29e9e", "value": "2deade72ab849e6107d0c9687fe3c88d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328999, "uuid": "f16ef848-0004-44af-a28f-ead44ae5d957", "value": "1536:hklqZEg15i1qf5YRxZgX3ZiRVY8v2QfKrXyL3XWf74E+Y/WlPBcW:h3t17S8ZiRVY8voXm3Il+YeoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647328999, "uuid": "fcae9bff-3fa4-4d08-b3bf-bb68869a1960", "value": 130895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647328999, "uuid": "0fbd8630-e4ce-4cf7-9db5-900852db57e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328999, "uuid": "ecfa21d9-4ee2-461b-bc2f-e9861ccc8e32", "value": "7bfs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e86602-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647353131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353131, "uuid": "215b3148-b1ac-4180-b1cb-1adbf516b3d3", "comment": "Malware payload (RedLineStealer)", "value": "eb8faf965da01cfd0e957717f0c2a0c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353131, "uuid": "655edc29-0436-4d99-b9d1-bb8f3806cae7", "comment": "Malware payload (RedLineStealer)", "value": "b7687a35f92757b75447bd7decafe34f00d75a6344d2732a52ef5ad3b297daf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353131, "uuid": "fee61683-2f2b-412d-97b2-0c3aa777ed35", "comment": "Malware payload (RedLineStealer)", "value": "9ba8c6b1d488d4be441b7c1815f1fa0f665bb603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353131, "uuid": "c29f5299-8815-46e1-a372-9c6fb6643bbe", "comment": "Malware payload (RedLineStealer)", "value": "cdc643004edb966403b6d2fb78111e211ed4903c2074ec5101aa54d968b29d100d13f0bb56d3915b862c1f4409d25f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353131, "uuid": "14d84f1c-2d36-4e46-8f0c-9c013c0a09d4", "value": "T1C984F126B691C031C10251B55D25D2B2A73EF5325A39C90BBB9D1B6A5E213C17FBB30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353131, "uuid": "6dcbc9ca-72c4-4ddc-9a3d-e5d70baeaa64", "value": "c4715cf6be93a0d532bbd0073142431e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353131, "uuid": "1b1b8565-0860-4ccc-bd37-db6a8500e321", "value": "6144:kfC1IbLYJtfz1kY4SKr+t0G06hraCyzyADrinxyvow:kfC1Ibuvo+AwaCAJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353131, "uuid": "31345d2f-56d4-483f-9013-ccebafeda857", "value": 386060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353131, "uuid": "035b413b-5946-43fa-a3a7-baef48404cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353131, "uuid": "6f271862-aa11-43fb-8e08-8e48c43cd606", "value": "eb8faf965da01cfd0e957717f0c2a0c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dc2c32-a470-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647356351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356351, "uuid": "1dacb239-61f3-40ff-b30b-4c6ea9a64ca6", "comment": "Malware payload", "value": "c13d6b033bdcdff84b7a6f6ad94afed6", "object_relation": "md5", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356351, "uuid": "4eadba53-eb3e-47b7-9474-74940d26d700", "comment": "Malware payload", "value": "b7ad8caa3b449f8a9c8292e069754562ab0e34f599bb79dd72f78bdf13476bc8", "object_relation": "sha256", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356351, "uuid": "a8c5dd1d-a9cb-4f87-8af8-a118e54dbb77", "comment": "Malware payload", "value": "33dd4cb1df99d838ec2d3c285800d179c8d2cca5", "object_relation": "sha1", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356351, "uuid": "d7fc0c4c-0483-491d-afe8-adcb612876b0", "comment": "Malware payload", "value": "bbad1a3965da5ef8dc2ccf3b931bfe6226815d79ec6dfe8a137c38d9ce6f15f4042a80af653a0b675b355f2e9b6118c8", "object_relation": "sha3-384", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356351, "uuid": "2a5ca3ff-93c7-4651-a05e-5dc7fa066516", "value": "T112A29063305FF10F1054133A345807E668BEE549C6CF8A4DFB8D8EAEA09DCDB2A586C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356351, "uuid": "3aad5195-1de1-4252-9e2e-e625405ef08e", "value": "384:keXiX++IWY6qtX1U361J1REIPAUTwtD0KGtVTpttttMgtttttttIQDI:kbUP4dB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647356351, "uuid": "b8734e9e-e7d9-4aba-853e-73fc522eba17", "value": 23371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647356351, "uuid": "f9d00063-33c0-4b60-b684-8950c74c9a7e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356351, "uuid": "63b582a2-8edd-4197-90ea-e813c5a563e1", "value": "zNBsKZzJ.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86170602-a488-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647366681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366681, "uuid": "78df7564-3245-4439-b1ce-5673de75c9d5", "comment": "Malware payload", "value": "2a0c3489d3b84afd44f500d843e505f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366681, "uuid": "e26d8f12-366e-4790-a73e-1dbb1dcd571b", "comment": "Malware payload", "value": "b81bd81219214c5730d96fd03f8c3735160b45251cc803941cda17528f9dce86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366681, "uuid": "fc497c11-566a-480b-9e12-3c82551c24bd", "comment": "Malware payload", "value": "775d4428a50a318f5eb6e6d61851f0e34a149ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366681, "uuid": "d02d88d6-96b7-4a15-b293-389c1686d04b", "comment": "Malware payload", "value": "a52a0181014696e8ce7f4e680c1211686d2bb86446ab1f832fc48dd2e0b90cf773f1af853130f4ba55550f5fd509b1db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366681, "uuid": "b51327a7-a755-4bd5-be99-9334c1d1a415", "value": "T1FB757E43A9CCB576CB9B02372A94DA3811E82190D7484B02FBFD397ABFC6AD1354E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366681, "uuid": "2ee35351-4ac2-4d5c-9d6c-4ccbf0c48a95", "value": "4753904c40d638a1bc745c65b88291d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366681, "uuid": "9e7ace30-b3c7-4b20-ac0e-530858d94e41", "value": "6144:2DVYVDViVDV3VDV2VtVDViVDV3VDVYVDViVDV3VDVoVtVDViVDV3VDVYVDViVDVZ:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366681, "uuid": "8f65ecce-e884-4bcc-8767-827be062547f", "value": 1654784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366681, "uuid": "31d05ca0-b5b9-4898-8f55-3789bb34a1ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366681, "uuid": "4999a615-e34a-41d9-91ac-683ceeebe97b", "value": "b81b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05f6af3-a495-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647372362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372362, "uuid": "84413d6b-e7a2-4781-8386-fb734280836c", "comment": "Malware payload", "value": "f90faa3a78ce9646a44c6667ba5e014d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372362, "uuid": "aa50385d-1779-4901-8745-f09bb91b1b93", "comment": "Malware payload", "value": "b8210ca62e125db005e00c3e77fcf0920291c43dcc32c4f6b0f6f38ffde09348", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372362, "uuid": "6235d58c-3a53-4b22-b0de-3cc96bbd4538", "comment": "Malware payload", "value": "c4cc885a28aaf6e4d152fba92d56e4d1c72dc28d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372362, "uuid": "269d8231-b83a-470c-b5f4-8899a2d1b70c", "comment": "Malware payload", "value": "0692a6032b634fc7041e7207cb58d3883226e2f9953bb0e026849e0bfa2c6f861fb3b478c70a3dd50675020a76b76599", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372362, "uuid": "d4aaacec-dd88-4f26-a067-e404daf441a6", "value": "T1F1E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372362, "uuid": "8838f92b-361e-45c7-b81f-5004cc04ee8e", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372362, "uuid": "35b67019-7a68-4678-a560-cd90d6591be7", "value": "12288:E94YBCR2xP7guDo463OP4eosiSOZjb2woE+MhJT:2kRAguDogPkddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647372362, "uuid": "f7cbb0e8-5841-47ae-9def-e9cc0f2cf40b", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647372362, "uuid": "a24759c9-61a1-4e57-aac2-a33985f3d435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372362, "uuid": "919601c2-200c-4ee6-9b51-cf57068a514d", "value": "emotet_exe_e5_b8210ca62e125db005e00c3e77fcf0920291c43dcc32c4f6b0f6f38ffde09348_2022-03-15__192554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48cd2f58-a455-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647344674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344674, "uuid": "e195041f-915f-481f-978f-d59b0d6174b5", "comment": "Malware payload (NanoCore)", "value": "eb96839d07efdee3240632898a8a65e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344674, "uuid": "0b9b9dd5-ec76-4acf-ac26-1c67e9d17e9f", "comment": "Malware payload (NanoCore)", "value": "b977b04f2072b83a299423cc05daabc62fab53933fde03daecc75baa34d374f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344674, "uuid": "360cca47-9da0-4c4b-97dd-cfdaf8a62123", "comment": "Malware payload (NanoCore)", "value": "bb02c233f19f9490d15660c4b3d07f0f594f022a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344674, "uuid": "c77915bf-21b1-4298-8584-8b93ebb5f46e", "comment": "Malware payload (NanoCore)", "value": "a8990d6d1702ea9cc6effc6c11b1e85a19971a73f1713a8551e76b913d9eced2c742c2ffe636648a8ac71ef5003a7559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344674, "uuid": "8c2e2085-9a09-4ed4-8cb7-f3a85b88d193", "value": "T13115120773E89F43E876D7FA8962150453FAB15D240AE3491CE630CB29F2F018795BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344674, "uuid": "4b577075-6e08-45c8-85ee-c709b3f998a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344674, "uuid": "fd3db6d6-61ec-42a6-953a-8673d1b07984", "value": "12288:0EmdkwOEocEqQDeFr957lMRJCji9u7wNnf0V0VkEDyG8PHvliSgXBSLIX:dm2wOHDeFr9PoDgMtflejvdiSgXAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344674, "uuid": "5eeb4201-042f-4ee0-a154-dbd6fd7be9fd", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344674, "uuid": "91ff7178-f05a-46b1-a0d7-a18a44f13659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344674, "uuid": "4187b286-3c4e-4017-9022-748170ad4c31", "value": "REQUEST FOR QUOTE_Spec of products_Pdf____.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2b3218-a46d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647354934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354934, "uuid": "eeff3030-b25b-4d3c-98e9-efd03bc231a1", "comment": "Malware payload (Heodo)", "value": "9688c06ab514054724bdf1257197cc92", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354934, "uuid": "396beb4b-68e4-4fd7-b9fc-9b24688beb89", "comment": "Malware payload (Heodo)", "value": "ba4fa94dc652fb8d618a8a0fc298c93b9e8cce3331fbe2c39026b7203ffef8b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354934, "uuid": "077f71a6-217b-426f-b738-a179c7e6d845", "comment": "Malware payload (Heodo)", "value": "5b207ccc144ad6a46ca0fb9ea447b8f9d2783652", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354934, "uuid": "8e89dd88-320f-4ae9-8d12-b765d82a012a", "comment": "Malware payload (Heodo)", "value": "a43c133de4115883117593f2602fbc6b9c34f8348101557f7df785d6d722171c79e307cc87026391b1ad4331758c0554", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354934, "uuid": "bb33e540-07b5-4182-b66c-8631e7c84021", "value": "T190257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354934, "uuid": "1ad8b186-5bc1-403b-a7df-fa8108bed8b7", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354934, "uuid": "c41b679f-82b4-444c-92dc-05f35ec6759a", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYKVP6FuR6shQLj88F+Krf6:v6oycln8cACi9P68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354934, "uuid": "9b30b75f-196c-4cab-837f-14c1c72e83f5", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354934, "uuid": "92d9c122-3aa1-431b-8e03-eef1c50b52f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354934, "uuid": "d21e0372-aca3-4e92-b8c5-a0d3fc223b73", "value": "R3lPMRyLzG5285aqFKrAK3bURoWr9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487be571-a49c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647375167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375167, "uuid": "13dbb905-8db2-4f6d-9dec-09e17bf1baf8", "comment": "Malware payload", "value": "ce7d01390791513a4e5179232c3e7080", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375167, "uuid": "42764758-3a06-43a1-99cf-86f123389ba1", "comment": "Malware payload", "value": "bacd965aab353f446418a1f2beb96d447e5fe663404e0e79c2282b6946333463", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375167, "uuid": "85ddccb3-6e8f-4ffc-821c-4badb695c481", "comment": "Malware payload", "value": "03e48d2bdb9cdf8ffc1c9eb4b64b96e3d255060b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375167, "uuid": "43db2d7a-ebe4-4ecf-a780-13a28e881415", "comment": "Malware payload", "value": "a0284ecb718334928840814ea3e2129e5bc337621bbda0cd24d5eac0fd0590c464467eee3e980134038ee200e8661015", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375167, "uuid": "bbafe473-0523-4a55-8211-d087b811ce61", "value": "T111E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375167, "uuid": "9c2e0c8d-f153-4956-ba37-8f6daac505f9", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375167, "uuid": "0c96d317-7a44-44fe-8ef5-00d125241324", "value": "12288:E94YBCR2xP7guDo463OP4e1siSOZjb2woE+MhJT:2kRAguDogPhddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647375167, "uuid": "04e33d1b-f840-4b76-b75f-03d2e6d43c49", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647375167, "uuid": "86b95674-9871-43f5-8f17-0ddba37f2567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375167, "uuid": "c78a3101-cf03-44da-8757-777907fc2597", "value": "ce7d01390791513a4e5179232c3e7080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291b3bde-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1647352781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352781, "uuid": "772d8feb-9dfb-4b46-8b1d-35dbcd74db51", "comment": "Malware payload (Socelars)", "value": "83988d16e65e206e6f6c6c849e2d6614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352781, "uuid": "7f51f9bd-08d0-4a1d-a020-529541d7e944", "comment": "Malware payload (Socelars)", "value": "bb22665f38590ec0270614069a88396882429e12a3cae64cdcad949103bb9b79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352781, "uuid": "0be6e323-9bcf-4a69-beed-2f48d0263a4a", "comment": "Malware payload (Socelars)", "value": "5da341253d6cd99ea9a827609e8b3e344d5060fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352781, "uuid": "890542f6-ada5-4ea4-8b98-cd9caa488786", "comment": "Malware payload (Socelars)", "value": "1ea3690cd08ac653d5c761e7558870f829969fce82d98dd56fbf8f0989ec12337ef900fc5405e69360dd8d5293769ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352781, "uuid": "a3597e88-76d3-4c03-8ab8-66144ed13420", "value": "T1B1658D11F6426036EDD3107292BF4EFE9D686D12030494E7D3C47EAA9E725E2363369B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352781, "uuid": "a4b2db50-df7d-4066-90dc-b7fb603865ec", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352781, "uuid": "002aa7cd-207c-4f4e-83c6-40b03cd312aa", "value": "24576:7KAgpBGV2HpWHuREjDnI2AuADZ8KvqC7mH2dtDPc/d/KF/Mg:HgpG57R8jnDPc1/K5Mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352781, "uuid": "ba123df3-16e7-4e83-81cd-3c0f8643dc24", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352781, "uuid": "38972148-c354-4621-88a2-76ee381124d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352781, "uuid": "65d3b7aa-613d-4c2c-b89a-301e084180f1", "value": "83988d16e65e206e6f6c6c849e2d6614.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d67472-a450-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647342474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342474, "uuid": "e264ff92-8849-4082-b922-d6bb87be298c", "comment": "Malware payload (Heodo)", "value": "773b2580e812cb1cb9d4be06e0c88fb4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342474, "uuid": "d685f520-fb7c-4db3-b0ab-b6e1d40e585b", "comment": "Malware payload (Heodo)", "value": "bcbcad1ebaebcc920ab2057873ecfca454e5612ae327d04ac23af6c05ad6f87e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342474, "uuid": "4a0c77d4-1978-4138-a49e-b0fcbdd2dd60", "comment": "Malware payload (Heodo)", "value": "6fbb8a54b857ee3efc8c51374c301964a531981a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342474, "uuid": "e1440719-6ee8-4445-aa57-de7082d79bac", "comment": "Malware payload (Heodo)", "value": "21c5314e04fe54bfbcb95a2641e26c7682d470145355069264020fee48f25fa1660375d01c580f029277e6216ada387e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342474, "uuid": "45892dd1-5e69-40cd-b46d-f7a51b8ebade", "value": "T11973F10EC232E15ECB2714BDD58B4FE7A40F79152AC4E57687C0FA4D27449AA638E31E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342474, "uuid": "43e17345-b9dc-4d82-8f21-a9bbb3994c24", "value": "1536:y1RPiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMdVIit:y1RiCtzSmICpH7OZuvZGsMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342474, "uuid": "940f7f6a-f446-449a-b3d0-fe881275ef4e", "value": 75911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342474, "uuid": "caf6e8a6-33e2-4d6d-9189-edae41fa181b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342474, "uuid": "891809d0-129f-464d-ac3e-f844b9e76be9", "value": "AVIS_82347.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b45d18-a431-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647329210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329210, "uuid": "7dba8dbd-5436-4986-bc04-c9ea755e9a56", "comment": "Malware payload (Formbook)", "value": "fabc474df9fba75f658f28c18a61dc78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329210, "uuid": "85e9ed5d-26bb-4013-a01b-22e258a2195b", "comment": "Malware payload (Formbook)", "value": "bcbf8a906dcee1a2cf55c638b4fd5c815d93b764bc88038210edfd7cb635ac69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329210, "uuid": "a2f523ca-1ede-4a49-ad79-bed992f12545", "comment": "Malware payload (Formbook)", "value": "0c11ffa35e85a3626aff7bcd6009adfc8b2f0e27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647329210, "uuid": "9e767464-c8b2-4c8c-ae40-1c64928e2a3b", "comment": "Malware payload (Formbook)", "value": "d5e7076acf994d310af811fb56703505effb86291109ee078b9a3716b74a0170808d4490265c3d0b488d108621b059ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329210, "uuid": "846ac66b-39fd-44d3-94f9-7144bd8df83d", "value": "T1E705010AB3F84F82F07ADBF785645A5487F5B06A0509D6494DCB70CB29B3F0087A9B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329210, "uuid": "d16be687-a68b-4f4a-8ec8-ce75ed4f5b9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329210, "uuid": "1757f9c6-884e-40ac-8634-d0027c66ca70", "value": "12288:cmmFkwOEocER3uAylQP3EOEUrm6MG4HlfHT5sPBFKwWx8iC1VlTpQXvIavM:Lm+wOelQT9mgSFTkOCjlTpQXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647329210, "uuid": "ace1cade-8b62-484e-a2a6-2b9ced15a9c1", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647329210, "uuid": "d93428f7-2f6c-4691-b230-4a57c9e26831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647329210, "uuid": "cc0ab995-1be5-4d39-a71b-88b9336dec26", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f774cf-a470-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647356348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356348, "uuid": "8bbd40b5-ce8c-4b2c-9b1e-1c3b324ede8b", "comment": "Malware payload (Gozi)", "value": "743bf0cc1becee9274e66f108753c23a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356348, "uuid": "c3965df6-d04a-45b3-a1da-b45ef77e20d7", "comment": "Malware payload (Gozi)", "value": "bce0ea4a85e5bc6af2dfe91b1ceef3416f210aa4f5c9cf8e6adf1b7f4aacf874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356348, "uuid": "1dcb64e0-1384-45b7-abd6-f81644577826", "comment": "Malware payload (Gozi)", "value": "83887ebf7e43dd55ac2964d4db2e1ac6107cede3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647356348, "uuid": "38014359-1ad6-47e8-9912-722dae4ab84b", "comment": "Malware payload (Gozi)", "value": "84b50df75e19fab17d032e6c7e3cb2395d3e3932095030a19d183f02461744e495cb3d28ab6ea49e847f1020c65f0a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356348, "uuid": "8e0b627e-afb2-4fd3-a4f3-81665804aa27", "value": "T165447D5AA3E50D95E9BBC5B9CD93D217DBF234091A60D34F52B4CE9A6F03722B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356348, "uuid": "0b87e833-cd4c-4051-ae5d-85397444f090", "value": "6144:3jOc9lLYJm9qCR8h2O1CCP1GzzBpbf76mWtM55jKMu:339VYJj0g2eCCP1GzzT7BWt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647356348, "uuid": "726fbc82-797b-459d-9d2f-508234ca3d74", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647356348, "uuid": "1c90c7d4-f080-41cc-a367-bc2ee34f7638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647356348, "uuid": "53953641-c417-4469-9510-7e726db9f2cf", "value": "1efaace0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b20639-a485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647365447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365447, "uuid": "44cce5f4-b42e-4b08-98c0-c227ad5afe82", "comment": "Malware payload (Heodo)", "value": "4793319514db265b1bb7a556a0295c2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365447, "uuid": "d5174872-8b3a-4fdc-af98-233f50fd7d1b", "comment": "Malware payload (Heodo)", "value": "bd0c17e0c00dcf686e06b736826f81da22f3e3eb579ea3f92a2ade6c0e7bbef1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365447, "uuid": "8000db3d-4af9-4e4d-9429-91fe8e4d4250", "comment": "Malware payload (Heodo)", "value": "9d94f2d8f59bb316d8068ea3f424a021c3afae3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647365447, "uuid": "50d71c2c-893e-4d70-b867-7a31798f78a5", "comment": "Malware payload (Heodo)", "value": "939b2f711945659473e935bc6b0e524f12c039ab476588d69abf51477523a9426ccff7294d5b7e68cadb1ed21f25df74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365447, "uuid": "0c9834ca-6d4c-43b9-bd52-d1b9a9e711d5", "value": "T1CB257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365447, "uuid": "daa6f974-1010-41a3-8e03-fcec1867987b", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365447, "uuid": "6744d00b-23ee-4c28-91e4-64ff0fbd3bcb", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlyOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8el65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647365447, "uuid": "26d84c2c-75ca-41b9-a702-a5300a4405be", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647365447, "uuid": "f674e7ee-52e4-41ab-bce1-601533339a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647365447, "uuid": "6b06533c-c927-4f89-b872-2306c750b5be", "value": "4793319514db265b1bb7a556a0295c2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edc89bd-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647354025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354025, "uuid": "fff9ccc9-b14b-48f2-b7cc-2455f6be3059", "comment": "Malware payload (AgentTesla)", "value": "35f1e9ce4f449f2602b684c2a1b10e93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354025, "uuid": "fd181b31-5f46-4d72-bb8d-1dfcd620a49c", "comment": "Malware payload (AgentTesla)", "value": "bd24071463a3544fb6f2deedf190b2f204de9e359414825c3adce3dbafc34f4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354025, "uuid": "c67dded5-34cf-4e4a-a0e3-c0ff67ea52e0", "comment": "Malware payload (AgentTesla)", "value": "ed8287c40b3088390fef992934aa9f9e588faf38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354025, "uuid": "eef32153-b91d-4361-9962-5ad000db6932", "comment": "Malware payload (AgentTesla)", "value": "2bdbe03d6e2e86cdb6be5d66031fc873d91ad96b8a2efb52107331de12d01c27b9abf9db176ccab09a1056df99145a33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354025, "uuid": "82b36a95-5a0a-4de1-b406-add11d8c40ff", "value": "T11884238BA9D58CF6F490017AB57A5FB5F73F509A1670985307183F6A6A2A3C202817F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354025, "uuid": "93b60711-a997-4e8a-8771-33fca2c1f752", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354025, "uuid": "8d0f1cce-61ef-45cc-9e62-bbf3f1d88629", "value": "6144:rGiqFu1m9TwUPPyN4srSH+x8PFnnB+sreQl+Z4YwlhoTOQGNswL:RM9TB3rqS4OBDreQlxjoTGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354025, "uuid": "98dff4a3-48b0-4ccb-8f14-6b9d850f1ba9", "value": 385834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354025, "uuid": "9f6b8a1d-a0e0-4eb8-836b-c60f8974e557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354025, "uuid": "14be140c-3e81-423e-be0e-7593ed94fdef", "value": "Halkbank_Ekstre_20200520_115007_302191.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d978ab7c-a468-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647353077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353077, "uuid": "708bd7ae-e2fa-40f7-be6a-758c76bb402c", "comment": "Malware payload (Gozi)", "value": "520636dbbdc33d8dbdf1b14f043b46f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353077, "uuid": "bb9221db-fe28-403a-a654-f7cbaf0d3c59", "comment": "Malware payload (Gozi)", "value": "bd8aa280646a2b601ccbd5cec125d51646624d34005eb7db56da6b70fda821cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353077, "uuid": "0e10a907-fb3e-4eb6-977f-f918c43534de", "comment": "Malware payload (Gozi)", "value": "20eec5615c4ecca3603f889bccf975c855fa7a07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353077, "uuid": "025daacf-991e-43e8-b43a-2d8b2c42ed3c", "comment": "Malware payload (Gozi)", "value": "e5c595ff4b4228827948c2f0b0d0dc89ae69d7581f74bc133bb3e80e165a56ff320f632f73f004526f8d2188a98ab6c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353077, "uuid": "f7925ee0-a442-4cf0-b026-c4f357510957", "value": "T15044CF213660C837F55326311965CB725B7A78316AA5C34B7BA80F3A4F313D0AA3E3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353077, "uuid": "332b8b51-5181-4d5d-bda6-55bb14b7ddc2", "value": "c4715cf6be93a0d532bbd0073142431e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353077, "uuid": "1d6d7b93-14ad-4578-afd2-8b6bee4537ef", "value": "3072:BwsrrHgB98BRdFfHsN+DBZqGZvTx5kQ4e2B5:iqHgEBRjZqGZ7wVR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353077, "uuid": "b69acda3-f362-4c28-9c2d-9f45fd671675", "value": 258117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353077, "uuid": "4e513415-1faf-45ba-bb5f-6798071d78c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353077, "uuid": "f78590d8-96e2-419f-96dd-25ab772e772a", "value": "520636dbbdc33d8dbdf1b14f043b46f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973191ff-a488-11ec-9275-42010a9c0029", "comment": "Malware payload (XpertRAT)", "timestamp": 1647366710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366710, "uuid": "e1e417c5-ec47-4ee7-b48b-1e1746bad9f8", "comment": "Malware payload (XpertRAT)", "value": "fd5a0326a71e89b2ff144ea336fac113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366710, "uuid": "16550ae2-92a4-4d08-9357-2ef6877e7fe0", "comment": "Malware payload (XpertRAT)", "value": "bda50ff249b947617d9551c717e78131ed32bf77db9dc5b7591d3e1af6cb2f1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366710, "uuid": "5f10e092-7a2d-48eb-b7f2-c2a162e93040", "comment": "Malware payload (XpertRAT)", "value": "aa6b046a0ed889b59cdb0ee9a957c4c6d542e233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366710, "uuid": "f5d0843e-8d3c-4944-8dbe-b28844c4e3bc", "comment": "Malware payload (XpertRAT)", "value": "6d4f3b4aff79efd6b446c6b87a3645c282a5f24f6c8d2ed4e82a1ddb33086b346291d68ce9ddaa2fc4ca769d66820d06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366710, "uuid": "083e2617-cdd6-4156-86a7-dc30d404de5d", "value": "T1A8F402D836958FA3ED70C3BEDABDA80917B6B9758510E2188CD720DB56A2FDD1210F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366710, "uuid": "d5de8dc7-3cca-46ef-b164-0bab4affd8f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366710, "uuid": "2a7f6ac1-6c06-47ea-ab22-d625d6e485d8", "value": "12288:lIuwOEo+EvtXS6RUQ1tQjChvA0Hx+WBIw+d0oDzhPDhn+uqGr5jeLM0u+6y:SuwO8YUQE8HsWCw+d0UlrqGrpeLM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366710, "uuid": "4e7c145d-6615-4283-8429-805216600535", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366710, "uuid": "d2111e99-a3c7-408c-9afa-a1da01769e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366710, "uuid": "2e63bec2-1c99-4458-abcd-d80990fea0e0", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e28e8d2-a450-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647342669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342669, "uuid": "312942c5-1021-4680-be5f-6f3bae870843", "comment": "Malware payload", "value": "25a1eba18113c8806e93e2bdfa9e8dcb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342669, "uuid": "569b61f4-a5cb-41d5-abb2-a63b633b33fb", "comment": "Malware payload", "value": "bdbb67d57f79dac06eadf108f6bcc7224d49292bd705baaac5561e1e83097439", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342669, "uuid": "8aa88305-662e-42bd-9fa0-8a2bacadc530", "comment": "Malware payload", "value": "5436d6073d0e26dd03e0272e2dd960a45f26421a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342669, "uuid": "8b61aaa0-8453-4481-9231-7fcb2eddc810", "comment": "Malware payload", "value": "1bbb266a6ddb252324c0a6f03f7888a519ef275ad72dec8838d848b0b14e4af0a53b82ab603ca9d3dc246665f846c9af", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342669, "uuid": "d4b0f6bd-fd6a-4ac5-a06d-ccec31837d58", "value": "T1FE63010A19693BEE96D1B77EBD25FAE12C8560AE001BF13CCD18B09F5911171AE66C07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342669, "uuid": "ec534326-8c0b-40af-b472-6af9c0d2a834", "value": "1536:So6l8Knd0TU/rD3qciF7aRnDC8ftm7y/cVFcYO+qI44BCEbNeeWkbqTfZs:SjzndAU/rD6oRntftmqM78IFQEbNeHpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342669, "uuid": "c1f9b44c-2712-4b37-b195-bda406f86f5e", "value": 69088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342669, "uuid": "5308c457-1603-449f-80ac-60fafe3566aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342669, "uuid": "3a0e125e-eccf-4925-abb5-34e019413376", "value": "Documento.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebb8ae0-a42b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647326860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326860, "uuid": "41e407b3-baf2-4019-8b02-09caeb6090a3", "comment": "Malware payload (Mirai)", "value": "adc5cde3056113444c2885b6f58a4380", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326860, "uuid": "119f83f0-9c00-40e7-ae13-df0e4e749e55", "comment": "Malware payload (Mirai)", "value": "bdc0e676f992469cdfb3303b630bcf3289855a36e0024129a5e50875bbb42907", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326860, "uuid": "2c7ab6e8-2ba9-4b5e-a1b1-810f280925e7", "comment": "Malware payload (Mirai)", "value": "dd5b29416eeff44f2655492e7b791bc6017eccf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326860, "uuid": "7d79f839-90c8-4b34-8fce-dcb47b08c46a", "comment": "Malware payload (Mirai)", "value": "2e966381bc2c6133801dcd1663d43c2f49d021bb468bd84faf8d25995cf8ca69d34ae7dfe084d58dfc5647f76094ef29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326860, "uuid": "27dee85c-9add-46a7-ac64-64a767c50f9d", "value": "T1E5C2E15D84B83E9EE6EE1E3CD09505A48584E2DA719B778DC341CC43BB47607B14E8A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326860, "uuid": "d35ccd89-a263-42d2-8da2-5f484ad5eaf9", "value": "384:QO8zpeifi0DGqAIhybiWGkKzUw+2MAMdpaR1lgo8EHT+1CpRWGVCzhMhHN:qpeiKeA4PkjbWjgovK10WMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326860, "uuid": "c7d9f609-1d9a-4078-a0f0-ba0721c7ff2b", "value": 27516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326860, "uuid": "4cf795c1-5e5e-4011-9a5b-b18439b238ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326860, "uuid": "2c058bd5-c015-41de-be92-112acc2f5b51", "value": "SecuriteInfo.com.Linux.Mirai.1503.4332.2204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfa1ce5-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "fd7b3c28-8e28-411e-8d0f-a4398880cb00", "comment": "Malware payload (Heodo)", "value": "5a301aad6ea7b02e23821a776759df62", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "ad00925a-8927-4b71-9d24-e9c2f1250ef8", "comment": "Malware payload (Heodo)", "value": "bea0bde1b773d2016bdb54d88f64e47aa24bac071ae9f000c47f5048e42ec8ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "0926557a-39ee-4219-96ab-2cca46cf757a", "comment": "Malware payload (Heodo)", "value": "05d54a472118fd664685d6043a42cb1ee73bbbe8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302696, "uuid": "216f896c-42a7-48f1-b4c4-e64790830974", "comment": "Malware payload (Heodo)", "value": "ad906afa71d641d0dd6d616ce5d209ecddbb524ed592a96122a4eb5b8e7c13e9c46943fb27a853203465ea5187d19b12", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "632ccd39-ef5f-46e6-872e-38d304ab8bec", "value": "T1C1256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "d17a2537-59a7-45d6-a234-d36116889a7e", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "55c09139-34aa-4b33-899e-8878d57d5fb1", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkmwLBeUNKsuG31Pt8H:3dlV0EnITIwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302696, "uuid": "e55b78e0-8d06-4ddb-a16c-c9371c1b27ac", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302696, "uuid": "5e6de9d4-d874-4768-80a9-368c14faa125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302696, "uuid": "2e5352fb-01c3-4886-8262-71c798441f2b", "value": "emotet_exe_e4_bea0bde1b773d2016bdb54d88f64e47aa24bac071ae9f000c47f5048e42ec8ec_2022-03-15__000448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9732735-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1647354795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354795, "uuid": "c6f2d0db-1811-47b7-8f2f-bb0329f1c503", "comment": "Malware payload (BitRAT)", "value": "514837c22746ae83fad96926ad2ddf83", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354795, "uuid": "05ee771f-fb4c-43bc-bb94-7c12df7cf412", "comment": "Malware payload (BitRAT)", "value": "beced991de014438e5a42627fd44721a06fd4fa67b8a58319fc00eb6316169a1", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354795, "uuid": "97d85d45-3cdb-4c5c-86b7-2dcb2d3886a1", "comment": "Malware payload (BitRAT)", "value": "e23e87f578c20f743ca1460d5e744c10b629cc16", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354795, "uuid": "331a193c-1df6-45cb-8d88-a9d2050f903d", "comment": "Malware payload (BitRAT)", "value": "cd412f8c48d513a6757437a0b949e175e34ef6e598920f1a8334d377f5f4900c9717030f02b14b989f9b1693aca7e806", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354795, "uuid": "1a02acc6-144a-410d-8eef-2b652e024af5", "value": "T1D3A52301BA60D036F4B716F81C7583BAA92F79A19B11D1CBA1E83ADF52352E1ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354795, "uuid": "62e8a6e5-d542-4f6f-9536-f9a84cc7b8ae", "value": "0bff565af25c1bc5033321ca0bc710a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354795, "uuid": "a3ad3600-0044-4c0e-8693-10bbf62cfffc", "value": "49152:4bAM+JWcJIVmnZAjtJeGvnEgj2s/gNXrQ4/owDx+SH1ePVui:2AMKWcyVuweoF/gN7HZVePZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354795, "uuid": "da5d6d54-708c-4143-936c-14fd6337bf10", "value": 2180096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354795, "uuid": "6db869c9-fe36-4546-ab76-d7ed152f5b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354795, "uuid": "0b3c4f72-34a0-4cf1-87ce-3e897214bfb7", "value": "514837c22746ae83fad96926ad2ddf83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f210984-a462-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647350241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350241, "uuid": "8975c081-3736-43d7-98ef-cb8e44f68ae1", "comment": "Malware payload (RemcosRAT)", "value": "eb612df3a7baf7031cbeffe134b8988c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350241, "uuid": "3ed37c6b-ffb8-44f3-b6a8-118711bc760c", "comment": "Malware payload (RemcosRAT)", "value": "bee130d210370de6bc337cf3fe6708b4b15759ec3635f9187db96c0089173077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350241, "uuid": "7d6baf60-9f3e-4177-8087-220aa39555d4", "comment": "Malware payload (RemcosRAT)", "value": "1b6ceb04126c63eead0a918f1f3fb20cbed17f6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350241, "uuid": "ede6e4a0-a10a-49b8-a279-d8a164e9aa4f", "comment": "Malware payload (RemcosRAT)", "value": "6e4b78798b20c44727a5a6448b6b9bd54d085c6ddd7662d1cd9c0406fd552e6698f72eeee6bdc138f45082954220e140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350241, "uuid": "bf9e3f7c-bbe3-4345-9609-62af2f8ea5ac", "value": "T18D55F1E0FB0896BEDC05613AC4A84C701DB52B9E24197F1761AF21DD453BACF49A6C2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350241, "uuid": "ea471e0f-d816-4287-80b9-70c1f6096a4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350241, "uuid": "83ecc0ff-92ef-4f20-b6ba-c95b42dc7149", "value": "24576:o912iDU7XDFLbgTOvzH97xL8WE5tavpNSU8TlzBxKm0tD0/pcaXaAx5:4QiCDFnVT9VUxUulzBX/pQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647350241, "uuid": "24357732-37a3-4af3-9304-6f27ec1e8338", "value": 1331712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647350241, "uuid": "59086232-b10f-4615-a631-21d6944756bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350241, "uuid": "6e44fc34-ecaf-4dd3-bf95-2ba66f8ddbe3", "value": "2022CN8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61254124-a45a-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1647346862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346862, "uuid": "6abeecf8-f40b-4ac3-99f8-4838999bef7c", "comment": "Malware payload (CobaltStrike)", "value": "00c50326be1fa582712620818c9fb843", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346862, "uuid": "550d590c-603b-445d-80cf-6402eabceb08", "comment": "Malware payload (CobaltStrike)", "value": "bee477999b629375f40b062ce90431a9eaff9faa657b2f93bdfb531874a737f5", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346862, "uuid": "b58839c4-75f9-4c39-94df-3a1bb197df8f", "comment": "Malware payload (CobaltStrike)", "value": "d64afd660f33f3910938cf022817d8f94fa5bfa0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346862, "uuid": "fe6681e3-819d-47d7-9d11-cbff2380b49a", "comment": "Malware payload (CobaltStrike)", "value": "87ad5bb085863599c0436f982fe5ea0457efb171e3e3564c1b508c66964b41df14bebe288f0926da2d74d6f471571dc2", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OWLNET LIMITED", "colour": "#957294", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346862, "uuid": "92c1266f-d6ca-4c1b-b699-c2390ea2e340", "value": "T119348D117991C433D5B2143409E8DBB6593EB9310F319AEFA7D41B7E8E303C29635A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346862, "uuid": "7255b671-62b2-4c71-a7d4-96c945930ec5", "value": "72f267ade25f33641f36cfea542d0b99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346862, "uuid": "b21146dd-559d-4118-946d-92f5fb6d5bc9", "value": "6144:lzcj6L+eOOzCucjsAYKm2mv9kTAWe1AOa1s6E005JWnc:NcyOKLcjsKiZYs6E005JWnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647346862, "uuid": "0a1e5a1e-4961-4795-bd86-6225553426bb", "value": 251192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647346862, "uuid": "6a70e98f-d3cb-43bb-b330-077ea32cf5f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346862, "uuid": "36c0f71e-6355-4ee2-a0d2-646a128a388e", "value": "bee477999b629375f40b062ce90431a9eaff9faa657b2f93bdfb531874a737f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d21d37-a434-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647330636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330636, "uuid": "1f5fa6b1-2e47-4bd5-b7c3-f9820b1de140", "comment": "Malware payload", "value": "a25d538b37f686e64dcea930fe69ea0c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330636, "uuid": "c6256a49-7b0c-4336-ac06-250178504830", "comment": "Malware payload", "value": "bf91955396eae4e2db1b70f1d937aac92bc7a7032a648a9d01053c616fb66d98", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330636, "uuid": "2e442dc2-c5d4-4e3d-ba54-68201605fdc8", "comment": "Malware payload", "value": "e0d4053722a791e550cda78fec59adaedd165fc8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330636, "uuid": "a05a142e-2179-478a-bde8-5653ed7ff085", "comment": "Malware payload", "value": "de37171832c530075085342c6075fc8a1c4a3ba22afe39bfd181c6ee310923f8caaf55c45086965e6ae0b38feeb198dc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330636, "uuid": "24ac2b91-186a-457b-a0c6-b1bca509708f", "value": "T16A931200201EEDD9E994443AB7E0DF7F179F55AA482329FC335551530D9FB83A9A4F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330636, "uuid": "e7ba75d8-2724-43cf-a64c-1dc23cfeefb6", "value": "1536:MIDrNZdwBAAR0+myMSOb9D4nu9JSM6koEr1PC6jmzRdcgKRejx/AX1Ylm7y:xdwruM124nu9gkoEr72TcrRUhu1Ylm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647330636, "uuid": "3e887b24-c9e5-4eab-9cc8-36bf27a538ad", "value": 92891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647330636, "uuid": "79b8a69d-1374-4a71-a690-87d5fc855c75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330636, "uuid": "f83ad37e-1ee4-4053-a63f-2190d21129d4", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f216e830-a46b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647354407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354407, "uuid": "0bc05b72-9809-4267-91e6-d75a7ccf9b3b", "comment": "Malware payload", "value": "d7b17e5ccdf695bb7acc9235b4e0a591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354407, "uuid": "fe7233cb-ad19-435c-b6d0-e6f82bcf14a5", "comment": "Malware payload", "value": "c04089468922696353c3c7a044bc53491562ae6a894f77e303f2d50d41363bb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354407, "uuid": "45cb2b08-5e8d-4d8c-8999-410c75432e1f", "comment": "Malware payload", "value": "edf33bca4888eb4256445a15dcb8c732b6ce49c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354407, "uuid": "4fd4bc49-aa6c-4607-9f2b-cac7529fb7aa", "comment": "Malware payload", "value": "265a02cc0dffc3220847ec563c534e26972f5b0c7498039b5fa3b39f3a8da6eabe6c2a29aceb9750ac2212edb4b300fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354407, "uuid": "c4365519-17fb-4185-87a4-460fd33a73d6", "value": "T18B350210BAA0C035F2F705F409BAD39C6A3F7DA16B2495CBA2D466E966753D0EC35307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354407, "uuid": "84899424-54d9-40d7-83a0-acfde7ac9b82", "value": "0bff565af25c1bc5033321ca0bc710a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354407, "uuid": "103012d7-dcf2-4ac7-8e8e-8c9a49ffb6e1", "value": "24576:fba6o5sPtIIBhNfE6zWppGFR//gv1dMu18HA:PVb86zWrGF1Fq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354407, "uuid": "684a8d05-5ba9-48c9-9816-2c840fba51c9", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354407, "uuid": "f6384a87-b5c5-4c0d-9686-b61cde548999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354407, "uuid": "6f1e8d6b-9c8d-4fff-8b82-dfb5f7b9d4cf", "value": "d7b17e5ccdf695bb7acc9235b4e0a591.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f5e43c-a42f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647328403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328403, "uuid": "4e01561d-f9e5-43b9-bca1-5fcbf886c26f", "comment": "Malware payload (Heodo)", "value": "e60d32e227530e06b74e296c9890b881", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328403, "uuid": "159f424a-2251-47c1-8a2a-0d2af9b31a23", "comment": "Malware payload (Heodo)", "value": "c05b38d967ddd2c9313b0372098dbd05da2d1996bb2ad86223a18e3eaefc47f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328403, "uuid": "3fda7eb6-36e6-4244-84a9-d74eac9dcce5", "comment": "Malware payload (Heodo)", "value": "0852881b7229b26766dddcb94130591cfde23643", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328403, "uuid": "fdff21ec-5846-412c-a2dc-a79cbaebfef7", "comment": "Malware payload (Heodo)", "value": "0b1f2e7a92d1410a1066244f15c7f70ef77bb1ad37dc8fce58d4f9fb83c226726de0f1f903affe3eda90b738aef16ae1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328403, "uuid": "89f56186-eed9-44a2-9e42-1511c72ba7d4", "value": "T15545AD1137D1C07AC1AF03B5491AD769B2FABD646FB542C76F902BAE0E344D3D636242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328403, "uuid": "3eba356f-4565-4d4d-8c63-6b98eff12120", "value": "2e575d8fb1e65dc783586b7b235e64a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328403, "uuid": "dd5c6e7c-e392-42a5-8967-1e48bf286d19", "value": "12288:/XF08FkN6ZayRkNx22Oi3NjjsjPb5SqZox02IQZN2W6VaYiKntDNPq:/XFt26ZaKIx27R/UqZQ02IQzJmaYD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647328403, "uuid": "0e226292-76ee-4ace-bbab-4f71001fe306", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647328403, "uuid": "785e5f77-9196-4a56-9e67-79c399e4a619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328403, "uuid": "dea0ef27-b590-43e0-bee6-50d7e3ca93ec", "value": "emotet_exe_e5_c05b38d967ddd2c9313b0372098dbd05da2d1996bb2ad86223a18e3eaefc47f2_2022-03-15__071318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a5775b-a459-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647346442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346442, "uuid": "eb0a1780-7d94-40c2-841a-ee868678ef06", "comment": "Malware payload (Heodo)", "value": "d768a9af12778b8c9314e251d8c5d96a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346442, "uuid": "c8ecceab-61b9-4f9b-a206-e78e20066a0f", "comment": "Malware payload (Heodo)", "value": "c13e9601808ca939d20d8323188731e388724802b281734943db70146b69dcc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346442, "uuid": "c79050a0-7675-4c6d-bf4a-6b076952a985", "comment": "Malware payload (Heodo)", "value": "c91c02dac2f7d183f9db66b54c64c114d8f88890", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647346442, "uuid": "2ee7cdf6-5b84-4f19-bff5-dd25fc754df4", "comment": "Malware payload (Heodo)", "value": "5f36c404a6a25fb950364d755c98ab72709729b7b57f86e5c5006d47fc5546cfa2deae9896fd4cdf44f427891e86e050", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346442, "uuid": "ec3a9515-5bce-4dae-bb3b-cb41ce11829b", "value": "T140257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346442, "uuid": "3de52e86-9518-4921-ab62-eb80d013313d", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346442, "uuid": "9fdde8ec-b3af-49d2-a23a-b77138641f34", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHY4VP6FuR6shQLj88F+Krf6:v6oycln8cACirP68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647346442, "uuid": "324fc228-597e-4872-a4c9-21bed2258043", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647346442, "uuid": "cff4c9b7-17fb-4b74-b4a6-522bdd6ffd45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647346442, "uuid": "a6ddecdd-0aec-4c76-afde-7da275045929", "value": "d768a9af12778b8c9314e251d8c5d96a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bf73f5-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647333987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333987, "uuid": "d1ff146d-7e76-48e6-bd67-6f469927eb45", "comment": "Malware payload (NanoCore)", "value": "0ca8127ebc7f265da8c22209f42c11cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333987, "uuid": "88dcba3a-9d40-4a17-b2ae-46c54cb8a932", "comment": "Malware payload (NanoCore)", "value": "c149c63edd6c455c6b6bbc9f95d6c4145f6c5e20570a19584f1041f8b410f3e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333987, "uuid": "07eaa603-d263-4be2-b5d4-cf2e01a42a3d", "comment": "Malware payload (NanoCore)", "value": "275d719e46d3ea4aa3599d92d9c3070ba1601b4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333987, "uuid": "dc92e67b-8fd3-40f3-83ae-769574ff5a1e", "comment": "Malware payload (NanoCore)", "value": "d0dcd5885e51f05a320394daa44011d078a9c62844d9bdcc6db6416b0d6cee307e8b2c583429c044d00ff9eb55a6d4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333987, "uuid": "65d27355-d431-43f0-8a1c-c4a1faac9d86", "value": "T16F05124972EC5F03D0BA8BF585253A4863FBB5AA9120C78D0ED934CBB6B3F114941A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333987, "uuid": "1526c88c-97c3-4049-ad37-085bf312887a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333987, "uuid": "cd51bba4-5afc-42ec-8d65-faee4450d35a", "value": "24576:rFkwOyLo1aqGUHXG3jYrX3upKDXsYKjTG6QG0T:SfHGUHXIYrXOKXsM6Z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333987, "uuid": "a602744f-b99b-4e37-b98f-0e1dc301f844", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333987, "uuid": "8bf590da-1c6b-4470-8dba-4fbebef9f525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333987, "uuid": "50734afb-3499-4e3b-8ac8-7bedffbe7d58", "value": "URGENT REQUEST FOR QUOTSCAN COPYPDF...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c65689-a46c-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647354737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354737, "uuid": "0d2d509e-69dc-4f6a-8583-aace94c85ce5", "comment": "Malware payload (NanoCore)", "value": "88b411a253896e1ee1c725c2d12d4a5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354737, "uuid": "2de5b35b-a037-4984-b65a-5ac153c52fc6", "comment": "Malware payload (NanoCore)", "value": "c1b389c206643b8b44108fef4b41234ef5818d2868a769d20609dbc9ece3a68b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354737, "uuid": "f40a9c23-5eb9-423e-8b68-579dfb9c898b", "comment": "Malware payload (NanoCore)", "value": "0d296a636b1e39b16481491465f216d8da4c47b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647354737, "uuid": "ab696cbc-5ccc-4cfb-927c-edacc7227855", "comment": "Malware payload (NanoCore)", "value": "c620049645e8f351bb297b923e8c227b657e43ba31c9c1185856cfa79130026288eed9f259ae21a7ed0fd9c82253aac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354737, "uuid": "31db052f-a29b-4e62-90be-be8b11246fb8", "value": "T1B2F417ACB22071DFC85BC572CA645C68EE91767B930F9213902325AD996D9C7CF14CB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354737, "uuid": "e2d8b970-0f29-4c37-82a8-ec5611aae18b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354737, "uuid": "03224ab1-3592-4d29-8d32-33847a4e6adb", "value": "12288:Kxz9JEbcQlKsz7UfCGYO6Isoyc3jmFW82+tA4WNya6nYYkAYVqevf9ust5ze+xQr:K3DWyPb6INytFWc+1kZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647354737, "uuid": "4af00b7b-61dd-4fa8-aea1-2ad7f6e75d1b", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647354737, "uuid": "64c4fccb-08fc-4c9f-93c8-fa2e747e8bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647354737, "uuid": "b9dfa5ad-b72a-4b35-95c9-9232e85b9201", "value": "88b411a253896e1ee1c725c2d12d4a5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a03f90-a43e-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647334709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334709, "uuid": "416cb382-d25f-4b05-bc10-40e475a7aa76", "comment": "Malware payload (SnakeKeylogger)", "value": "705e4d2fd8b2a1f4c04a44e2ad7f0022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334709, "uuid": "440b594c-0f85-4e91-8632-bf14a0060467", "comment": "Malware payload (SnakeKeylogger)", "value": "c1f2fc828447090bb545580ee2d46919e8a96377a792f2207af3456e119a5d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334709, "uuid": "5f0c24e8-498f-48f9-9bc0-b2ce2afbf41a", "comment": "Malware payload (SnakeKeylogger)", "value": "3272dafcf5e6f8c3f529eeaccf86167932538556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647334709, "uuid": "4d6e173e-d41b-402b-a43a-8818aef14fc6", "comment": "Malware payload (SnakeKeylogger)", "value": "a6bda9e74233c2e95f9b8466e5700630976b5d673392e07947c7f8ba0810d3ec32aa23155594e9523d9c730c249dd071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334709, "uuid": "f8cbf6c3-4eb1-45bb-b97a-b3f2bec0dad4", "value": "T1AC15DFAC32C47D9EC623CD76C9642C54EA3170BA6B07D207A107159D9A5DBEBEF102E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334709, "uuid": "382ec1b2-1c89-4d55-a76c-5efdaf183f4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334709, "uuid": "81da7c76-4952-4a82-8921-23e112c2c385", "value": "24576:HTz1gwOnvZEbnFEiq4uryjnjs3IfwuOaA:H31gfnvZEzFEwuss3HuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647334709, "uuid": "1fbe1aa8-9220-4986-a9be-a6c3dcb39c9f", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647334709, "uuid": "a56053aa-0c4f-43be-ab50-4b18db218732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647334709, "uuid": "e7d14ebb-b18c-4796-9c97-bf965ad30dcd", "value": "Halkbank_Ekstre_20220315_15483269.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6f696a-a445-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647337945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337945, "uuid": "e0ea2407-9411-4614-9c40-a129c899a593", "comment": "Malware payload (Heodo)", "value": "1fc5eb83eedcc6eded904707fbada7e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337945, "uuid": "93966ebf-3f40-4686-9d52-1d2d59167ec8", "comment": "Malware payload (Heodo)", "value": "c206d23444db5d4dc75eb819f52ed00d2eee3d25cf5aef5accef13a2880a0222", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337945, "uuid": "01e70661-9d0b-49c1-a2dc-85592f081028", "comment": "Malware payload (Heodo)", "value": "0ca07bdfc3cc8c2d4ffcf405cf6c430daf132b20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647337945, "uuid": "9d63475d-b828-47f9-aead-626141836074", "comment": "Malware payload (Heodo)", "value": "dff45341e8f71c26e3a2bd2c046a10497fab3b43958b3da9395bf830c467b744fbecc3567176ebf302dc12bdc38b95c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337945, "uuid": "79825301-246d-474f-8280-e4e60420b9dd", "value": "T1F5257C137989C13EE8AF017A494B733E157BA81C1634DECB56DA2ED92F308D5863F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337945, "uuid": "cb384b32-68e8-4a90-8f59-5a99e2244e42", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337945, "uuid": "67c2f278-ea88-49e1-8abc-8e883d182c52", "value": "12288:AFFTO6oyclOdChc3cA5D1mJiQiHYUVP6FuR6shQLj88F+Krf6:v6oycln8cACi7P68ThQjrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647337945, "uuid": "436129f6-6e37-4c87-8852-10be44f1248e", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647337945, "uuid": "cc34fdc5-e0c2-40a4-9e56-bb7b54f853e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647337945, "uuid": "9e1b4da9-6367-4341-82f5-28380a6e443f", "value": "1fc5eb83eedcc6eded904707fbada7e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35eaf34b-a430-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647328751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328751, "uuid": "9e3f75cd-37f5-4bc4-ab8c-c119e3b3acd2", "comment": "Malware payload", "value": "d855dc5d6d53fc1200f4a95d5b50084c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Picsys", "colour": "#71CC2E", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328751, "uuid": "40a04107-b3b2-44c0-8d2c-03163ea90112", "comment": "Malware payload", "value": "c20b685abeaedc23677c39139b7a2a0268ddde08a034deeba39c93f8b76df8e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Picsys", "colour": "#71CC2E", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328751, "uuid": "8afc262a-3e54-44e5-a106-59f52cbea6ca", "comment": "Malware payload", "value": "4f2b76b3306e1d07d1cc196e0d95b6767bf74ee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Picsys", "colour": "#71CC2E", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647328751, "uuid": "ecb5f721-650b-4452-bb03-18d613cba630", "comment": "Malware payload", "value": "76af3025efb1a5efe7cd1fbe6a15c1436c8089f106e34613a4f20adec1a45adc9e3fed55e4cf9ef206120d92fbcf9a78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Picsys", "colour": "#71CC2E", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328751, "uuid": "bbc378d5-e884-40d8-a8ae-fa7d75411a2c", "value": "T14F53F224FDC47E00C1C3DBBAEF3793B9340F8AD875285769F716620678961A699CB026", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328751, "uuid": "d9c318c1-53da-42d6-82a2-3617b1ee97a9", "value": "359d89624a26d1e756c3e9d6782d6eb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328751, "uuid": "6aeb0d25-434a-4178-80b5-52ae65b34b94", "value": "1536:y4QQ6NSyM61l19piO+LV8YEoI/EU9RUe4maO:y4X6NSyfnpijeYEoIcq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647328751, "uuid": "8d659537-787e-48fa-b72e-671a6ac3cab0", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647328751, "uuid": "cac34316-a101-4e1b-95fd-22b3d29f303a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647328751, "uuid": "3a3200bc-8839-459e-81d6-9d71742757f6", "value": "08a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c15ac90-a483-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647364356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364356, "uuid": "14aa2639-b375-4138-88e5-7faf13afe375", "comment": "Malware payload", "value": "85e445f7808dc998d08802257d71c657", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364356, "uuid": "bfcbbfdd-d8a7-489b-84f0-d57c332ccbab", "comment": "Malware payload", "value": "c26f5a65d820f636c514a4b6eefc2daed98fe4e26c65f88762e099490b6aacec", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364356, "uuid": "5661ecd7-f38c-4ad2-ae96-f35d57aa3283", "comment": "Malware payload", "value": "6ce89005732328301137ad7995d7bfb6a10761d0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647364356, "uuid": "abff628b-61a8-4d29-96ed-a7e636ff0dd7", "comment": "Malware payload", "value": "6d21420152dc5c6c19afaf155ce4c68c52c186408508e6b7ac5d77facb8c215902fa0526a2a11d636a0fa4977f944b44", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647364356, "uuid": "853fddad-30bb-49a8-bd18-9d1595486940", "value": "T1C9A61287EB88D89BC0F60673C977012731575E29078356BA1B9CF33828776C25F95ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647364356, "uuid": "1197650e-1f41-41b5-8adb-febcc577c900", "value": "196608:2LAzIekGu40DwH2pq4Ld6MdsAfdR8yV/aUvsOuAvjutZK1oMYdUg:HEekm0DwW44R6MHdqyV/acuAvKMOPKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647364356, "uuid": "39e4d515-15f1-433d-9cfb-4a3b27962fe4", "value": 9791543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647364356, "uuid": "50d2a330-e9ab-4c76-a44f-aa9967448e41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647364356, "uuid": "116b0472-52f8-4122-bb4f-d1b8158c8189", "value": "My Blood Sugar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea21231-a456-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647345086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345086, "uuid": "e306a212-d58c-4dc2-8cea-bae56d545ee9", "comment": "Malware payload", "value": "a20a6ab37e0e1b6fdd398279d243e615", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345086, "uuid": "38412656-6eb8-4ec6-8f2b-8ef434d8e7c6", "comment": "Malware payload", "value": "c27a476cbbee03fb545302a193f4fb6fcce527bd7eb1198be3d6545141128768", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345086, "uuid": "92f21c5c-19be-4a25-b80e-20cb0bbc3f4a", "comment": "Malware payload", "value": "0f4c3b6235d3139555e3a530edffd5f5ca622783", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647345086, "uuid": "33169d23-caee-453e-a7fa-e4b16d3af06f", "comment": "Malware payload", "value": "45a5ff365b91a3939facaa7f47ade3d90f4b41f27c5359abfc346ee92d86810faacb4f4fa371e175154efd6c9b0be3cd", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345086, "uuid": "f99c02a3-043c-4b69-b65c-1d0b34aed516", "value": "T1F8914A6A034FC9EDB663B9C895C51A53EFA14522472CE6C4CFA0BEF6340587CE4E5848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345086, "uuid": "51513923-c6d1-47b1-b8bb-c59f0d31d6b4", "value": "96:89Df1LjwjbsRTy7vx+LDfxWfrOoU14k9YIi+rPCFAOzvVev:8JZsj41y7vxqUDQ199K++FAOzvVev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647345086, "uuid": "d764fb9c-789e-41b1-9285-01678f877e94", "value": 4206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647345086, "uuid": "b69885ce-f839-4f5d-a799-83dcd8c116c1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647345086, "uuid": "bfd306b6-fd23-4b84-b5e7-efd23c4758a2", "value": "comun_175.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c004fea4-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647353464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353464, "uuid": "221eec82-6917-4321-b056-4c337ec99f68", "comment": "Malware payload (Formbook)", "value": "fde89c72dd6769e0165b980db075e662", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353464, "uuid": "406f1b36-3d76-4f20-a58b-46cb04ad236a", "comment": "Malware payload (Formbook)", "value": "c29bc0fc93797a7744d7e1077a6f9306d5b9588e6ca56cbcad0839be54013f6b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353464, "uuid": "aa10a9bb-cef9-46ab-9b6f-22dc81916d6c", "comment": "Malware payload (Formbook)", "value": "36c3a23414fcc439d9141beaf6f1af688f6b835b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353464, "uuid": "df59203a-1f16-408e-b793-68d676205531", "comment": "Malware payload (Formbook)", "value": "7e44ed71e4f76eded5352ce50dfd87f64a6a90f3e38765e05749faba3cfb9e47db6ac8d637972a6a8fec129069896443", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353464, "uuid": "70d93958-7ed0-4590-b5c2-1557a29260be", "value": "T103141220F3A0CE56DDC38EB55251FAB8A658DF9171BE51099F0AB349D23D73C88B2067", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353464, "uuid": "b7ca334c-5f03-4ba2-9ea7-b50271d26182", "value": "3072:3ULg24BoE5pRsu4ixbWQKY4uDe4/z2+Hp2/DR2Ud8eLVbIO9LXsUtn50rAzcaj6:ELg2qVjHxb8Mr2Q6EUyepbIKbt5G9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353464, "uuid": "41fc3146-2175-4abe-bf8f-f50442e59690", "value": 191016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353464, "uuid": "faa0391d-1a42-4c32-87ba-c25d3f886657", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353464, "uuid": "7847ed76-8ce4-49ea-ae16-b83ab748c321", "value": "Purchase Order Samples PO NO.10039.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecc5acc-a436-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647331423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331423, "uuid": "b39ff119-e73f-422b-84d4-0cade3ac8025", "comment": "Malware payload", "value": "e182a861616a9f12bc79988e6a4186af", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331423, "uuid": "8012dbf0-7fbd-41bb-8744-b566ab41e591", "comment": "Malware payload", "value": "c2badcdfa9b7ece00f245990bb85fb6645c05b155b77deaf2bb7a2a0aacbe49e", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331423, "uuid": "07705e6c-3b20-466d-8a92-06de2772cb19", "comment": "Malware payload", "value": "69840d4c4755cdab01527eacbb48577d973f7157", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331423, "uuid": "6e3c7e55-bcac-41c7-91ef-7aa2a74efbe7", "comment": "Malware payload", "value": "46aebbd5794b736d4639e34528268e7f050222a8fdef5729cccf5ccd2b4877c142feb38d1e23ab4144a14fc3a64f3bdd", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331423, "uuid": "8a5bacd9-1965-4f89-a3aa-138ef3fce4b7", "value": "T11F32D0352AFE101EB2B3FF815BD47595AF5BBAA329794C592081070985E2C40EDE1B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331423, "uuid": "c5c75379-5f3a-47b2-984b-4fe92b77354e", "value": "192:qK8Lkrc2HWT1jbAaBLGFNN68RNEFQQrrl+lBAlJlgQGtb0UqQYGQrQoGuQgQXPY5:qK82ZWTd/LYNBRNEFl+l2lJlGdPUlcKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647331423, "uuid": "c899afb3-0495-4897-8524-da58ca126c84", "value": 11692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647331423, "uuid": "7e9da0c5-2dbe-494e-a563-c8f765bb9d5d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331423, "uuid": "d67af481-8c0a-4396-85f7-a68cbe13cc7f", "value": "Outlook (3).wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0828d249-a450-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647342418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342418, "uuid": "2d6c8a65-d9fb-4338-bf70-0d9f08fbaebd", "comment": "Malware payload (Heodo)", "value": "9db78ca201936974df66b02edfcf5a9c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342418, "uuid": "2baa3e85-a920-4f0b-928f-8b8e83c8b179", "comment": "Malware payload (Heodo)", "value": "c2e765fec3b5e6f9d06ae6c140ae0300794bda75c9b3a1de1571a8d8faa982b0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342418, "uuid": "bc67ddd1-6b1e-4be9-8bc1-539b7352a230", "comment": "Malware payload (Heodo)", "value": "fb325ab73aade6c1df3160d617bfffc982e91a3a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342418, "uuid": "a6f242e2-d12e-4203-b4a1-59ebaf8cc8d3", "comment": "Malware payload (Heodo)", "value": "7cea57427cddccc2edbadda542f1ab9ec9ee34fe5693d192f2ccf9870ca98be68db56db4f7171cddc554007dcbb52eac", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342418, "uuid": "627eabd1-7ef2-43fa-b78a-0b4e0e189974", "value": "T11073F11EC222E15ECB2714BCD48F0FE7A54F761929C4E87687D0FA4D17049AA638E71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342418, "uuid": "16587071-9dd7-4478-aa47-95f865cf8f38", "value": "1536:aLgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:d1WiCtzSmICpH7OZuvZGsM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342418, "uuid": "5add72e7-abb7-4ee3-a667-11bda216d85b", "value": 74757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342418, "uuid": "0a21eec5-9298-46e8-a6ce-09f4e76438ed", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342418, "uuid": "d6cec1a5-9d0c-48b9-8240-785f70c3ca15", "value": "Nachricht_4195.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f8899d-a43a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647333079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333079, "uuid": "d1adb757-7940-4ffb-9086-3897705ad208", "comment": "Malware payload (RedLineStealer)", "value": "71fc2f096ca11c42eec1687d5e52692c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333079, "uuid": "e576ac08-fed9-4b3d-8a35-660c0c7931a4", "comment": "Malware payload (RedLineStealer)", "value": "c2edd73c44beb4bae6d666109f793c0e246a1cc28bf868d10841023283d880d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333079, "uuid": "e6620e0d-65b9-4f3c-ac33-8c5408eb9eed", "comment": "Malware payload (RedLineStealer)", "value": "20cdec832e6aadf7b9fa636afa7e155c76443240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333079, "uuid": "6543b31d-4a0b-432c-9629-f9c717238c57", "comment": "Malware payload (RedLineStealer)", "value": "57b017faeaf6019eea52b896bf442f4ab23f6a1957218ece1f8f5eacb77bcc5b5b8d0e1506df69e59752eecef888eb61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333079, "uuid": "f0c1097e-32f9-47bf-b99a-43c70ccd2bbd", "value": "T123554C66F28AC732D19102352A44FAC0FF2859F72026FD52784D6D7B17DBE8A91B78C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333079, "uuid": "9ffffad6-597c-428e-befb-0f0993f10d22", "value": "a21e203f8df9da3decdb4919874e98b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333079, "uuid": "d30b1501-1761-40fa-8d4c-aa8ac92b1bb8", "value": "24576:kB2fTo+wwNeAmzbgYyODvuR9Vvj2GUINSxN9:kYTo+aEQ25zSxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333079, "uuid": "1180bc8b-a5ad-410e-81f2-078420690ea2", "value": 1311840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333079, "uuid": "72ae330b-3d4a-4aeb-8624-3a36be026d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333079, "uuid": "8f2a1480-3882-4b06-9a1f-0ce066afd5bc", "value": "c2edd73c44beb4bae6d666109f793c0e246a1cc28bf86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765a8060-a491-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647370520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370520, "uuid": "38c533f6-8897-4d83-ae50-ae449819367c", "comment": "Malware payload", "value": "e3d1a52f7f73f5fbe38a868b770e7d18", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370520, "uuid": "4426a56d-9686-47fb-bbe1-2e9a11807604", "comment": "Malware payload", "value": "c3e4ad1ed3ff397c22e418eda1a11a55f65d9934e8ae44967dffa5ea1b784419", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370520, "uuid": "b32a79ce-6358-4a89-aa22-a5fb45a99e90", "comment": "Malware payload", "value": "05c01aa1476dce1ed317059a17063b1c3c6b2256", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647370520, "uuid": "9a7903ee-39a0-49ae-b227-258a4712075c", "comment": "Malware payload", "value": "fe4825f8452f59e77f2ab71e86caf756ff84dd657533b1375e534fa21adc8c37a7680910c8410aa696e3d665a326a070", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370520, "uuid": "52458be1-8175-4145-b9dc-b7c4fe7f5c19", "value": "T1A8E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370520, "uuid": "b10646eb-8059-4db7-b46b-820f6aeaf0f0", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370520, "uuid": "010ba2d7-930e-41fe-943c-1946e3763258", "value": "12288:KFxGsTPy4BHT4Sj1zf8f7ABqDLkWynCsZ:obPy44Y1of7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647370520, "uuid": "6213adc2-2b82-4097-a555-268b85e06917", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647370520, "uuid": "a5bbed22-22bd-4278-85b5-9c04564c0185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647370520, "uuid": "cd4f858b-a88b-4e74-b770-5b38e3652c78", "value": "emotet_exe_e4_c3e4ad1ed3ff397c22e418eda1a11a55f65d9934e8ae44967dffa5ea1b784419_2022-03-15__185514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe38af68-a41d-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1647320926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320926, "uuid": "2eca4480-8cc8-46c0-a70c-961505c28943", "comment": "Malware payload (njrat)", "value": "28fdb5fe28363eb97d17ffa66befd796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320926, "uuid": "3653e4fb-3764-4a54-a43e-0358d6f2579e", "comment": "Malware payload (njrat)", "value": "c4129b34223aa76d82149dfb9d96165a2c415edb79c4eb534239035bd98047de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320926, "uuid": "b85383a3-d22f-47b6-89dc-ad634f31ca58", "comment": "Malware payload (njrat)", "value": "c203ab122d82a9bef9c4b6ef12fbc1f09c5b576d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320926, "uuid": "a0cadaa7-3e04-4c83-a5e1-a1b9d612c2c2", "comment": "Malware payload (njrat)", "value": "b83fdbf5f3a1991eab24ec0b9a824ff8c48fabf2c26a906ea45c3c9def27af2f91cbe272c5e1c5773f489e2fe72c05b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320926, "uuid": "fbf2b60a-e3e9-4820-a934-1fb693c529f8", "value": "T134C39E0EFB7E6A57CE5C06FFC413A0AD42A1C968A112E7E758D41A721F2278CC1C6D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320926, "uuid": "c0703443-fc85-4542-a9cc-1b18f8e50013", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320926, "uuid": "6ba44fbd-853e-4845-b872-a8b4accb2743", "value": "1536:yZTEC8Z4ensnE9lbdfSpQN7K4SvXXFUpXBDfw2NXAN+YLrHJp/U5FzHzAmuz:y5ryCEdNZVSv+X9TX++erW9juz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320926, "uuid": "3574d0d8-a789-4a27-ada3-6d8336c9029e", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320926, "uuid": "b9ee1442-6dee-4061-accf-58fe19174acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320926, "uuid": "4dd5d50e-f52d-4b1d-aff2-2b7b408f7ea4", "value": "xU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccb1366-a487-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647366370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366370, "uuid": "0ce9c461-384d-40ac-a50f-24624f741c38", "comment": "Malware payload (Heodo)", "value": "46240c30ec47d65a0753e2da2ef3ebb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366370, "uuid": "cf476bae-4a48-4202-b5b7-4cdc99f9c31a", "comment": "Malware payload (Heodo)", "value": "c42a43d64235a27e2796213c6d07315d5c0ed7ea249499e6bc474026985ce0a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366370, "uuid": "4e8d92d0-e31f-4f41-abf1-3010aad049e8", "comment": "Malware payload (Heodo)", "value": "e1373450fc715414c61cdf0c92920fc190199651", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366370, "uuid": "1c57e7dc-bbc1-418c-89f0-a3f010873d9a", "comment": "Malware payload (Heodo)", "value": "3c173d032fa065241c6725b1c2353d6a9ef72056f8cd49591d101ed49c8efe4a908ec4b048f978d1afeda8e47efb1b20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366370, "uuid": "b4b3e4d5-44ef-413c-aafb-be13978b7c67", "value": "T1EE257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366370, "uuid": "9f530346-6eac-462f-b325-bdfcebf3240c", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366370, "uuid": "88490561-686c-4478-9c6a-b09060ee21ad", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlCOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Wl65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366370, "uuid": "96b49291-da00-4a5c-8b79-5842e175a511", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366370, "uuid": "1efae9dd-97af-45a2-80cb-b1255886a98d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366370, "uuid": "ffd7ac77-021f-4ff9-a085-e24badb69142", "value": "46240c30ec47d65a0753e2da2ef3ebb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485b3f56-a489-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647367007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647367007, "uuid": "f4eb335f-d61b-436e-a8d4-bd1a9ed45445", "comment": "Malware payload (RedLineStealer)", "value": "17d9484053f498e023ee2b582e50b13a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647367007, "uuid": "3a0ecf0a-1ca9-4cf4-ae6d-b63ee1a4f301", "comment": "Malware payload (RedLineStealer)", "value": "c4723b946e8913f59ccb64d9025440820124104c653c79023f09d28da35d0442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647367007, "uuid": "e0618a20-6f11-47a2-8c44-4bf260b38599", "comment": "Malware payload (RedLineStealer)", "value": "db3329f622ac8b5cbfb76a308775ace9cd37af9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647367007, "uuid": "c3373a8e-3faf-4c25-9ec6-b62a4e40cc9c", "comment": "Malware payload (RedLineStealer)", "value": "4e850d6da74827412cf9663f3e0c277600a2b58e3f649a43408119755e9cbd9a4d7496af1f603ba39c2f3be9a1b3baaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647367007, "uuid": "6ad1227d-c755-4b67-a9e0-3e64a4598338", "value": "T168852353A2FC94E9FBE15237DAB74C4D8E70A453A086FFEA132054199423BF65CC7292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647367007, "uuid": "ce997c6d-4b7c-40cf-b9ce-8e86099be48b", "value": "f5e19596a9724fda09c730f3a70d9192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647367007, "uuid": "9f960aa1-fcc7-43ad-b395-f51064fdd891", "value": "49152:beq9rUfu/+aZ6y2be4+lTvDUhB94dUQ9R:Cq9rUfuGiYHeT7UhMiQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647367007, "uuid": "5c8d1c60-7ad3-4098-a750-d63c70c53463", "value": 1746896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647367007, "uuid": "ea2e5a8d-667f-420a-9e04-5c86b4acf226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647367007, "uuid": "195b705a-4037-40da-a755-999710d9f74f", "value": "c4723b946e8913f59ccb64d9025440820124104c653c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff0d3ac-a49c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647375180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375180, "uuid": "cf67f3f1-82ef-420c-8943-9c201033e1b5", "comment": "Malware payload", "value": "9accc13d5f021dc0751db281a4c8582c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375180, "uuid": "9802013d-73af-4489-95fc-296be8ba6bdd", "comment": "Malware payload", "value": "c4751299941f00454fd28534c474fba6d971f506e7743318da8026f22e386503", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375180, "uuid": "205fa214-44e1-4629-a544-4ed3d89964df", "comment": "Malware payload", "value": "4ed6e739f8702ef48cd73ae47266dc40dc65c64b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647375180, "uuid": "138a4128-5713-4674-ae41-1a00f1d2e419", "comment": "Malware payload", "value": "b05c0cf20f92dc5754284f77ed95f8a0a807d8e2c6df9ffb9722fd12d99323f7f18fbff73bfedcaadf20002d0c7e1f40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375180, "uuid": "ef04fb2c-9654-4e84-912c-1ea8dce582c0", "value": "T1B6E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375180, "uuid": "bb23602d-efd1-4cc1-808e-84409bfdbc6b", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375180, "uuid": "c6b3acb3-b369-4cad-9dde-eaa131741628", "value": "12288:E94YBCR2xP7guDo463OP4eusiSOZjb2woE+MhJT:2kRAguDogPSddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647375180, "uuid": "9b282f3d-7893-4cfd-9c53-64e014de3b56", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647375180, "uuid": "e6f39231-b5ac-4710-a820-bc27dcafd878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647375180, "uuid": "8d520724-9394-4ebe-a9e6-4ffb3bbdb7ef", "value": "9accc13d5f021dc0751db281a4c8582c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea81c6d2-a43b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647333778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333778, "uuid": "a8029e61-efde-495c-90a9-68f935804fb9", "comment": "Malware payload (Heodo)", "value": "25ff268d4619941322d53cce983fef15", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333778, "uuid": "199f75ea-d309-4861-8a10-0df8b397277f", "comment": "Malware payload (Heodo)", "value": "c4bce51d3f596649beac4b8a0aa58ceddc26867577ec5844409868854a9856d0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333778, "uuid": "ff64ba0c-80d1-4bf6-896b-171d9db81d0e", "comment": "Malware payload (Heodo)", "value": "86349b5ab0d762ca8d733510b9c5d092a278981d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333778, "uuid": "95630af4-4b32-4944-8bfc-e75ca3136001", "comment": "Malware payload (Heodo)", "value": "4269ad88e879c0b37c00e523e0f1285e0b63f413db18cf5d03106e2e702d299a4ecab8a53fa5367a8b72093a30564edd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333778, "uuid": "d344aba3-b72d-4ced-8cff-8ae90662fb49", "value": "T1EA73E11EC522E19DCB2700BDD2CF4FEB948F75153AC0E47A93C0E94D2B4895AA74E64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333778, "uuid": "c1d42559-d8de-4da4-b397-2f2da29359ed", "value": "1536:OS3FXUcSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM7VI0E:t310tzSmICpH7OZuvZGsMnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333778, "uuid": "3a6ba29c-2c63-49b1-a1e7-9380c392066d", "value": 76170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333778, "uuid": "95d25a18-299e-4b0e-818c-4eb163154fb7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333778, "uuid": "f479cae2-137c-47b8-9bba-9084aef80994", "value": "Details-9667.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fc196f-a44f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647342119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342119, "uuid": "430005a8-13ec-46b2-ac8e-e58a1dd5d450", "comment": "Malware payload (Loki)", "value": "6b803e1262974a495d08ab021b2cd952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342119, "uuid": "10eddfd5-2889-4062-8e96-d6bf40d9f830", "comment": "Malware payload (Loki)", "value": "c4d4b8a005cd3d2be678da8850be2dd70babba9e81eeeab75de417c9fc6a1dae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342119, "uuid": "df6de82c-a946-467b-9f90-d9ff0dd8ac13", "comment": "Malware payload (Loki)", "value": "454cac44c7ad7623762297e40345d061456d27b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342119, "uuid": "cae72f60-9aa3-4b38-9797-41f3e0ba88f3", "comment": "Malware payload (Loki)", "value": "e07978348fffdc4d265d2b13aaef2cd3246d9bebfd7e1574d4304b722ee4ae196ab7c3b957aba46c37517b6c99ec24b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342119, "uuid": "459256da-be60-448a-8f57-158be1a06829", "value": "T134F4024AB3F49F83E0B7D7FB8869194453B6B11A152DE64E9CC630C718B7F0087A4A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342119, "uuid": "26b483be-b6b4-47de-9230-78e374347014", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342119, "uuid": "3d3ba9a9-8b1d-4615-8794-4006b43ccccd", "value": "12288:AgFcdm0kwOEocEgJvs/zYCCfcaCp//1rFlw9CMibZXdnlZsENYOF3V:X6mvwOMCCop1Lw9x0pDsENL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342119, "uuid": "2190dced-2dee-40e0-a962-d90a792aefa6", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342119, "uuid": "3131b8e4-6284-4480-8c8c-2bed3a85038c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342119, "uuid": "6b6ccc81-5cb0-4b74-b1e7-74fffb2844b3", "value": "DHL Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf66847b-a495-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647372360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372360, "uuid": "0674104b-101c-4425-a9dc-7b602db8eff2", "comment": "Malware payload", "value": "d01baf21aff83cbbc1e884eb02378a15", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372360, "uuid": "0d0c5117-d61e-45d4-b5d8-4f83c75c745b", "comment": "Malware payload", "value": "c5b9013f3df3eaf3731b1be40420938c28ea9e1e81b48fdca03ed1b878ca6ad8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372360, "uuid": "8038c9bd-b601-481f-baa4-9238263fd3d9", "comment": "Malware payload", "value": "f44fecf6f6a01437f8b1c8cb02bdadd7476a9c49", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647372360, "uuid": "f52c7400-66b3-456d-b14f-34b833df761d", "comment": "Malware payload", "value": "6c88d7b3becb8f254c7583207714b6ad7d843aecd0fa5f14ffa02fe80f3b44e0370864573b47964cb5f5399a56541634", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372360, "uuid": "d0e5e8b4-aeea-403f-b8c3-f6b0efb3123d", "value": "T154E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372360, "uuid": "f72b7f4f-f7e6-49c7-b583-dd32f5da100d", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372360, "uuid": "92c35d86-247e-4f9f-9a6a-193d13ee4c11", "value": "12288:E94YBCR2xP7guDo463OP4ersiSOZjb2woE+MhJT:2kRAguDogP/ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647372360, "uuid": "133808cd-1e77-4568-b3cc-8cf329822d52", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647372360, "uuid": "35904b57-c050-4157-812f-0371fee1a531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647372360, "uuid": "164a0268-6272-4cb6-a33c-b69fdd43785f", "value": "emotet_exe_e5_c5b9013f3df3eaf3731b1be40420938c28ea9e1e81b48fdca03ed1b878ca6ad8_2022-03-15__192553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f17c42-a464-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647351051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351051, "uuid": "f40eeb69-ecdb-42ac-8928-5609b8bc44e7", "comment": "Malware payload", "value": "99081888d5be56ab56b611cf41bab052", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351051, "uuid": "eba5f7c2-c132-4239-bf40-3be84fd55969", "comment": "Malware payload", "value": "c7777c477ea35ae1f0c278ccfb0fbc4f7be029103802b3dd4c12e7dcb9f869b3", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351051, "uuid": "cfed1636-f429-457b-a7c2-1039621f9f97", "comment": "Malware payload", "value": "564fd91440e53116fe95afe88fe654253d4baf87", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647351051, "uuid": "169feccb-c8d4-4d63-8800-7c35ac95c4ec", "comment": "Malware payload", "value": "1b633c5bcda72af7d4abb1b1ec064f922b2aa044bd7db5e71cbd7466979facfea961f51d37d1ffe898107b545ad57434", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351051, "uuid": "81c3535f-ee1b-4497-91eb-2021da55b149", "value": "T111517219FD0BD25CADB5232ADD8B8A36FF1B412B95A0100871DCC2595F3080A9A6CB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351051, "uuid": "f9a5fcd1-b625-4abd-8cf2-ee75c937d37c", "value": "48:pjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQdrozl4X:RChrffoypvK0elkEYZaM8ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647351051, "uuid": "22ba103a-eecc-45bf-b431-f767a200c883", "value": 2750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647351051, "uuid": "9f471d37-2091-4419-8237-8174fb080d33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647351051, "uuid": "6a00c754-4c7d-4470-9ecd-9335dbd8daf4", "value": "t8sXFn82.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f214bf9b-a43e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647335079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647335079, "uuid": "7f9838e9-47cd-461e-872c-5ba2c007c22b", "comment": "Malware payload (Heodo)", "value": "159504423ed03f41d9a5111172e40583", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647335079, "uuid": "57fc5434-6bdc-42a3-9bec-66dffb1ea45e", "comment": "Malware payload (Heodo)", "value": "c8039b4bf3530799f31a12e0cf4762ef11c86e8df796a5a865365754c0d376bd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647335079, "uuid": "0ec6dc30-874b-461e-b0e8-04a2bc8859bc", "comment": "Malware payload (Heodo)", "value": "32b8e8166c2b317f9e6336d68d668ff170bf07e0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647335079, "uuid": "bd10695f-d22b-4142-bd93-e586b4c22a2c", "comment": "Malware payload (Heodo)", "value": "89fde1a1287a1be5a767d2d4570f4f0e9b4ba2a99e72cdd29d86e7ab51a1f20be9b49d5ffda9c95d188ab88440e25bea", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647335079, "uuid": "d33e9c25-b72a-49ec-88b0-41b5617deb7a", "value": "T14F73F11EC222E15ECB2714BCD48F0FE7A54F761929C4E87687D0FA4D17049AA638E71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647335079, "uuid": "4e8c2a48-1cd6-4d18-a008-cc9f874f24f6", "value": "1536:WLgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:R1WiCtzSmICpH7OZuvZGsM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647335079, "uuid": "ecb27219-9318-4161-98fd-b17a75c52c48", "value": 74757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647335079, "uuid": "aabf9ccf-4f95-4e2a-b331-711f5008208a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647335079, "uuid": "65111ea0-82fe-4656-a1ec-7e23482a715c", "value": "MES-535.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744742e8-a466-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352048, "uuid": "b85e8ff9-cc07-46d5-8a6a-7ab396b45688", "comment": "Malware payload", "value": "58fdcb3b5730935dcc8e712b9be5f536", "object_relation": "md5", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352048, "uuid": "90b2abde-5159-4148-a73d-8bc3b969fc27", "comment": "Malware payload", "value": "c80877bcdb1e1d21b0e33dbdd725db3eb7815e03d9609637b99db3ce71719eb6", "object_relation": "sha256", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352048, "uuid": "a78031fb-10b3-4c30-b577-21648318bffc", "comment": "Malware payload", "value": "d9806de01e9c8db41d533a27f764adc82e1f9b72", "object_relation": "sha1", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352048, "uuid": "ed8af1e4-70b9-4937-8545-fdeeffdd7f0c", "comment": "Malware payload", "value": "886388e3620fa83bcbe85b76b002acd6e033ac15d710899b33b52ce6fe9b3089e0db53e8fa938e634e0073d67f24db25", "object_relation": "sha3-384", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352048, "uuid": "c2a29c2d-a30e-4dad-b3eb-52adc4a04ddb", "value": "T1664114976E90BF43C3D132B392FDCD29B5328FC99590DF54E8A44CB8901B9258934772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352048, "uuid": "d32cb9a7-5b06-48a9-ad3c-f910a3691e40", "value": "48:1IuP66ciWC9ggJghW1vBQw/1zYZV1M255q:W066ciWpSOw/CZ7M25g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352048, "uuid": "2e3c1ee0-47fe-468c-8c69-567693a1f29c", "value": 2029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352048, "uuid": "1de0fdd3-c3a7-400a-b290-983898ff3e23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352048, "uuid": "ae3cd8e8-0254-4417-b536-f20a7b90189f", "value": "script", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d005de9-a488-11ec-9275-42010a9c0029", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1647366692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366692, "uuid": "32744350-0c8b-4d61-85f9-f44352871236", "comment": "Malware payload (Downloader.Upatre)", "value": "e63a11b2e2e6bcfa68011a56ac95bcbb", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366692, "uuid": "4a6355e2-dfae-47ef-9921-f68ae6f7eb03", "comment": "Malware payload (Downloader.Upatre)", "value": "c808c7043bbe6f22fdae5e9ad031db55e2ec385489a53ad3096985e53292244b", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366692, "uuid": "75553d65-cd6a-485d-ae99-e82f07406897", "comment": "Malware payload (Downloader.Upatre)", "value": "3a43758c8f5bf1fd80b44d7dca6adaebd242ce59", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647366692, "uuid": "7869fce8-b83e-4042-bf15-ec752e1f2721", "comment": "Malware payload (Downloader.Upatre)", "value": "9347618a23bc4c139b28462bdd3c5df5beefa4e128e27e4befb787af6c65a7b77903e9f520dce209364f3585447bd5dd", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366692, "uuid": "430720bb-58cc-4e2b-b493-e2cd90747aaa", "value": "T1F0932878AAD76E64E3779E7485F1B4B26035BF123D13E95C10523A210933BC29F61E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366692, "uuid": "7c222a60-43bd-47f0-ad0d-f5aaa856fc6b", "value": "bbe0e58a50af019da15d0f4f3e85b8f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366692, "uuid": "c2aa75c7-f162-4c6e-8170-4e48b174f079", "value": "1536:f9HMlaocok7dJK4Rm7mUBAMs0q4gF693F7hmE5hOy:f9H75dJKWohBAMs0qC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647366692, "uuid": "9db1fe5d-a758-4267-b3b6-63ea6bf5ac7b", "value": 95002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647366692, "uuid": "f218a2bc-08cf-4a37-8344-57cc8cde0df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647366692, "uuid": "fc58b0da-4686-4280-9a9c-a54ba9ca511b", "value": "c808c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7e6277-a44a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647340167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340167, "uuid": "325acbcf-bce3-4545-9473-2928e2f5c317", "comment": "Malware payload (Gozi)", "value": "aa9e193908e16757ca1803d25f3b65d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340167, "uuid": "4c59d4b5-dae0-42ff-b1a1-d75115bc7a43", "comment": "Malware payload (Gozi)", "value": "c8ac98c4e43e4290cdaefce51ebf9165143c31d3fbce0f9f80cf5a3258058c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340167, "uuid": "85ce1390-8573-431b-90c7-e02671ea9301", "comment": "Malware payload (Gozi)", "value": "1bd752e969771db5af1ffbf7ebe956dd8fefe040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647340167, "uuid": "d32a5527-b45e-4ec7-93c9-0a471536533f", "comment": "Malware payload (Gozi)", "value": "6edbb7eb6c0ea4b106526b185dc9f0a9c0ebe9197f82c33e71e7a8bd90fb6b5ff17cb7653b5eacb409af6e3a50dac7c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340167, "uuid": "838bb18e-68d5-403c-be08-9ef397323ed5", "value": "T14A44CF213660C837F55326311964CB725B7A78316AA5C34B7BA80F3A4F613D0AA3E3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340167, "uuid": "85f1040a-1954-4f22-8ebb-9384a684348d", "value": "c4715cf6be93a0d532bbd0073142431e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340167, "uuid": "3d4dd6ac-58f4-4547-8fb8-d8b1660870ae", "value": "3072:BwsrrHgB98BRdFfHsN+DBZqGZvTx5kQ4e2Bl:iqHgEBRjZqGZ7wVRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647340167, "uuid": "bce1e68e-518b-46f2-bba6-5f8caaf51851", "value": 258188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647340167, "uuid": "831e04c4-b9cf-4619-86fd-33ac7e173167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647340167, "uuid": "f5555083-153c-4414-bd0b-4d07afbb1166", "value": "EWHxeQ.bfvvu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8ad02f-a467-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647352382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352382, "uuid": "83f9f152-576e-4748-b849-b607233ea7e3", "comment": "Malware payload (SnakeKeylogger)", "value": "7d3ab4d6572fd1cb4668678829c6f56d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352382, "uuid": "aa208b12-bb9a-427e-b2aa-2ed298efd28c", "comment": "Malware payload (SnakeKeylogger)", "value": "c8d7d8e02c3969bd85595fc773c4ff6dd25223286dd1747e7949eb863970827c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352382, "uuid": "5a4592ba-e1b0-4ead-9577-797d19d70140", "comment": "Malware payload (SnakeKeylogger)", "value": "680075aa86840a70e59bbe73fa0051da5cf25bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352382, "uuid": "992939bf-a7c9-4ae0-adc8-354f4c201b38", "comment": "Malware payload (SnakeKeylogger)", "value": "373d219cf36626dfdefa6daae35a20af07b991e1331ba8a405e6c41c4430aa8bfa13a4c0932440b19e8db81a37f7558c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352382, "uuid": "8a29a5f0-ad82-4686-b671-6eec269b04f4", "value": "T13905024AB3E88F83E0BAC7FA88B505040376B0A9111EE35D5CD670D769E2F4487A5F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352382, "uuid": "b5fc88f3-a374-489d-9210-194bf30b64cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352382, "uuid": "ef3199f6-af25-4a69-add0-0dff38549828", "value": "24576:PJwmxwOeCRy7gBXPr8GoH+U6z7602oAv98f:OEfdGmT8jHX6zWoAV8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352382, "uuid": "de30733f-bcdc-465b-b0f6-5a9694e8a4b3", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352382, "uuid": "5e71b76d-e8ca-433d-ab59-d835cd1bec88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352382, "uuid": "0334336d-d318-41e7-b426-7fa66c04efef", "value": "Halkbank_Ekstre_20222501_ 073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0587b1d4-a46a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647353580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353580, "uuid": "50777d99-e1fd-47da-acb2-83742c544d46", "comment": "Malware payload (Loki)", "value": "c5f45a7659bc72be49c859dc28ffdd29", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353580, "uuid": "52823b11-eecb-457a-9e5d-fcb2149d52e4", "comment": "Malware payload (Loki)", "value": "c94702434a9ba5aa3def81ecf07917087c3b4b477a512c7f26320f89eee519f8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353580, "uuid": "4d68bdca-2987-4a7d-8ba2-74ac872732c6", "comment": "Malware payload (Loki)", "value": "da53082e6a00725e1627b1c39ca5cc9508af98bf", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353580, "uuid": "e49e8d12-172d-4e70-926e-7235e688d396", "comment": "Malware payload (Loki)", "value": "95905027b54a241044608062560c210619d64666db5903761d3feef68158ba293bf2da0d840a1e59926b6938c7bde09b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353580, "uuid": "66f3fbd0-70a4-40c1-a964-2c7dcd1f6194", "value": "T12E14127F73BA07D5E8349EB68A86022951F4DE5248CE4CE84D2C3A80D775A7C8DE7815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353580, "uuid": "59f268fa-c578-41bb-852d-533871188991", "value": "3072:OWvVJqdMDAJw3CPI6vZTup9OHKKdIkpgruAGMXGUqf7vFCbuXgSgMpKHuJ58GEFO:Tv6rJIY5nKxN0MWUy7NXg0TnW+F666T8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353580, "uuid": "41662a9c-90fa-4b36-b26d-11b5d14350d0", "value": 191240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353580, "uuid": "a098a829-f3b1-4678-82d0-e27dd72816e6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353580, "uuid": "8f19cd6b-25b6-4a30-a3fe-669292396c92", "value": "Cable TT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c0de36-a455-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647344783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344783, "uuid": "72b7fee9-4e7e-4097-acdf-45ac3cc38c6b", "comment": "Malware payload (Heodo)", "value": "3e5de50a418427663bff55421bca2dc4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344783, "uuid": "d658f941-70fa-437c-be7c-34dbd443bb42", "comment": "Malware payload (Heodo)", "value": "c968611efd902a16650b45fb7cd47c4bfbdf7a21e4d33420a9b38496c960943e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344783, "uuid": "e82ff8ac-59f6-43f1-93a7-7db308e22cbb", "comment": "Malware payload (Heodo)", "value": "96b7022eaf0e0634a587d24f5d4eff60baf13169", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647344783, "uuid": "adda2934-b6a5-40bc-9fa8-9a29d0bf20b2", "comment": "Malware payload (Heodo)", "value": "5231224a74767964626821be472e53bf9e772542744c9d9ddcaec263d80920f0c66e5d266df7cd6a9995f7518aac6f0d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344783, "uuid": "5744d936-004a-4872-b007-a687016632a0", "value": "T11D33D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344783, "uuid": "2cc6d73e-2f3c-48b5-bbdc-ca96165782b4", "value": "1536:EAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:tcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647344783, "uuid": "63f25339-0a00-46e1-82de-0c0b4771a8ba", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647344783, "uuid": "8965d05f-980c-4975-b506-be6fb633cd3c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647344783, "uuid": "a8d4f917-bfdf-4c97-a7a7-9d7fd546b628", "value": "Frage-zur-Rechnung.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc27ec0f-a451-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647343149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343149, "uuid": "637d2222-6e96-4b4f-bc86-47b8027b427c", "comment": "Malware payload (Heodo)", "value": "5ed267da1fd8a4767a8b287f2020a8d3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343149, "uuid": "273e2c42-2feb-4b2c-81e3-c06b10b50bec", "comment": "Malware payload (Heodo)", "value": "c9726ade364e2b86e017499a61cb0b23b6faa9bdd36b9a0c9278e48588c0962f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343149, "uuid": "4fd9e1f9-7c12-481a-9041-ffab3d40a3b1", "comment": "Malware payload (Heodo)", "value": "26ba43721d144606869810c32f5e035e22104ed1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647343149, "uuid": "41cccab6-6af8-4d76-b1c8-74b786251081", "comment": "Malware payload (Heodo)", "value": "d7a00f6f37d3e64538971e0251207c08d8cd25fa8fa1cacdae522a30549a786ef79730666cc3808d0a46d27c7d07f9c2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343149, "uuid": "c0a44114-e728-4d2c-863c-7423e237c986", "value": "T12E73F11EC222E15ECB2714BCD48F0FE7A54F761929C4E87687D0FA4D17049AA638E71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343149, "uuid": "3e376266-1681-4e62-8f98-8c9e0f7bca79", "value": "1536:6LgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:91WiCtzSmICpH7OZuvZGsM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647343149, "uuid": "6532457d-fb32-449f-9b98-c51f4b7f3ea2", "value": 74757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647343149, "uuid": "4b00a81a-2ed8-4235-acaf-d49b55c131cf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647343149, "uuid": "2b089d87-999f-45ab-9fa9-cd5b39896339", "value": "7WPVV-607185.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdcdcd0-a45f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647349244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349244, "uuid": "306aa29f-77be-452c-b5c3-c4459d094b35", "comment": "Malware payload (Quakbot)", "value": "9305a93306bcfc0e81d1bcf8a0716a37", "object_relation": "md5", "Tag": [ { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349244, "uuid": "4d4d19f6-34e9-4a19-a507-e4fc283df9d7", "comment": "Malware payload (Quakbot)", "value": "c9813d00b016d7ce0ad3b1354853e5b2e702f0eeb3acba0f34fd319acdbb352f", "object_relation": "sha256", "Tag": [ { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349244, "uuid": "591e943a-52b3-4c03-88ec-3cbdc9244aaa", "comment": "Malware payload (Quakbot)", "value": "3dfb6b89af41aea8bf39714e92426a638afe0bc9", "object_relation": "sha1", "Tag": [ { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349244, "uuid": "9da042bd-b1c2-42e4-b51d-faafe4421cf3", "comment": "Malware payload (Quakbot)", "value": "6ae2fd01d8feffccae97576db6efa2719b7172cb11bd0ce65e08b8d71246a901f6bc74aa6e688126a96ef4b40b37fcdd", "object_relation": "sha3-384", "Tag": [ { "name": "obama167", "colour": "#190E2B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349244, "uuid": "a0ffab5e-1f8f-4ac2-82a5-112cd1d82352", "value": "T103C3BE5BA0155F42D66946B4FF071DE81F01235EA8C2B6AE12562C8A3F663B32FCC35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349244, "uuid": "8d8e3457-726e-48e4-9eec-fbb548dfb9dc", "value": "3072:mAz2AAfDixLbLdbLwgmfMBs+KjHQzVZcNB:muwbiQPEBs+KzQLcNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647349244, "uuid": "7d973651-bb58-4d27-88e9-404237d8556e", "value": 119977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647349244, "uuid": "7e96e5cd-1926-4050-90b9-eb562ca76471", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647349244, "uuid": "742a04df-a894-487d-a1b3-e461d6256df4", "value": "REF-947149079-Mar-15.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e426e051-a42b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647326895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326895, "uuid": "401f2006-2b9c-4259-b229-0e0c4cdb7783", "comment": "Malware payload", "value": "86d72ec42f45de9a0b6f4ab00154d024", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326895, "uuid": "4aa98813-2b4b-41c4-9262-c9d8693f4427", "comment": "Malware payload", "value": "c987e249aecd0fa352a74b8245f5185a443a3a234754515ec2f174d6c4199cac", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326895, "uuid": "b0b3f94b-4d31-4a07-9261-e0e9722b281c", "comment": "Malware payload", "value": "afb6839ba97c3dcd89198140fc621e43fe024918", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647326895, "uuid": "c9f94439-f453-4b3c-8131-09445d6984b2", "comment": "Malware payload", "value": "0159643acf21af820371b6ea6974422987f61905b456386ff1cfb1867431e45cfc79f3d97c6399d2792ef6406836a89f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326895, "uuid": "d88900fb-87fd-461d-9738-39074c4d4de1", "value": "T1CA6301C35CC822ED490955ABC298A04B7114BBB528581BAC9BD8725EAF511BFDF036BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326895, "uuid": "cc0a0130-5dd8-41f8-9280-223373218f78", "value": "1536:csht4mIHh+zABdlXzRdtbl0G9kczixkQ9pdaUKZRCJGlEYU:cs0mIeABdHnl0ekUikQPdaUUnSYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647326895, "uuid": "f078ec96-6d08-4b28-97b5-6d6dc3d413e9", "value": 69852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647326895, "uuid": "21d150c5-b628-45b7-b0c0-8f64668f3661", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647326895, "uuid": "3ef93a5d-a9d3-4f9a-927d-cf43acf15eb3", "value": "m_1403.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f64e49f-a438-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647332149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332149, "uuid": "f2fe2c9b-8e57-49e9-b4f4-e606aa0eccb8", "comment": "Malware payload (NanoCore)", "value": "d20acc1df5b7156af34f7bc2b742018f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332149, "uuid": "1da88c17-b7c6-4dbb-ac96-5c7b1b0e745c", "comment": "Malware payload (NanoCore)", "value": "c9e41839229f9f0212302fabb622b307341d9094b6f6c348b166b858012f296e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332149, "uuid": "54c53e76-6f27-40e2-9a31-9065a004a9c2", "comment": "Malware payload (NanoCore)", "value": "429eb66c60b59e60e382daa62069e33907f6e4b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647332149, "uuid": "77f5e210-26a1-4732-b14d-64f614bb978f", "comment": "Malware payload (NanoCore)", "value": "7824058dbd8d6922134c1677c4d50751ab77cc1130fe066dddc4d5157e8738f6b790657a890aaaebfe0d2bbbbfe512c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332149, "uuid": "a88a27ec-a85e-48c8-9170-9d7e63e4a899", "value": "T1D015124A73F99F82F0BAD7FA9536161043B8B11A050DE24A5DC2B0DB19F7F405BA0B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332149, "uuid": "a94d209e-7277-47b9-9eed-7b6932d0a4b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332149, "uuid": "c07f7479-0752-4365-8e7f-a6db663e9d18", "value": "24576:fomLwOxje1Upwqr7fMfiBBCPQacSfg8Pf:ASfxj+C38q/CPQ9SY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647332149, "uuid": "694aaf70-d1ac-4361-bc19-df22d2a64f1a", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647332149, "uuid": "0b0d25ce-f56d-4a73-8ab1-db9a32463146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647332149, "uuid": "bee6b7b9-2f21-4dd6-85f0-e5e524f5f9ed", "value": "d20acc1df5b7156af34f7bc2b742018f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e74e10-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353282, "uuid": "3d8564ad-edaa-4778-a028-2562a161be83", "comment": "Malware payload (Heodo)", "value": "93fa2932d8466f37b7bf49e63af984e1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353282, "uuid": "96cadb8c-8f3b-47d5-8910-2d5478161118", "comment": "Malware payload (Heodo)", "value": "ca28cbd334cc4eac84c51a71e67627d0788653899f69d38739c102f4430d2f83", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353282, "uuid": "fdc2aa06-6bdc-4182-aecf-a97b2c734dac", "comment": "Malware payload (Heodo)", "value": "b72a31da3d8a09e273253010dc2408b87394f7de", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353282, "uuid": "316a1c69-0178-4662-9eae-636c44f184ff", "comment": "Malware payload (Heodo)", "value": "c1bfa5cd91c181ff7f7f4806f81aad56a75345e93c428e7d901af38066d37a4ec3c23fef3125d9e941acb3d31ca06c27", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353282, "uuid": "90a24dea-2de7-4d5f-8a27-709ba0788175", "value": "T12833D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353282, "uuid": "909239ab-2ea6-40be-8991-6ce5ecf10d41", "value": "1536:IAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:xcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353282, "uuid": "5e83815d-bd00-4629-9c2c-31a4a0949611", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353282, "uuid": "47744a1f-75cf-40a1-844d-3e0cd9033136", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353282, "uuid": "6661a0a5-c25d-4bfc-bdcc-7ccea3d60359", "value": "Insight Medical Publishing_6.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af73760-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647353267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353267, "uuid": "47d0bdcd-7a93-4637-b183-98af11accf94", "comment": "Malware payload (Heodo)", "value": "c7f19bb6f44a34eaadca52a4490b3258", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353267, "uuid": "48bf2e9f-9469-4a52-a297-21aba11ef7db", "comment": "Malware payload (Heodo)", "value": "ca37c6b3ee7104d82eb64c2bb2089448f23eb9b2331b311caebd7999a22db077", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353267, "uuid": "5a84d3eb-a9ef-42f7-92a4-0e2105856fb8", "comment": "Malware payload (Heodo)", "value": "e2d6a42128515a95c533fbe5c59bf7b5b8eb4468", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353267, "uuid": "ac89dfe3-d73a-49fd-a0bd-8849c105213d", "comment": "Malware payload (Heodo)", "value": "8fe53f00544dd5ed08d996c809500f1c038b5e74393dcce614a9bcb231c9112336acf26f2034203a6ef1092a01371881", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353267, "uuid": "3e1c263e-47fc-4f81-a9ad-030a53b6a016", "value": "T11333D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353267, "uuid": "ce7dbef1-eab1-4b6e-8ced-17497621be0b", "value": "1536:UAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:9cEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353267, "uuid": "5f29b7f1-eacc-4dbe-8398-b2009b328e84", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353267, "uuid": "4e4e9a46-ad95-4a5e-b7c7-2e5180e35660", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353267, "uuid": "453cbd24-3f26-41e9-b241-e6cfaa0d0b32", "value": "iMedPub LTD_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fa1cd4-a43c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647333831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333831, "uuid": "1982aded-6ef6-40ac-b9e3-9a867dfdeb9c", "comment": "Malware payload (AgentTesla)", "value": "ea6bd0d04407f350d9105aed3a286cb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333831, "uuid": "8336de3f-ef13-4619-8292-7eb2c9795956", "comment": "Malware payload (AgentTesla)", "value": "ca43cdf8ad72cea92e0a0ca66c6e2def569a6b691768f740ef23b393b183eefb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333831, "uuid": "c734e293-2df1-4e9e-a7e8-cb02629ecb36", "comment": "Malware payload (AgentTesla)", "value": "4b80f451d25b508c4741d9283ce63ec0acbaefca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647333831, "uuid": "0e8d9a5d-aea2-472f-8f34-b40008bb1274", "comment": "Malware payload (AgentTesla)", "value": "aae5e39f7e908717f96332bdf8e5f54952001643ab3db06d9c3fe75b4ec78088c2b2c43cd2dc4a774f70b203707e954c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333831, "uuid": "6e7ac1a7-aee0-4739-938f-858fc523b88c", "value": "T175842397F6EB672BD95311B72FB973B89177D2C4021E71230F589E1E6C2287B12012A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333831, "uuid": "77685c02-29f6-4e92-8345-c71b5751c5f8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333831, "uuid": "19a0600e-e727-4647-8ada-d1c916d737f2", "value": "6144:rGi1xfc8UKcA0P360f8xzBKNWOyuIBzNSuG5bsDeGwG8CEvnLbfWq8unmGNU:vc8x0HkKnIBzNSuG5bsDeG18CEvnffgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647333831, "uuid": "2a4b80a0-3ea8-4b31-8e5e-368ba744cf55", "value": 387067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647333831, "uuid": "3a0154ac-8419-4f06-a748-2ffb9806d952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647333831, "uuid": "2d11784d-75ec-46ec-81b2-98df65f5cd65", "value": "PO DRAFT-Mt ch..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b394d224-a469-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647353443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353443, "uuid": "df7af10a-00af-4224-9fdb-c88e22d586a4", "comment": "Malware payload (RemcosRAT)", "value": "fe189108f7e3882377c3474d58ef0be6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353443, "uuid": "399a0685-ea5a-4262-89e9-a194d4cb86ce", "comment": "Malware payload (RemcosRAT)", "value": "cb5fb80d501859604aebdbc7031d3caef572f3d12cf3067712f065a042d13a88", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353443, "uuid": "90c57553-5a78-448d-befb-d1b5e2848ebd", "comment": "Malware payload (RemcosRAT)", "value": "6a79928027ba221053781aec9e382c4dd4c8b882", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353443, "uuid": "4d0f7d4a-f93f-42bd-878c-24970cca656c", "comment": "Malware payload (RemcosRAT)", "value": "e60769a01cd2d4f1490e97c3753983725c134552594ec184c06ac26cbf684f8deb39f9555486589657e03b94e9f519e7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353443, "uuid": "f9cf5cca-c269-4e12-b13c-32169501705d", "value": "T1969259C5E374972DEFB62674DA93843C4FA49F0E2BD2CB0134A4764A15FDB1504E2A2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353443, "uuid": "7b0f29bf-29ea-4d3a-91c5-2017312ae865", "value": "384:xho5mEdeY2K1tENbmV1JYP5GgeqAXVV+RwwHHC75E:xZKRY5ukP57epVVmw8HC7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353443, "uuid": "8c43d96c-8db1-417a-95a1-7ab0caf37a4e", "value": 21016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353443, "uuid": "fdd106a2-3124-4718-905a-11a362bb29e8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353443, "uuid": "45cc09a4-bc41-4c9b-ae73-3fe1c01ab408", "value": "SC-PO Bangalore project DELHI2022-15.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cde8a4-a435-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1647330920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330920, "uuid": "53b568d9-3fb2-4d33-947c-4c90294f20a6", "comment": "Malware payload (AZORult)", "value": "921ca5ce444e4fd3f75c5185a9ce226d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330920, "uuid": "ae7cb410-c453-4df5-bf7e-07e0bcc66c44", "comment": "Malware payload (AZORult)", "value": "cc3cc2b2f00b65d6d83cfcbe21722f8bddbfacbe6fa06452fd6dc9d407bcb3c2", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330920, "uuid": "68d3cebc-af14-456c-8b99-f264498ae939", "comment": "Malware payload (AZORult)", "value": "ac57beaa9a1a7ed048a57949143115cb53990ea1", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647330920, "uuid": "f8d342e1-8d4f-46e6-944e-b57aa3591623", "comment": "Malware payload (AZORult)", "value": "ec26544d70610a994eee1e0ffcdc41d4c4943fb39370def0466e2337aad33e9e30399d9cbf09b566aac2458795abc611", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330920, "uuid": "67323c8e-e2a3-40b4-89d5-b42c19e478ee", "value": "T13CB4232DA35CC7A79D4B25D3D0E53B2FD0CC6D926CE60EB4103AD4E3F99126856AB18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330920, "uuid": "39ae287b-e578-4930-8d8d-25527b9ca148", "value": "12288:Bn7kL7rKlYZZ7b/qMLKIUPCqT/Zp93qr3SFC1NDIph0:hM7rADLdo3tIX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647330920, "uuid": "358d1c03-0ea1-46bb-8f45-e643abfe3944", "value": 510034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647330920, "uuid": "3947db14-438b-492b-99df-62e7d5d6ce02", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647330920, "uuid": "25453520-2a4b-4b3a-962d-5e81aa9fda81", "value": "DELHI-Aircraft- airline spares purchase order-Specifications.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0decf4-a436-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647331368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331368, "uuid": "b572389a-f732-413c-8033-327edbdfbab8", "comment": "Malware payload", "value": "69ff29b86ab5444197aeb0cf5eba0967", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331368, "uuid": "3348ee65-ee3d-43b4-9223-53368bcd3fa1", "comment": "Malware payload", "value": "cc67e663f5f6cea8327e1323ecdb922ae8e48154bbf7bd3f9b2ee2374f61c5d6", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331368, "uuid": "a991e166-72ce-4326-9d2a-43593b64007e", "comment": "Malware payload", "value": "4808cae5e9684e691490a652a93a56005d603643", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647331368, "uuid": "57ea70f8-5939-49df-894a-1ae9f3c5e570", "comment": "Malware payload", "value": "834ab244c8ee09bd0348f9e385ab5d3382a67c20b718c33c822bd0f09bb3bb40e372d11be415175f4b411176af7e4e5c", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331368, "uuid": "a40c720c-1cb9-475c-a23c-007eaadce8c6", "value": "T177E174597883E0B491339AB6ED5FF41CE562602345F99C01BA4C8BC50F3466AA790FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331368, "uuid": "50d9707c-1f7f-4021-8e08-f2715e43cfe7", "value": "96:6imsv4StrH1miKu5gnUJqCZXbVY0XHIHgE4GBuKEBOFcVQ5RJi9qzis:65sv4StBmFUXZ5LXHIHKGYK6OC8PuqzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647331368, "uuid": "8ce6cd1c-3a07-4ed7-adf7-cc14c0d36cc7", "value": 7171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647331368, "uuid": "70cb4f50-b3d7-4610-9f14-6865e1969f72", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647331368, "uuid": "316d75fb-4d84-4ae6-9e7e-76ec5b1efa7f", "value": "cc67e663f5f6cea8327e1323ecdb922ae8e48154bbf7bd3f9b2ee2374f61c5d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863c369a-a466-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647352078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352078, "uuid": "4fa9c5f4-d45b-431e-962e-742175ded9f0", "comment": "Malware payload", "value": "d5d0627af47060e26ef97894f34a4081", "object_relation": "md5", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352078, "uuid": "9ef36c04-2620-46ae-8b02-484ea0d206c1", "comment": "Malware payload", "value": "cce4c37fa13da8953c962809bf9a57190ec37904533965ab1ddc7ffdcb4ab7e6", "object_relation": "sha256", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352078, "uuid": "42ff2494-a0db-49e4-ab7e-cf53888d40c1", "comment": "Malware payload", "value": "58b260016fc80c9be44046242cc047bcfda219d4", "object_relation": "sha1", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647352078, "uuid": "98617afa-aab1-47f5-88b5-b6fbbaf7cc56", "comment": "Malware payload", "value": "76833e84583fc22940e2d40cc0bc13ac55cac8ebbb2db2f23e2d47295bc6d853442740ebfab47bc5f9ab04ece1612e17", "object_relation": "sha3-384", "Tag": [ { "name": "SoftwareUpdate", "colour": "#811139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352078, "uuid": "68113c67-55e4-41bc-bfc2-87443d340e7d", "value": "T1BC429E69C59BA833D27362B8957978C1F08C0EC39140E7CC3009BBCA66563E4AB53E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352078, "uuid": "26f83cca-68a7-4084-b43a-3a6974c93bb0", "value": "192:Q86oNm8OJ2wc3rMKkTPukcx118H111M05AgPekKiD2h0vtm12aav5a:Q86t8IhTuHgH111/eVuhvtm12Dv5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647352078, "uuid": "39503cde-2746-4880-86f2-f9fc557260e2", "value": 12300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647352078, "uuid": "1c0b6420-94d0-4254-b36f-a2ae28b5659a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647352078, "uuid": "08c16add-976a-4596-8e9c-da84d3349fea", "value": "docx (2).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b73d1f-a451-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647342836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342836, "uuid": "8d84813c-8e4e-4dca-b637-bb20f2b5d150", "comment": "Malware payload (Heodo)", "value": "126d3ea0605b44de2d5f254fb2604ea0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342836, "uuid": "aa3da62e-4a80-4b78-83ba-889f73e36397", "comment": "Malware payload (Heodo)", "value": "cd32e7335cbfe8c5cd4a16a41e8c6379dd89ed9a657109f8cd8ddddb4d528599", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342836, "uuid": "374e69f0-9c30-48fd-a2df-877f0bde625b", "comment": "Malware payload (Heodo)", "value": "b3138a04893a46225610c8cd6606751f6654eb85", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342836, "uuid": "e2f19e61-8dd7-4725-9ed7-d3a6fa5f0f34", "comment": "Malware payload (Heodo)", "value": "2ba221a0513aabf271c773c248ff254e7174582966ce7d7499c90405b03e0da3e83d9430b26fc50262406e63c8df848e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342836, "uuid": "2c6d0299-ca20-4f54-9533-46d4d3e94271", "value": "T1A673F11EC222E15ECB2714BCD48F0FE7A54F761929C4E87687D0FA4D17049AA638E71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342836, "uuid": "022b46e8-0547-4c24-9ac6-4ae711f0569c", "value": "1536:6LgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:91WiCtzSmICpH7OZuvZGsM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342836, "uuid": "a2b26b11-747b-495d-a6a1-7ea6389b1c7e", "value": 74757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342836, "uuid": "9ce0276c-1ba7-463c-98c1-ae7764546d1f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342836, "uuid": "0d231198-f78a-4d7c-a2cd-9e9961e55ab0", "value": "DATEI 1503.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f509427-a463-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647350617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350617, "uuid": "e4404f8d-88aa-4591-a035-d16d027ad38a", "comment": "Malware payload (Heodo)", "value": "a905c6c228480c77765798bacd1c59f7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350617, "uuid": "1ec23dcf-30d6-4ca4-99f1-8f325c1f2cae", "comment": "Malware payload (Heodo)", "value": "cd8f20d576df7a3b1fd4536e7f7f98f118fc46204a33ab65f82a0dc1bb632c78", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350617, "uuid": "4d533443-545f-4ba0-ab76-3503811332dd", "comment": "Malware payload (Heodo)", "value": "e0394e779f81cad609cf82ed3f5e5a87e2a99d80", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647350617, "uuid": "5abb146f-89b7-47b1-893d-20ea7d0e6ce6", "comment": "Malware payload (Heodo)", "value": "c2f470145cb64837248bce6b82824cc2a09b5f367c6233070a8293c7573f62fdaed713c8e512c4228d884ee820f5864d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350617, "uuid": "9098d252-5cb0-482f-9812-7281437c9220", "value": "T15733D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350617, "uuid": "82487ae4-714f-4a02-b8df-d3bd9af0a447", "value": "1536:EAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:tcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647350617, "uuid": "78090205-9f31-4f4b-a1f1-35f61376ad50", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647350617, "uuid": "b58e309c-1b0c-4d3e-96a1-3ad5fc6b48ce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647350617, "uuid": "1792ad22-0c36-4124-afd1-c8cb80e7c241", "value": "Frage-zur-Rechnung.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c8156d-a41d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647320885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320885, "uuid": "939d9639-acfc-48db-97bc-df53d4557b56", "comment": "Malware payload", "value": "ec5da41c1fb55eea7bb923d9c5be7057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320885, "uuid": "dc3ce660-dcd5-43af-9a8a-ac48548852d1", "comment": "Malware payload", "value": "cdb800ab5a74920c6005dacafd014ca1452b404c25bfdf9ba4e92e570160c196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320885, "uuid": "986f7c9f-b0e1-46be-8a1f-32cc761e1561", "comment": "Malware payload", "value": "804205afd72ef14761afcef9638565fe046acd8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320885, "uuid": "ad778cab-ee3e-4155-a1af-906dc56a1f04", "comment": "Malware payload", "value": "d672dd213dd0ed2cb32887a17e7ab4591b141255fef0e1e1eeddbd854892a64081bcd15c2ec4b4e029125355ce141a74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320885, "uuid": "dabfda1f-cceb-4b01-9177-366c9c26cfa5", "value": "T1B0930259A2A556E6CA41D2381007A43B1DB66D175011F68EF3F8AD7F0EB0B4BEF60650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320885, "uuid": "234d0c78-b4e2-4065-9212-de6c2f62e26e", "value": "f7d7aebc53da63d60a50b5993b57877a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320885, "uuid": "5195a2f0-582c-4039-a0e3-59c196dfd3f5", "value": "1536:kxnhmuHsywOK6AwqmHYhBO7IMI4prp7/0vtd960e5AseZCyrGVcKMeTdh:yA+XAwVHYtMIYrp7svd60QPyrGVcKV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320885, "uuid": "99e6520d-ce5f-471a-8ef1-ec2aca1161a1", "value": 93976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320885, "uuid": "eb7af2ac-9a49-4352-97af-765165ab2c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320885, "uuid": "2e4e04e0-469f-4c51-8e6d-e26e047e0f49", "value": "cdb800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed781f9-a494-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647371876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371876, "uuid": "9ab648da-bd68-4e83-9e0d-08c5b2dbf3ad", "comment": "Malware payload", "value": "396a0bdd05a934d1c828dd4b2bced38e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371876, "uuid": "8d9fb60e-2f5b-4a03-8898-ac3b87e98414", "comment": "Malware payload", "value": "cdcdbbbacd1776d2cee469b25ad4cc6d1116288d03a1341eb9ac32b757f5a544", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371876, "uuid": "09efe334-7108-4bdc-ab53-c4781c69ae09", "comment": "Malware payload", "value": "d5e815ea26d694344dceeb5f1087e22e5f98cede", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371876, "uuid": "37170a9e-4d8e-4deb-8899-68d26cb00580", "comment": "Malware payload", "value": "39565dbffcd9d06511e9022e8a31fc338c41d192b889928795024c108f0d400e8483cd7267e1b1f4db97e1417d3f3b9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371876, "uuid": "61a31871-aa84-431b-8456-7c6c8de628bd", "value": "T1B2257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371876, "uuid": "9ed588ef-b40c-4740-85be-b8351e4caeb8", "value": "9cf6025d2631a46e01cb03996065b088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371876, "uuid": "f21f91e3-5c19-42dc-ae39-397e6abbe7fe", "value": "12288:tORt+oQnWSdv9mjbaNNlo8XKlaOlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8il65Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647371876, "uuid": "ac76b193-214c-494b-af5b-bb93e89f3ef4", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647371876, "uuid": "7cd1c8a5-b810-4c42-98d2-17bdb0ee8ea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371876, "uuid": "5e1b4998-069d-4d2f-84da-ecef84b48e98", "value": "396a0bdd05a934d1c828dd4b2bced38e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0575e03-a468-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647353035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353035, "uuid": "dfd3df5e-e9ed-41d3-9a84-9f6f21bba6bc", "comment": "Malware payload", "value": "6eaf4b2f67fa41762b5cfefc2ec67e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353035, "uuid": "aa559f45-eeca-4070-8917-8063ce90e9f6", "comment": "Malware payload", "value": "cdd12576c48c2123efbc19404d37cc9505c80d8378f37e793a4b0ecb02aa2361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353035, "uuid": "4404ebd5-850c-42a2-8391-455a5654a455", "comment": "Malware payload", "value": "5c910ecb57f7a1016ae972058e9b785e3b4e232b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647353035, "uuid": "00867bec-ebd9-40b1-808f-5fabc4b56c36", "comment": "Malware payload", "value": "38f10c4ec74d97ade78aa4f49519727c01effc9686d6c9c6eed793d0c1b583a8321475b761290953d242760d99d702da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353035, "uuid": "5996e7da-ccb4-4420-a93a-3c3ceb6c2dc3", "value": "T1BCF5F1AE21543368C42AC4389523B846F1F2751E07B497DF76D7FEC13B6B990E52AB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353035, "uuid": "5a7c845e-a93e-4e08-b11b-4ab11aa6addc", "value": "f41bd45d825b0e2e44373b89f24d3e52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353035, "uuid": "2faa8106-e7fe-41a3-b147-c785a7166a4d", "value": "98304:7tioJNgpGQoF7cc/KFq0bEoypkEdEQ/nCEG+nB:7Veg7LyFq0bK1dEQ/nCx+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647353035, "uuid": "6d15bcd7-2323-4f65-b3cf-b8e1069783ab", "value": 3366912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647353035, "uuid": "ab66589c-3e25-4055-b83a-c9ccce149d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647353035, "uuid": "ad544ca5-2b75-4892-88a6-613d9c10729a", "value": "6eaf4b2f67fa41762b5cfefc2ec67e79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c74bafb-a494-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647371846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371846, "uuid": "8bf46854-b3d3-472c-9dc1-c3f230801f0e", "comment": "Malware payload (Mirai)", "value": "2ff80eac92193266050b46ebf88c1d7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371846, "uuid": "5b8b8af1-b03d-4d4a-a10a-1d9e52645612", "comment": "Malware payload (Mirai)", "value": "ce75d3930059c663b0cf39425f6591e21d9bf5c53d3592a51218ae8f7481019f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371846, "uuid": "06254d9b-ebff-4b62-970e-fb29aae24e9e", "comment": "Malware payload (Mirai)", "value": "ee96b942764f2b8c97034082f4f29f13bea564a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647371846, "uuid": "e23f8359-cc96-415a-ae96-965f03c70526", "comment": "Malware payload (Mirai)", "value": "60b2955f160ec7c2fd95a0dde6520828c7fc0d66bccf493e137b30718e96f106fc6aee11a6c15b6a79347771955642c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371846, "uuid": "85d5bf2e-9b61-42ca-b537-1cd8955f5aa3", "value": "T1C6B2D1C2C24D9053C1F12C30FFBD895E62698BB977DA303A550C866CE7682D998FA5D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371846, "uuid": "22c18cc2-b756-48c7-8753-db1d10609508", "value": "384:Em9gqxDVxRDbjVc6q64xPaPiqgD+xBcbFnv9DCHWPtBcrpo51d7GBjLOmdGU5Ea:EADVxRnjVcFoPTgD5FvRnKpo5j3UJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647371846, "uuid": "cf8d0d04-e652-4a10-af89-ae90a40b67de", "value": 25260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647371846, "uuid": "e3fdd4e6-361b-4312-8904-635b98d2b048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647371846, "uuid": "2d54bb82-27ea-4d6f-b6de-9691f38bf0a9", "value": "2ff80eac92193266050b46ebf88c1d7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbc5ef5-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "beea7959-4438-4b1f-9287-51282b66b578", "comment": "Malware payload (Heodo)", "value": "ff2c110d2f8e2970b641e0a587b5f116", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "046ebde9-aada-48b9-8ff4-aff9a658210a", "comment": "Malware payload (Heodo)", "value": "ce8529b410468bc1840ec496e0e9552b6950bc8a1b0be77cc060bc169ea06518", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "5fc778ad-3b74-4cd4-8bf6-0e78ea5c7518", "comment": "Malware payload (Heodo)", "value": "1d23ead292ec58d1e53b859620fccffc4397f24a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302695, "uuid": "897cf618-7076-465e-818b-1131584282bf", "comment": "Malware payload (Heodo)", "value": "cd305bbe19c413bac1fc39d36a0bfaa6157cb44d73c059800fd82c007f7d4c7dc3eb33078eb88c8d5e935b9423bd4dd0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "7c04cb91-c507-4004-86ad-e60c4e90d12b", "value": "T1C2256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "9ea47d9f-7fc1-47ba-8eeb-2be9e3620ed9", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "114082ab-b2c6-477a-9328-4bd3ff88a21f", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkhwLBeUNKsuG31Pt8H:3dlV0EnITrwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302695, "uuid": "0df60ccc-f3b2-423b-8d8d-ffcf4093120b", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302695, "uuid": "318a3e9f-67de-4124-ac9e-79711a3cea38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302695, "uuid": "cc07ce81-2c0f-4497-a00e-4997a062221a", "value": "emotet_exe_e4_ce8529b410468bc1840ec496e0e9552b6950bc8a1b0be77cc060bc169ea06518_2022-03-15__000447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca11877-a41d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647320897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320897, "uuid": "dfb2e63a-50bb-4f9c-bb2e-42550369652c", "comment": "Malware payload", "value": "c8a73a64f2cce65d8bea76193910600a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320897, "uuid": "f20859a3-1922-4d5d-b17e-c891bd46eb82", "comment": "Malware payload", "value": "ceb0c5f7369e17246d0302339b55492332592b5b0b0be6f684807a63b31204a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320897, "uuid": "2f52b332-1d3d-47b5-8e43-b3a82f0b0006", "comment": "Malware payload", "value": "7c6dba749d07ee0a34354918fb85e0dd4b7c0799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647320897, "uuid": "430f6c3f-f716-4a03-88e2-1c6ef3119575", "comment": "Malware payload", "value": "74616b96af06074a770a9879a5a58600621dbaebd63036d61cb333835c1547d0b01583bb0c7a64cddfa4c4f3e2bff550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320897, "uuid": "e2415e5a-df2c-411a-8fbe-9f75dc590776", "value": "T1A945AD1B2C505E3BC3B24E38C6687191E6FE17CC1F4A34D72B94041A3E26DF76676A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320897, "uuid": "4e8bae7f-88a2-412a-a330-9862e351537d", "value": "abb0de2487df1f4b90213cc8b2e4d179", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320897, "uuid": "81245581-5bcf-4766-8fae-886ae725662e", "value": "24576:n66MKlCMwSY6NxEZf/dgmG32LQkKYd8woik1HW:nsKM6NYKmS2EkKGrwHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647320897, "uuid": "50d203e9-fc5c-4243-848b-bf85d5babc84", "value": 1202176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647320897, "uuid": "be108a1c-3da8-4512-9b58-dddc10fd3ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647320897, "uuid": "fe759000-3945-4095-a2df-92c18891501a", "value": "ceb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9c8299-a3f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647302693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "d75d50fb-a1af-4a8c-aaa5-2063b8a095f2", "comment": "Malware payload (Heodo)", "value": "fd89f15c5f77d4669f9ae02e3a712140", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "ecc10194-2a6f-46b6-a4e7-80a275887553", "comment": "Malware payload (Heodo)", "value": "ceb38948c3eaae9e6ba83db2778e32b2b01a66640a33fca762df81209e6a5fd6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "5eba4cf7-b306-4eb9-9aa1-eafd9bbb6fda", "comment": "Malware payload (Heodo)", "value": "caae83a99c4485416e20ec9ebd768501e28293d8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647302693, "uuid": "62cd5a94-c956-4563-85f8-0422f3e15737", "comment": "Malware payload (Heodo)", "value": "95fc4cfa8fc98f2911b5e7986482fbaa22f06c9a84ffe7d0530e491065b55dafa214d26ac477b900525176d7d8056e24", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "b8809e8e-b911-4ba2-9832-b3f88d396413", "value": "T1EF256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "f9594fd7-99c9-49c9-a88d-599abc6bd58b", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "93eeee9c-8191-4b21-8676-c16cadb2a11b", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkzwLBeUNKsuG31Pt8H:3dlV0EnITFwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647302693, "uuid": "6d5a4182-6e64-4f03-a9a4-ea3d9c5fd0d6", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647302693, "uuid": "ab07c24f-ef8d-4313-8619-bafe9bb02c24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647302693, "uuid": "c5426b2e-1bd5-43f0-a7ab-91b73c3350fd", "value": "emotet_exe_e4_ceb38948c3eaae9e6ba83db2778e32b2b01a66640a33fca762df81209e6a5fd6_2022-03-15__000446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230a0ccb-a451-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647342892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342892, "uuid": "23be6ce0-ed8a-45c8-a114-7cd260c7ca97", "comment": "Malware payload (Heodo)", "value": "477a29ddb5b5307ace92c07fd74ea063", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342892, "uuid": "36e9dbd0-589f-4ef8-a36b-d06799679f97", "comment": "Malware payload (Heodo)", "value": "cef35300b151f9eaa0b368526861d6c5797f8509ee7a321ecb79c8e89c52636a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342892, "uuid": "ebaa7264-317d-49c0-848d-5db91a31765a", "comment": "Malware payload (Heodo)", "value": "4ec96e637363bd41f3003318f9f0177a5138583c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647342892, "uuid": "69653943-6087-465f-9981-b7e61bb8f20d", "comment": "Malware payload (Heodo)", "value": "462e19244ae284e6b8162d82aa36b65c773a1ba5b98a36ee564ec201157a4acf666bf06914c8e17aa5d0a5192007cca8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342892, "uuid": "2ad91ec4-f359-4e82-93d6-8d8caf5033dd", "value": "T13173F11EC222E15ECB2714BCD48F0FE7A54F761929C4E87687D0FA4D17049AA638E71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342892, "uuid": "81522f26-8f3f-40d5-a069-f15f03e556f1", "value": "1536:mLgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:B1WiCtzSmICpH7OZuvZGsM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647342892, "uuid": "bf2e1292-032a-4672-b1e4-32550a32bde9", "value": 74757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647342892, "uuid": "5e9ddae9-0291-4d6b-92d2-264845acc2fa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647342892, "uuid": "3f40f558-8eb6-43ec-bc07-2eaa5145d718", "value": "Datei-15032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d87f19-a46e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647355703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355703, "uuid": "b8c09a8d-8531-4fe5-8232-07ba2bfa9342", "comment": "Malware payload (AgentTesla)", "value": "c4a95ca000fde758d15acdf7e63d7f09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355703, "uuid": "3ae9595f-1ef3-4afc-9a2b-dfb02828141b", "comment": "Malware payload (AgentTesla)", "value": "cf3d34b8ae35248e2a3894ab18b95ca6b9a1432bb1951839d7bb70a4f1b5a99f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355703, "uuid": "34a9cb7c-2e94-4453-976b-6ed6cdcb524e", "comment": "Malware payload (AgentTesla)", "value": "4192351ccb2ea68e96bd0075ae543945c7afa0c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647355703, "uuid": "5480b6c3-7bb8-427c-b471-1267b25a0123", "comment": "Malware payload (AgentTesla)", "value": "85c656ca1eb7f3de925bd3313ad61d02a3d2df0cfadaabb5f8409c2f80b4669348a939100ada8f6e52a793ace3257b0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647355703, "uuid": "0cb67709-12ec-4e58-85de-87e4285b1b5a", "value": "T154B423F755FCF2E8386A20DA0A2C91752623D6173FB0643B23DE6239885DF401F4A5B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647355703, "uuid": "2fbeb73d-391c-47d1-8c96-5fafd482c2f0", "value": "12288:nzUG/ACQLuu3aNReqcC4AR68ArvcEFFcE+Zw5fgR1ktvO:nzT/6ah4Z8cvkE++mktG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647355703, "uuid": "29be002b-85f5-4df0-b22d-ce75b13f5555", "value": 498628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647355703, "uuid": "528877c1-ac9f-42d7-8669-9d935d9309a0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647355703, "uuid": "8e326953-4c5c-46b3-8a34-3c084adcacd8", "value": "Bid RFQ_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15435884-a460-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647349312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349312, "uuid": "1d54f77a-c4a1-4f7b-a89d-a5956b104cbe", "comment": "Malware payload (Loki)", "value": "f6036e802bb253a20c30600f01e0efaa", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647349312, "uuid": "390b706a-fffe-4ea0-9c02-e0350cdbce55", "comment": "Malware payload (Loki)", "value": "cf428aa93ac3f8f596abece089fd497bce404e1542efae6298339392e4d8f9fb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exporta